mihari 7.3.2 → 7.5.0

data/lib/mihari/emitters/yeti.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+module Mihari
+  module Emitters
+    class Yeti < Base
+      # @return [String, nil]
+      attr_reader :url
+
+      # @return [String, nil]
+      attr_reader :api_key
+
+      # @return [Array<Mihari::Models::Artifact>]
+      attr_accessor :artifacts
+
+      #
+      # @param [Mihari::Rule] rule
+      # @param [Hash, nil] options
+      # @param [Hash] params
+      #
+      def initialize(rule:, options: nil, **params)
+        super(rule:, options:)
+
+        @url = params[:url] || Mihari.config.yeti_url
+        @api_key = params[:api_key] || Mihari.config.yeti_api_key
+
+        @artifacts = []
+      end
+
+      #
+      # @return [Boolean]
+      #
+      def configured?
+        api_key? && url?
+      end
+
+      #
+      # Create a Hive alert
+      #
+      # @param [Array<Mihari::Models::Artifact>] artifacts
+      #
+      def call(artifacts)
+        return if artifacts.empty?
+
+        @artifacts = artifacts
+
+        client.create_observables({observables:})
+      end
+
+      #
+      # @return [String]
+      #
+      def target
+        URI(url).host || "N/A"
+      end
+
+      private
+
+      def client
+        Clients::Yeti.new(url, api_key:, timeout:)
+      end
+
+      #
+      # Check whether a URL is set or not
+      #
+      # @return [Boolean]
+      #
+      def url?
+        !url.nil?
+      end
+
+      def acceptable_artifacts
+        artifacts.reject { |artifact| artifact.data_type == "mail" }
+      end
+
+      #
+      # @param [Mihari::Models::Artifact] artifact
+      #
+      # @return [Hash]
+      #
+      def artifact_to_observable(artifact)
+        convert_table = {
+          domain: "hostname",
+          ip: "ipv4"
+        }
+
+        type = lambda do
+          detailed_type = DataType.detailed_type(artifact.data)
+          convert_table[detailed_type.to_sym] || detailed_type || artifact.data_type
+        end.call
+
+        {
+          tags:,
+          type:,
+          value: artifact.data
+        }
+      end
+
+      def tags
+        @tags ||= rule.tags.map(&:name)
+      end
+
+      def observables
+        acceptable_artifacts.map { |artifact| artifact_to_observable(artifact) }
+      end
+    end
+  end
+end

data/lib/mihari/enrichers/base.rb

@@ -10,7 +10,7 @@ module Mihari
       # @param [Hash, nil] options
       #
       def initialize(options: nil)
-        super(options: options)
+        super(options:)
       end
 
       #

data/lib/mihari/enrichers/google_public_dns.rb

@@ -50,7 +50,7 @@ module Mihari
       end
 
       def client
-        @client ||= Clients::GooglePublicDNS.new(timeout: timeout)
+        @client ||= Clients::GooglePublicDNS.new(timeout:)
       end
     end
   end

data/lib/mihari/enrichers/mmdb.rb

@@ -39,7 +39,7 @@ module Mihari
       end
 
       def client
-        @client ||= Clients::MMDB.new(timeout: timeout)
+        @client ||= Clients::MMDB.new(timeout:)
       end
     end
   end

data/lib/mihari/enrichers/shodan.rb

@@ -22,13 +22,13 @@ module Mihari
 
           if tapped.reverse_dns_names.empty?
             tapped.reverse_dns_names = (res&.hostnames || []).map do |name|
-              Models::ReverseDnsName.new(name: name)
+              Models::ReverseDnsName.new(name:)
             end
           end
 
           if tapped.vulnerabilities.empty?
             tapped.vulnerabilities = (res&.vulns || []).map do |name|
-              Models::Vulnerability.new(name: name)
+              Models::Vulnerability.new(name:)
             end
           end
         end
@@ -50,7 +50,7 @@ module Mihari
       end
 
       def client
-        @client ||= Clients::ShodanInternetDB.new(timeout: timeout)
+        @client ||= Clients::ShodanInternetDB.new(timeout:)
       end
     end
   end

data/lib/mihari/enrichers/whois.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "whois-parser"
-
 module Mihari
   module Enrichers
     #
@@ -18,22 +16,15 @@ module Mihari
       def call(artifact)
         return if artifact.domain.nil?
 
