mihari 7.2.0 → 7.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/Dockerfile +1 -1
- data/lib/mihari/actor.rb +7 -0
- data/lib/mihari/analyzers/base.rb +0 -7
- data/lib/mihari/enrichers/base.rb +54 -12
- data/lib/mihari/enrichers/google_public_dns.rb +28 -7
- data/lib/mihari/enrichers/mmdb.rb +25 -7
- data/lib/mihari/enrichers/shodan.rb +35 -4
- data/lib/mihari/enrichers/whois.rb +32 -24
- data/lib/mihari/models/alert.rb +12 -0
- data/lib/mihari/models/artifact.rb +105 -181
- data/lib/mihari/models/rule.rb +21 -0
- data/lib/mihari/rule.rb +27 -6
- data/lib/mihari/schemas/alert.rb +3 -3
- data/lib/mihari/schemas/analyzer.rb +27 -27
- data/lib/mihari/schemas/emitter.rb +9 -9
- data/lib/mihari/schemas/macros.rb +2 -2
- data/lib/mihari/schemas/options.rb +2 -5
- data/lib/mihari/schemas/rule.rb +12 -12
- data/lib/mihari/services/builders.rb +0 -153
- data/lib/mihari/services/enrichers.rb +1 -1
- data/lib/mihari/services/getters.rb +1 -1
- data/lib/mihari/version.rb +1 -1
- data/lib/mihari/web/public/assets/{index-GWurHG1o.js → index-JHS0L8KZ.js} +29 -29
- data/lib/mihari/web/public/index.html +1 -1
- data/mihari.gemspec +2 -2
- data/requirements.txt +1 -1
- metadata +7 -7
@@ -20,158 +20,5 @@ module Mihari
|
|
20
20
|
Rule.from_yaml ERB.new(File.read(path_or_id)).result
|
21
21
|
end
|
22
22
|
end
|
23
|
-
|
24
|
-
#
|
25
|
-
# Autonomous system builder
|
26
|
-
#
|
27
|
-
class AutonomousSystemBuilder < Service
|
28
|
-
#
|
29
|
-
# @param [String] ip
|
30
|
-
# @param [Mihari::Enrichers::MMDB] enricher
|
31
|
-
#
|
32
|
-
# @return [Mihari::Models::AutonomousSystem, nil]
|
33
|
-
#
|
34
|
-
def call(ip, enricher: Enrichers::MMDB.new)
|
35
|
-
enricher.result(ip).fmap do |res|
|
36
|
-
Models::AutonomousSystem.new(number: res.asn) if res.asn
|
37
|
-
end.value_or nil
|
38
|
-
end
|
39
|
-
end
|
40
|
-
|
41
|
-
#
|
42
|
-
# CPE builder
|
43
|
-
#
|
44
|
-
class CPEBuilder < Service
|
45
|
-
#
|
46
|
-
# Build CPEs
|
47
|
-
#
|
48
|
-
# @param [String] ip
|
49
|
-
# @param [Mihari::Enrichers::Shodan] enricher
|
50
|
-
#
|
51
|
-
# @return [Array<Mihari::Models::CPE>]
|
52
|
-
#
|
53
|
-
def call(ip, enricher: Enrichers::Shodan.new)
|
54
|
-
enricher.result(ip).fmap do |res|
|
55
|
-
(res&.cpes || []).map { |cpe| Models::CPE.new(name: cpe) }
|
56
|
-
end.value_or []
|
57
|
-
end
|
58
|
-
end
|
59
|
-
|
60
|
-
#
|
61
|
-
# DNS record builder
|
62
|
-
#
|
63
|
-
class DnsRecordBuilder < Service
|
64
|
-
#
|
65
|
-
# Build DNS records
|
66
|
-
#
|
67
|
-
# @param [String] domain
|
68
|
-
# @param [Mihari::Enrichers::Shodan] enricher
|
69
|
-
#
|
70
|
-
# @return [Array<Mihari::Models::DnsRecord>]
|
71
|
-
#
|
72
|
-
def call(domain, enricher: Enrichers::GooglePublicDNS.new)
|
73
|
-
enricher.result(domain).fmap do |res|
|
74
|
-
res.answers.map { |answer| Models::DnsRecord.new(resource: answer.resource_type, value: answer.data) }
|
75
|
-
end.value_or []
|
76
|
-
end
