mihari 7.1.1 → 7.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8ea0adf73bba53f264c22f8885d44e24de5657a2a77c2b7ea3533bb5acf6e78b
-  data.tar.gz: 77ab077d9322a22b0e399c81c057485aec1c4cdb1a14f15cbd81f1a3650f37a6
+  metadata.gz: 52d1c8320fdb5233c9738f3b4599868260fef892599cdfb42da6c3af17583b75
+  data.tar.gz: 625cd92558eff5a4d5613e588cc5ee85b9b714a9af211788da1a294d8d54ac45
 SHA512:
-  metadata.gz: 3b68702c146819189140c0c5626c27f7b53f94021dd21138f0ac2758366486cebb7c450e0168f76cfc3d9940ee86eb2b279eb1725a3922614f51930dcb0e6b71
-  data.tar.gz: e30c01360a6d382e73a8e88a40a5cd3f1dba6bac9ebbbe9b87b9b51cff4a6dc59676d19eec4fe757a3a40d78a560886e434802b74fdf125e663b73ae4c7abd8a
+  metadata.gz: 96811d3ebfffcb27a7577b814be280916dd46bd3477233374ffafd2bf784d9e5133f89b1d7650c722c25e2f678f82380f5ced2eff8f9b7e1f3c96583f54a1114
+  data.tar.gz: 5c13581e670c7aff158e93335fe9c626294cad622f153e61a338f31bb5a1e459302f34a3a9ddf18e0bb322e1359c43a6b782387cdc800f9b047c04e5521f4c70

data/lib/mihari/actor.rb

@@ -55,7 +55,7 @@ module Mihari
 
       joined = self.class.configuration_keys.join(", ")
       be = (self.class.configuration_keys.length > 1) ? "are" : "is"
-      message = "#{self.class.class_key} is not configured correctly. #{joined} #{be} missing."
+      message = "#{self.class.key} is not configured correctly. #{joined} #{be} missing."
       raise ConfigurationError, message
     end
 
@@ -75,22 +75,22 @@ module Mihari
       #
       # @return [String]
       #
-      def class_key
+      def key
         to_s.split("::").last.downcase
       end
 
       #
       # @return [Array<String>, nil]
       #
-      def class_key_aliases
+      def key_aliases
         nil
       end
 
       #
       # @return [Array<String>]
       #
-      def class_keys
-        ([class_key] + [class_key_aliases]).flatten.compact.map(&:downcase)
+      def keys
+        ([key] + [key_aliases]).flatten.compact.map(&:downcase)
       end
     end
   end

data/lib/mihari/analyzers/base.rb

@@ -65,7 +65,7 @@ module Mihari
           # It is set automatically in #initialize
           artifact = artifact.is_a?(Models::Artifact) ? artifact : Models::Artifact.new(data: artifact)
 
-          artifact.source = self.class.class_key
+          artifact.source = self.class.key
           artifact.query = query
 
           artifact
@@ -93,14 +93,23 @@ module Mihari
         return result if result.success?
 
         # Wrap failure with AnalyzerError to explicitly name a failed analyzer
-        error = AnalyzerError.new(result.failure.message, self.class.class_key, cause: result.failure)
+        error = AnalyzerError.new(result.failure.message, self.class.key, cause: result.failure)
         return Failure(error) unless ignore_error?
 
         # Return Success if ignore_error? is true with logging
-        Mihari.logger.warn("Analyzer:#{self.class.class_key} failed - #{result.failure}")
+        Mihari.logger.warn("Analyzer:#{self.class.key} with #{truncated_query} failed - #{result.failure}")
         Success([])
       end
 
