mihari 7.2.0 → 7.3.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/Dockerfile +1 -1
- data/lib/mihari/actor.rb +7 -0
- data/lib/mihari/analyzers/base.rb +0 -7
- data/lib/mihari/enrichers/base.rb +54 -12
- data/lib/mihari/enrichers/google_public_dns.rb +28 -7
- data/lib/mihari/enrichers/mmdb.rb +25 -7
- data/lib/mihari/enrichers/shodan.rb +35 -4
- data/lib/mihari/enrichers/whois.rb +32 -24
- data/lib/mihari/models/alert.rb +12 -0
- data/lib/mihari/models/artifact.rb +105 -181
- data/lib/mihari/models/rule.rb +21 -0
- data/lib/mihari/rule.rb +27 -6
- data/lib/mihari/schemas/alert.rb +3 -3
- data/lib/mihari/schemas/analyzer.rb +27 -27
- data/lib/mihari/schemas/emitter.rb +9 -9
- data/lib/mihari/schemas/macros.rb +2 -2
- data/lib/mihari/schemas/options.rb +2 -5
- data/lib/mihari/schemas/rule.rb +12 -12
- data/lib/mihari/services/builders.rb +0 -153
- data/lib/mihari/services/enrichers.rb +1 -1
- data/lib/mihari/services/getters.rb +1 -1
- data/lib/mihari/version.rb +1 -1
- data/lib/mihari/web/public/assets/{index-GWurHG1o.js → index-JHS0L8KZ.js} +29 -29
- data/lib/mihari/web/public/index.html +1 -1
- data/mihari.gemspec +2 -2
- data/requirements.txt +1 -1
- metadata +7 -7
@@ -20,158 +20,5 @@ module Mihari
|
|
20
20
|
Rule.from_yaml ERB.new(File.read(path_or_id)).result
|
21
21
|
end
|
22
22
|
end
|
23
|
-
|
24
|
-
#
|
25
|
-
# Autonomous system builder
|
26
|
-
#
|
27
|
-
class AutonomousSystemBuilder < Service
|
28
|
-
#
|
29
|
-
# @param [String] ip
|
30
|
-
# @param [Mihari::Enrichers::MMDB] enricher
|
31
|
-
#
|
32
|
-
# @return [Mihari::Models::AutonomousSystem, nil]
|
33
|
-
#
|
34
|
-
def call(ip, enricher: Enrichers::MMDB.new)
|
35
|
-
enricher.result(ip).fmap do |res|
|
36
|
-
Models::AutonomousSystem.new(number: res.asn) if res.asn
|
37
|
-
end.value_or nil
|
38
|
-
end
|
39
|
-
end
|
40
|
-
|
41
|
-
#
|
42
|
-
# CPE builder
|
43
|
-
#
|
44
|
-
class CPEBuilder < Service
|
45
|
-
#
|
46
|
-
# Build CPEs
|
47
|
-
#
|
48
|
-
# @param [String] ip
|
49
|
-
# @param [Mihari::Enrichers::Shodan] enricher
|
50
|
-
#
|
51
|
-
# @return [Array<Mihari::Models::CPE>]
|
52
|
-
#
|
53
|
-
def call(ip, enricher: Enrichers::Shodan.new)
|
54
|
-
enricher.result(ip).fmap do |res|
|
55
|
-
(res&.cpes || []).map { |cpe| Models::CPE.new(name: cpe) }
|
56
|
-
end.value_or []
|
57
|
-
end
|
58
|
-
end
|
59
|
-
|
60
|
-
#
|
61
|
-
# DNS record builder
|
62
|
-
#
|
63
|
-
class DnsRecordBuilder < Service
|
64
|
-
#
|
65
|
-
# Build DNS records
|
66
|
-
#
|
67
|
-
# @param [String] domain
|
68
|
-
# @param [Mihari::Enrichers::Shodan] enricher
|
69
|
-
#
|
70
|
-
# @return [Array<Mihari::Models::DnsRecord>]
|
71
|
-
#
|
72
|
-
def call(domain, enricher: Enrichers::GooglePublicDNS.new)
|
73
|
-
enricher.result(domain).fmap do |res|
|
74
|
-
res.answers.map { |answer| Models::DnsRecord.new(resource: answer.resource_type, value: answer.data) }
|
75
|
-
end.value_or []
|
76
|
-
end