|
77
|
-
end
|
78
|
-
|
79
|
-
#
|
80
|
-
# Geolocation builder
|
81
|
-
#
|
82
|
-
class GeolocationBuilder < Service
|
83
|
-
#
|
84
|
-
# Build Geolocation
|
85
|
-
#
|
86
|
-
# @param [String] ip
|
87
|
-
# @param [Mihari::Enrichers::MMDB] enricher
|
88
|
-
#
|
89
|
-
# @return [Mihari::Models::Geolocation, nil]
|
90
|
-
#
|
91
|
-
def call(ip, enricher: Enrichers::MMDB.new)
|
92
|
-
enricher.result(ip).fmap do |res|
|
93
|
-
if res.country_code
|
94
|
-
Models::Geolocation.new(
|
95
|
-
country: NormalizeCountry(res.country_code, to: :short),
|
96
|
-
country_code: res.country_code
|
97
|
-
)
|
98
|
-
end
|
99
|
-
end.value_or nil
|
100
|
-
end
|
101
|
-
end
|
102
|
-
|
103
|
-
#
|
104
|
-
# Port builder
|
105
|
-
#
|
106
|
-
class PortBuilder < Service
|
107
|
-
#
|
108
|
-
# Build ports
|
109
|
-
#
|
110
|
-
# @param [String] ip
|
111
|
-
# @param [Mihari::Enrichers::Shodan] enricher
|
112
|
-
#
|
113
|
-
# @return [Array<Mihari::Models::Port>]
|
114
|
-
#
|
115
|
-
def call(ip, enricher: Enrichers::Shodan.new)
|
116
|
-
enricher.result(ip).fmap do |res|
|
117
|
-
(res&.ports || []).map { |port| Models::Port.new(number: port) }
|
118
|
-
end.value_or []
|
119
|
-
end
|
120
|
-
end
|
121
|
-
|
122
|
-
#
|
123
|
-
# Reverse DNS name builder
|
124
|
-
#
|
125
|
-
class ReverseDnsNameBuilder < Service
|
126
|
-
#
|
127
|
-
# Build reverse DNS names
|
128
|
-
#
|
129
|
-
# @param [String] ip
|
130
|
-
# @param [Mihari::Enrichers::Shodan] enricher
|
131
|
-
#
|
132
|
-
# @return [Array<Mihari::Models::ReverseDnsName>]
|
133
|
-
#
|
134
|
-
def call(ip, enricher: Enrichers::Shodan.new)
|
135
|
-
enricher.result(ip).fmap do |res|
|
136
|
-
(res&.hostnames || []).map { |name| Models::ReverseDnsName.new(name: name) }
|
137
|
-
end.value_or []
|
138
|
-
end
|
139
|
-
end
|
140
|
-
|
141
|
-
#
|
142
|
-
# Vulnerability builder
|
143
|
-
#
|
144
|
-
class VulnerabilityBuilder < Service
|
145
|
-
#
|
146
|
-
# Build vulnerabilities
|
147
|
-
#
|
148
|
-
# @param [String] ip
|
149
|
-
# @param [Mihari::Enrichers::Shodan] enricher
|
150
|
-
#
|
151
|
-
# @return [Array<Mihari::Models::Vulnerability>]
|
152
|
-
#
|
153
|
-
def call(ip, enricher: Enrichers::Shodan.new)
|
154
|
-
enricher.result(ip).fmap do |res|
|
155
|
-
(res&.vulns || []).map { |name| Models::Vulnerability.new(name: name) }
|
156
|
-
end.value_or []
|
157
|
-
end
|
158
|
-
end
|
159
|
-
|
160
|
-
#
|
161
|
-
# Whois record builder
|
162
|
-
#
|
163
|
-
class WhoisRecordBuilder < Service
|
164
|
-
#
|
165
|
-
# Build whois record
|
166
|
-
#
|
167
|
-
# @param [String] domain
|
168
|
-
# @param [Mihari::Enrichers::Whois] enricher
|
169
|
-
#
|
170
|
-
# @return [Mihari::Models::WhoisRecord, nil]
|
171
|
-
#
|
172
|
-
def call(domain, enricher: Enrichers::Whois.new)
|
173
|
-
enricher.result(domain).value_or nil
|
174
|
-
end
|
175
|
-
end
|
176
23
|
end
|
177
24
|
end
|
data/lib/mihari/version.rb
CHANGED