+      #
+      # Truncate query for logging
+      #
+      # @return [String]
+      #
+      def truncated_query
+        query.truncate(32)
+      end
+
       class << self
         #
         # Initialize an analyzer by query params

data/lib/mihari/analyzers/passivetotal.rb

@@ -57,7 +57,7 @@ module Mihari
         #
         # @return [Array<String>, nil]
         #
-        def class_key_aliases
+        def key_aliases
           ["pt"]
         end
       end

data/lib/mihari/analyzers/securitytrails.rb

@@ -51,7 +51,7 @@ module Mihari
         #
         # @return [Array<String>, nil]
         #
-        def class_key_aliases
+        def key_aliases
           ["st"]
         end
       end

data/lib/mihari/analyzers/virustotal.rb

@@ -46,7 +46,7 @@ module Mihari
         #
         # @return [Array<String>, nil]
         #
-        def class_key_aliases
+        def key_aliases
           ["vt"]
         end
       end

data/lib/mihari/analyzers/virustotal_intelligence.rb

@@ -34,14 +34,14 @@ module Mihari
         #
         # @return [String]
         #
-        def class_key
+        def key
           "virustotal_intelligence"
         end
 
         #
         # @return [Array<String>, nil]
         #
-        def class_key_aliases
+        def key_aliases
           ["vt_intel"]
         end
       end

data/lib/mihari/constants.rb

@@ -5,7 +5,7 @@ module Mihari
   DEFAULT_DATA_TYPES = Types::DataTypes.values.freeze
 
   # @return [Array<Hash>]
-  DEFAULT_EMITTERS = Emitters::Database.class_keys.map { |name| { emitter: name.downcase } }.freeze
+  DEFAULT_EMITTERS = Emitters::Database.keys.map { |name| { emitter: name.downcase } }.freeze
 
   # @return [Array<Hash>]
   DEFAULT_ENRICHERS = Mihari.enricher_to_class.keys.map { |name| { enricher: name.downcase } }.freeze

data/lib/mihari/emitters/base.rb

@@ -19,6 +19,14 @@ module Mihari
         @rule = rule
       end
 
+      # A target to emit the data
+      #
+      # @return [String]
+      #
+      def target
+        raise NotImplementedError, "You must implement #{self.class}##{__method__}"
+      end
+
       #
       # @param [Array<Mihari::Models::Artifact>] artifacts
       #
@@ -38,7 +46,9 @@ module Mihari
           ) { call(artifacts) }
         end.to_result
 
-        Mihari.logger.warn("Emitter:#{self.class.class_key} failed - #{result.failure}") if result.failure?
+        if result.failure?
+          Mihari.logger.warn("Emitter:#{self.class.key} for #{target.truncate(32)} failed - #{result.failure}")
+        end
 
         result
       end

data/lib/mihari/emitters/database.rb

@@ -21,6 +21,10 @@ module Mihari
         alert
       end
 
+      def target
+        Mihari.config.database_url.host || Mihari.config.database_url.to_s
+      end
+
       class << self
         def configuration_keys
           %w[database_url]

data/lib/mihari/emitters/misp.rb

@@ -56,6 +56,13 @@ module Mihari
         })
       end
 
+      #
+      # @return [String]
+      #
+      def target
+        URI(url).host || "N/A"
+      end
+
       class << self
         def configuration_keys
           %w[misp_url misp_api_key]

data/lib/mihari/emitters/slack.rb

@@ -165,6 +165,13 @@ module Mihari
         webhook_url?
       end
 
+      #
+      # @return [String]
+      #
+      def target
+        channel
+      end
+
       #
       # @return [::Slack::Notifier]
       #

data/lib/mihari/emitters/the_hive.rb

@@ -33,6 +33,13 @@ module Mihari
         api_key? && url?
       end
 
+      #
+      # @return [String]
+      #
+      def target
+        URI(url).host || "N/A"
+      end
+
       #
       # Create a Hive alert
       #

data/lib/mihari/emitters/webhook.rb

@@ -55,6 +55,13 @@ module Mihari
         %w[http https].include? url.scheme.downcase
       end
 
+      #
+      # @return [String]
+      #
+      def target
+        URI(url).host || "N/A"
+      end
+
       #
       # @param [Array<Mihari::Models::Artifact>] artifacts
       #

data/lib/mihari/enrichers/base.rb

@@ -33,7 +33,9 @@ module Mihari
           ) { call value }
         end.to_result
 