-        domain = PublicSuffix.domain(artifact.domain)
-        record = memoized_lookup(domain)
-        return if record.parser.available?
-
-        artifact.whois_record ||= Models::WhoisRecord.new(
-          domain: domain,
-          created_on: get_created_on(record.parser),
-          updated_on: get_updated_on(record.parser),
-          expires_on: get_expires_on(record.parser),
-          registrar: get_registrar(record.parser),
-          contacts: get_contacts(record.parser)
-        )
+        artifact.whois_record ||= memoized_lookup(PublicSuffix.domain(artifact.domain))
       end
 
       private
 
+      def client
+        @client ||= Clients::Whois.new(timeout:)
+      end
+
       #
       # @param [Mihari::Models::Artifact] artifact
       #
@@ -53,85 +44,9 @@ module Mihari
       # @return [Mihari::Models::WhoisRecord, nil]
       #
       def memoized_lookup(domain)
-        whois.lookup domain
+        client.lookup domain
       end
       memo_wise :memoized_lookup
-
-      #
-      # @return [::Whois::Client]
-      #
-      def whois
-        @whois ||= lambda do
-          return ::Whois::Client.new if timeout.nil?
-
-          ::Whois::Client.new(timeout: timeout)
-        end.call
-      end
-
-      #
-      # Get created_on
-      #
-      # @param [::Whois::Parser] parser
-      #
-      # @return [Date, nil]
-      #
-      def get_created_on(parser)
-        parser.created_on
-      rescue ::Whois::AttributeNotImplemented
-        nil
-      end
-
-      #
-      # Get updated_on
-      #
-      # @param [::Whois::Parser] parser
-      #
-      # @return [Date, nil]
-      #
-      def get_updated_on(parser)
-        parser.updated_on
-      rescue ::Whois::AttributeNotImplemented
-        nil
-      end
-
-      #
-      # Get expires_on
-      #
-      # @param [::Whois::Parser] parser
-      #
-      # @return [Date, nil]
-      #
-      def get_expires_on(parser)
-        parser.expires_on
-      rescue ::Whois::AttributeNotImplemented
-        nil
-      end
-
-      #
-      # Get registrar
-      #
-      # @param [::Whois::Parser] parser
-      #
-      # @return [Hash, nil]
-      #
-      def get_registrar(parser)
-        parser.registrar&.to_h
-      rescue ::Whois::AttributeNotImplemented
-        nil
-      end
-
-      #
-      # Get contacts
-      #
-      # @param [::Whois::Parser] parser
-      #
-      # @return [Array<Hash>, nil]
-      #
-      def get_contacts(parser)
-        parser.contacts.map(&:to_h)
-      rescue ::Whois::AttributeNotImplemented
-        nil
-      end
     end
   end
 end

data/lib/mihari/entities/alert.rb

@@ -3,16 +3,16 @@
 module Mihari
   module Entities
     class Alert < Grape::Entity
-      expose :id, documentation: { type: Integer, required: true }
-      expose :rule_id, documentation: { type: String, required: true }, as: :ruleId
-      expose :created_at, documentation: { type: DateTime, required: true }, as: :createdAt
+      expose :id, documentation: {type: Integer, required: true}
+      expose :rule_id, documentation: {type: String, required: true}, as: :ruleId
+      expose :created_at, documentation: {type: DateTime, required: true}, as: :createdAt
 
-      expose :artifacts, using: Entities::BaseArtifact, documentation: { type: Entities::BaseArtifact, is_array: true }
-      expose :tags, using: Entities::Tag, documentation: { type: Entities::Tag, is_array: true, required: true }
+      expose :artifacts, using: Entities::BaseArtifact, documentation: {type: Entities::BaseArtifact, is_array: true}
+      expose :tags, using: Entities::Tag, documentation: {type: Entities::Tag, is_array: true, required: true}
     end
 
     class AlertsWithPagination < Pagination
-      expose :results, using: Entities::Alert, documentation: { type: Entities::Alert, is_array: true, required: true }
+      expose :results, using: Entities::Alert, documentation: {type: Entities::Alert, is_array: true, required: true}
     end
   end
 end

data/lib/mihari/entities/artifact.rb

@@ -3,40 +3,40 @@
 module Mihari
   module Entities
     class BaseArtifact < Grape::Entity
-      expose :id, documentation: { type: Integer, required: true }
-      expose :data, documentation: { type: String, required: true }
-      expose :data_type, documentation: { type: String, required: true }, as: :dataType
-      expose :source, documentation: { type: String, required: true }
-      expose :query, documentation: { type: String, required: false }
-      expose :created_at, documentation: { type: DateTime, required: true }, as: :createdAt
-      expose :tags, using: Entities::Tag, documentation: { type: Entities::Tag, is_array: true, required: true }
+      expose :id, documentation: {type: Integer, required: true}
+      expose :data, documentation: {type: String, required: true}
+      expose :data_type, documentation: {type: String, required: true}, as: :dataType
+      expose :source, documentation: {type: String, required: true}
+      expose :query, documentation: {type: String, required: false}
+      expose :created_at, documentation: {type: DateTime, required: true}, as: :createdAt
+      expose :tags, using: Entities::Tag, documentation: {type: Entities::Tag, is_array: true, required: true}
     end
 