|
77
|
-
end
|
78
|
-
|
79
|
-
#
|
80
|
-
# Geolocation builder
|
81
|
-
#
|
82
|
-
class GeolocationBuilder < Service
|
83
|
-
#
|
84
|
-
# Build Geolocation
|
85
|
-
#
|
86
|
-
# @param [String] ip
|
87
|
-
# @param [Mihari::Enrichers::MMDB] enricher
|
88
|
-
#
|
89
|
-
# @return [Mihari::Models::Geolocation, nil]
|
90
|
-
#
|
91
|
-
def call(ip, enricher: Enrichers::MMDB.new)
|
92
|
-
enricher.result(ip).fmap do |res|
|
93
|
-
if res.country_code
|
94
|
-
Models::Geolocation.new(
|
95
|
-
country: NormalizeCountry(res.country_code, to: :short),
|
96
|
-
country_code: res.country_code
|
97
|
-
)
|
98
|
-
end
|
99
|
-
end.value_or nil
|
100
|
-
end
|
101
|
-
end
|
102
|
-
|
103
|
-
#
|
104
|
-
# Port builder
|
105
|
-
#
|
106
|
-
class PortBuilder < Service
|
107
|
-
#
|
108
|
-
# Build ports
|
109
|
-
#
|
110
|
-
# @param [String] ip
|
111
|
-
# @param [Mihari::Enrichers::Shodan] enricher
|
112
|
-
#
|
113
|
-
# @return [Array<Mihari::Models::Port>]
|
114
|
-
#
|
115
|
-
def call(ip, enricher: Enrichers::Shodan.new)
|
116
|
-
enricher.result(ip).fmap do |res|
|
117
|
-
(res&.ports || []).map { |port| Models::Port.new(number: port) }
|
118
|
-
end.value_or []
|
119
|
-
end
|
120
|
-
end
|
121
|
-
|
122
|
-
#
|
123
|
-
# Reverse DNS name builder
|
124
|
-
#
|
125
|
-
class ReverseDnsNameBuilder < Service
|
126
|
-
#
|
127
|
-
# Build reverse DNS names
|
128
|
-
#
|
129
|
-
# @param [String] ip
|
130
|
-
# @param [Mihari::Enrichers::Shodan] enricher
|
131
|
-
#
|
132
|
-
# @return [Array<Mihari::Models::ReverseDnsName>]
|
133
|
-
#
|
134
|
-
def call(ip, enricher: Enrichers::Shodan.new)
|
135
|
-
enricher.result(ip).fmap do |res|
|
136
|
-
(res&.hostnames || []).map { |name| Models::ReverseDnsName.new(name: name) }
|
137
|
-
end.value_or []
|
138
|
-
end
|
139
|
-
end
|
140
|
-
|
141
|
-
#
|
142
|
-
# Vulnerability builder
|
143
|
-
#
|
144
|
-
class VulnerabilityBuilder < Service
|
145
|
-
#
|
146
|
-
# Build vulnerabilities
|
147
|
-
#
|
148
|
-
# @param [String] ip
|
149
|
-
# @param [Mihari::Enrichers::Shodan] enricher
|
150
|
-
#
|
151
|
-
# @return [Array<Mihari::Models::Vulnerability>]
|
152
|
-
#
|
153
|
-
def call(ip, enricher: Enrichers::Shodan.new)
|
154
|
-
enricher.result(ip).fmap do |res|
|
155
|
-
(res&.vulns || []).map { |name| Models::Vulnerability.new(name: name) }
|
156
|
-
end.value_or []
|
157
|
-
end
|
158
|
-
end
|
159
|
-
|
160
|
-
#
|
161
|
-
# Whois record builder
|
162
|
-
#
|
163
|
-
class WhoisRecordBuilder < Service
|
164
|
-
#
|
165
|
-
# Build whois record
|
166
|
-
#
|
167
|
-
# @param [String] domain
|
168
|
-
# @param [Mihari::Enrichers::Whois] enricher
|
169
|
-
#
|
170
|
-
# @return [Mihari::Models::WhoisRecord, nil]
|
171
|
-
#
|
172
|
-
def call(domain, enricher: Enrichers::Whois.new)
|
173
|
-
enricher.result(domain).value_or nil
|
174
|
-
end
|
175
|
-
end
|
176
23
|
end
|
177
24
|
end
|
data/lib/mihari/version.rb
CHANGED