-        Mihari.logger.warn("Enricher:#{self.class.class_key} failed: #{result.failure}") if result.failure?
+        if result.failure?
+          Mihari.logger.warn("Enricher:#{self.class.key} for #{value.truncate(32)} failed: #{result.failure}")
+        end
 
         result
       end

data/lib/mihari/enrichers/google_public_dns.rb

@@ -21,7 +21,7 @@ module Mihari
         #
         # @return [String]
         #
-        def class_key
+        def key
           "google_public_dns"
         end
       end

data/lib/mihari/schemas/analyzer.rb

@@ -10,12 +10,12 @@ module Mihari
 
       # Analyzer with API key and pagination
       [
-        Mihari::Analyzers::BinaryEdge.class_keys,
-        Mihari::Analyzers::GreyNoise.class_keys,
-        Mihari::Analyzers::Onyphe.class_keys,
-        Mihari::Analyzers::Shodan.class_keys,
-        Mihari::Analyzers::Urlscan.class_keys,
-        Mihari::Analyzers::VirusTotalIntelligence.class_keys
+        Mihari::Analyzers::BinaryEdge.keys,
+        Mihari::Analyzers::GreyNoise.keys,
+        Mihari::Analyzers::Onyphe.keys,
+        Mihari::Analyzers::Shodan.keys,
+        Mihari::Analyzers::Urlscan.keys,
+        Mihari::Analyzers::VirusTotalIntelligence.keys
       ].each do |keys|
         key = keys.first
         const_set(key.upcase, Dry::Schema.Params do
@@ -28,10 +28,10 @@ module Mihari
 
       # Analyzer with API key
       [
-        Mihari::Analyzers::OTX.class_keys,
-        Mihari::Analyzers::Pulsedive.class_keys,
-        Mihari::Analyzers::VirusTotal.class_keys,
-        Mihari::Analyzers::SecurityTrails.class_keys
+        Mihari::Analyzers::OTX.keys,
+        Mihari::Analyzers::Pulsedive.keys,
+        Mihari::Analyzers::VirusTotal.keys,
+        Mihari::Analyzers::SecurityTrails.keys
       ].each do |keys|
         key = keys.first
         const_set(key.upcase, Dry::Schema.Params do
@@ -43,13 +43,13 @@ module Mihari
       end
 
       DNSTwister = Dry::Schema.Params do
-        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::DNSTwister.class_keys))
+        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::DNSTwister.keys))
         required(:query).value(:string)
         optional(:options).hash(AnalyzerOptions)
       end
 
       Censys = Dry::Schema.Params do
-        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::Censys.class_keys))
+        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::Censys.keys))
         required(:query).value(:string)
         optional(:id).value(:string)
         optional(:secret).value(:string)
@@ -57,7 +57,7 @@ module Mihari
       end
 
       CIRCL = Dry::Schema.Params do
-        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::CIRCL.class_keys))
+        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::CIRCL.keys))
         required(:query).value(:string)
         optional(:username).value(:string)
         optional(:password).value(:string)
@@ -65,7 +65,7 @@ module Mihari
       end
 
       Fofa = Dry::Schema.Params do
-        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::Fofa.class_keys))
+        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::Fofa.keys))
         required(:query).value(:string)
         optional(:api_key).value(:string)
         optional(:email).value(:string)
@@ -73,7 +73,7 @@ module Mihari
       end
 
       PassiveTotal = Dry::Schema.Params do
-        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::PassiveTotal.class_keys))
+        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::PassiveTotal.keys))
         required(:query).value(:string)
         optional(:username).value(:string)
         optional(:api_key).value(:string)
@@ -81,14 +81,14 @@ module Mihari
       end
 
       ZoomEye = Dry::Schema.Params do
-        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::ZoomEye.class_keys))
+        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::ZoomEye.keys))
         required(:query).value(:string)
         required(:type).value(Types::String.enum("host", "web"))
         optional(:options).hash(AnalyzerPaginationOptions)
       end
 
       Crtsh = Dry::Schema.Params do
-        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::Crtsh.class_keys))
+        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::Crtsh.keys))
         required(:query).value(:string)
         optional(:exclude_expired).value(:bool).default(true)
         optional(:match).value(Types::String.enum("=", "ILIKE", "LIKE", "single", "any", "FTS")).default(nil)
@@ -96,7 +96,7 @@ module Mihari
       end
 