     class Artifact < BaseArtifact
-      expose :metadata, documentation: { type: Hash }
+      expose :metadata, documentation: {type: Hash}
       expose :autonomous_system, using: Entities::AutonomousSystem,
-        documentation: { type: Entities::AutonomousSystem, required: false }, as: :autonomousSystem
-      expose :geolocation, using: Entities::Geolocation, documentation: { type: Entities::Geolocation, required: false }
+        documentation: {type: Entities::AutonomousSystem, required: false}, as: :autonomousSystem
+      expose :geolocation, using: Entities::Geolocation, documentation: {type: Entities::Geolocation, required: false}
       expose :whois_record, using: Entities::WhoisRecord,
-        documentation: { type: Entities::WhoisRecord, required: false }, as: :whoisRecord
+        documentation: {type: Entities::WhoisRecord, required: false}, as: :whoisRecord
 
       expose :reverse_dns_names, using: Entities::ReverseDnsName,
-        documentation: { type: Entities::ReverseDnsName, is_array: true, required: false }, as: :reverseDnsNames do |status, _options|
+        documentation: {type: Entities::ReverseDnsName, is_array: true, required: false}, as: :reverseDnsNames do |status, _options|
         status.reverse_dns_names.empty? ? nil : status.reverse_dns_names
       end
       expose :dns_records, using: Entities::DnsRecord,
-        documentation: { type: Entities::DnsRecord, is_array: true, required: false }, as: :dnsRecords do |status, _options|
+        documentation: {type: Entities::DnsRecord, is_array: true, required: false}, as: :dnsRecords do |status, _options|
         status.dns_records.empty? ? nil : status.dns_records
       end
-      expose :ceps, using: Entities::CPE, documentation: { type: Entities::CPE, is_array: true, required: false },
+      expose :ceps, using: Entities::CPE, documentation: {type: Entities::CPE, is_array: true, required: false},
         as: :cpes do |status, _options|
         status.cpes.empty? ? nil : status.cpes
       end
-      expose :ports, using: Entities::Port, documentation: { type: Entities::Port, is_array: true, required: false },
+      expose :ports, using: Entities::Port, documentation: {type: Entities::Port, is_array: true, required: false},
         as: :ports do |status, _options|
         status.ports.empty? ? nil : status.ports
       end
-      expose :vulnerabilities, using: Vulnerability, documentation: { type: Vulnerability, is_array: true, required: false },
+      expose :vulnerabilities, using: Vulnerability, documentation: {type: Vulnerability, is_array: true, required: false},
         as: :vulnerabilities do |status, _options|
         status.vulnerabilities.empty? ? nil : status.vulnerabilities
       end
@@ -44,7 +44,7 @@ module Mihari
 
     class ArtifactsWithPagination < Pagination
       expose :results, using: Entities::BaseArtifact,
-        documentation: { type: Entities::Artifact, is_array: true, required: true }
+        documentation: {type: Entities::Artifact, is_array: true, required: true}
     end
   end
 end

data/lib/mihari/entities/autonomous_system.rb

@@ -3,7 +3,7 @@
 module Mihari
   module Entities
     class AutonomousSystem < Grape::Entity
-      expose :number, documentation: { type: Integer, required: true }
+      expose :number, documentation: {type: Integer, required: true}
     end
   end
 end

data/lib/mihari/entities/config.rb

@@ -3,10 +3,14 @@
 module Mihari
   module Entities
     class Config < Grape::Entity
-      expose :name, documentation: { type: String, required: true }
-      expose :type, documentation: { type: String, required: true }
-      expose :items, documentation: { type: Hash, is_array: true, required: true }
-      expose :configured, documentation: { type: Grape::API::Boolean, required: true }
+      expose :name, documentation: {type: String, required: true}
+      expose :type, documentation: {type: String, required: true}
+      expose :items, documentation: {type: Hash, is_array: true, required: true}
+      expose :configured, documentation: {type: Grape::API::Boolean, required: true}
+    end
+
+    class Configs < Grape::Entity
+      expose :results, using: Config, documentation: {type: Config, is_array: true, required: true}
     end
   end
 end