       HunterHow = Dry::Schema.Params do
-        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::HunterHow.class_keys))
+        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::HunterHow.keys))
         required(:query).value(:string)
         required(:start_time).value(:date)
         required(:end_time).value(:date)
@@ -105,7 +105,7 @@ module Mihari
       end
 
       Feed = Dry::Schema.Params do
-        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::Feed.class_keys))
+        required(:analyzer).value(Types::String.enum(*Mihari::Analyzers::Feed.keys))
         required(:query).value(:string)
         required(:selector).value(:string)
         optional(:method).value(Types::HTTPRequestMethods).default("GET")

data/lib/mihari/schemas/emitter.rb

@@ -9,33 +9,33 @@ module Mihari
       extend Concerns::Orrable
 
       Database = Dry::Schema.Params do
-        required(:emitter).value(Types::String.enum(*Mihari::Emitters::Database.class_keys))
+        required(:emitter).value(Types::String.enum(*Mihari::Emitters::Database.keys))
         optional(:options).hash(Options)
       end
 
       MISP = Dry::Schema.Params do
-        required(:emitter).value(Types::String.enum(*Mihari::Emitters::MISP.class_keys))
+        required(:emitter).value(Types::String.enum(*Mihari::Emitters::MISP.keys))
         optional(:url).value(:string)
         optional(:api_key).value(:string)
         optional(:options).hash(Options)
       end
 
       TheHive = Dry::Schema.Params do
-        required(:emitter).value(Types::String.enum(*Mihari::Emitters::TheHive.class_keys))
+        required(:emitter).value(Types::String.enum(*Mihari::Emitters::TheHive.keys))
         optional(:url).value(:string)
         optional(:api_key).value(:string)
         optional(:options).hash(Options)
       end
 
       Slack = Dry::Schema.Params do
-        required(:emitter).value(Types::String.enum(*Mihari::Emitters::Slack.class_keys))
+        required(:emitter).value(Types::String.enum(*Mihari::Emitters::Slack.keys))
         optional(:webhook_url).value(:string)
         optional(:channel).value(:string)
         optional(:options).hash(Options)
       end
 
       Webhook = Dry::Schema.Params do
-        required(:emitter).value(Types::String.enum(*Mihari::Emitters::Webhook.class_keys))
+        required(:emitter).value(Types::String.enum(*Mihari::Emitters::Webhook.keys))
         required(:url).value(:string)
         optional(:method).value(Types::HTTPRequestMethods).default("POST")
         optional(:headers).value(:hash).default({})

data/lib/mihari/schemas/enricher.rb

@@ -9,22 +9,22 @@ module Mihari
       extend Concerns::Orrable
 
       MMDB = Dry::Schema.Params do
-        required(:enricher).value(Types::String.enum(*Mihari::Enrichers::MMDB.class_keys))
+        required(:enricher).value(Types::String.enum(*Mihari::Enrichers::MMDB.keys))
         optional(:options).hash(Options)
       end
 
       Whois = Dry::Schema.Params do
-        required(:enricher).value(Types::String.enum(*Mihari::Enrichers::Whois.class_keys))
+        required(:enricher).value(Types::String.enum(*Mihari::Enrichers::Whois.keys))
         optional(:options).hash(Options)
       end
 
       Shodan = Dry::Schema.Params do
-        required(:enricher).value(Types::String.enum(*Mihari::Enrichers::Shodan.class_keys))
+        required(:enricher).value(Types::String.enum(*Mihari::Enrichers::Shodan.keys))
         optional(:options).hash(Options)
       end
 
       GooglePublicDNS = Dry::Schema.Params do
-        required(:enricher).value(Types::String.enum(*Mihari::Enrichers::GooglePublicDNS.class_keys))
+        required(:enricher).value(Types::String.enum(*Mihari::Enrichers::GooglePublicDNS.keys))
         optional(:options).hash(Options)
       end
     end

data/lib/mihari/structs/config.rb

@@ -68,7 +68,7 @@ module Mihari
           begin
             instance = get_dummy(klass)
             new(
-              name: klass.class_key,
+              name: klass.key,
               items: klass.configuration_items,
               configured: instance.configured?,
               type: type

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "7.1.1"
+  VERSION = "7.1.2"
 end