data/lib/mihari/entities/cpe.rb

@@ -3,8 +3,8 @@
 module Mihari
   module Entities
     class CPE < Grape::Entity
-      expose :name, documentation: { type: String, required: true }
-      expose :created_at, documentation: { type: DateTime, required: true }, as: :createdAt
+      expose :name, documentation: {type: String, required: true}
+      expose :created_at, documentation: {type: DateTime, required: true}, as: :createdAt
     end
   end
 end

data/lib/mihari/entities/dns.rb

@@ -3,9 +3,9 @@
 module Mihari
   module Entities
     class DnsRecord < Grape::Entity
-      expose :resource, documentation: { type: String, required: true }
-      expose :value, documentation: { type: String, required: true }
-      expose :created_at, documentation: { type: DateTime, required: true }, as: :createdAt
+      expose :resource, documentation: {type: String, required: true}
+      expose :value, documentation: {type: String, required: true}
+      expose :created_at, documentation: {type: DateTime, required: true}, as: :createdAt
     end
   end
 end

data/lib/mihari/entities/geolocation.rb

@@ -3,9 +3,9 @@
 module Mihari
   module Entities
     class Geolocation < Grape::Entity
-      expose :country, documentation: { type: String, required: true }
-      expose :country_code, documentation: { type: String, required: true }, as: :countryCode
-      expose :created_at, documentation: { type: DateTime, required: true }, as: :createdAt
+      expose :country, documentation: {type: String, required: true}
+      expose :country_code, documentation: {type: String, required: true}, as: :countryCode
+      expose :created_at, documentation: {type: DateTime, required: true}, as: :createdAt
     end
   end
 end

data/lib/mihari/entities/ip_address.rb

@@ -3,9 +3,9 @@
 module Mihari
   module Entities
     class IPAddress < Grape::Entity
-      expose :country_code, documentation: { type: String, required: true }, as: :countryCode
-      expose :asn, documentation: { type: Integer, required: false }
-      expose :loc, documentation: { type: String, required: false }
+      expose :country_code, documentation: {type: String, required: true}, as: :countryCode
+      expose :asn, documentation: {type: Integer, required: false}
+      expose :loc, documentation: {type: String, required: false}
     end
   end
 end

data/lib/mihari/entities/messages.rb

@@ -3,15 +3,15 @@
 module Mihari
   module Entities
     class Message < Grape::Entity
-      expose :message, documentation: { type: String, required: true }
+      expose :message, documentation: {type: String, required: true}
     end
 
     class ErrorMessage < Message
-      expose :detail, documentation: { type: Hash, required: false }
+      expose :detail, documentation: {type: Hash, required: false}
     end
 
     class QueueMessage < Message
-      expose :queued, documentation: { type: Grape::API::Boolean, required: true }
+      expose :queued, documentation: {type: Grape::API::Boolean, required: true}
     end
   end
 end

data/lib/mihari/entities/pagination.rb

@@ -3,9 +3,9 @@
 module Mihari
   module Entities
     class Pagination < Grape::Entity
-      expose :total, documentation: { type: Integer, required: true }
-      expose :current_page, documentation: { type: Integer, required: true }, as: :currentPage
-      expose :page_size, documentation: { type: Integer, required: true }, as: :pageSize
+      expose :total, documentation: {type: Integer, required: true}
+      expose :current_page, documentation: {type: Integer, required: true}, as: :currentPage
+      expose :page_size, documentation: {type: Integer, required: true}, as: :pageSize
     end
   end
 end

data/lib/mihari/entities/port.rb

@@ -3,8 +3,8 @@
 module Mihari
   module Entities
     class Port < Grape::Entity
-      expose :number, documentation: { type: Integer, required: true }
-      expose :created_at, documentation: { type: DateTime, required: true }, as: :createdAt
+      expose :number, documentation: {type: Integer, required: true}
+      expose :created_at, documentation: {type: DateTime, required: true}, as: :createdAt
     end
   end
 end

data/lib/mihari/entities/reverse_dns.rb

@@ -3,8 +3,8 @@
 module Mihari
   module Entities
     class ReverseDnsName < Grape::Entity
-      expose :name, documentation: { type: String, required: true }
-      expose :created_at, documentation: { type: DateTime, required: true }, as: :createdAt
+      expose :name, documentation: {type: String, required: true}
+      expose :created_at, documentation: {type: DateTime, required: true}, as: :createdAt
     end
   end
 end

data/lib/mihari/entities/rule.rb

@@ -3,17 +3,17 @@
 module Mihari
   module Entities
     class Rule < Grape::Entity
-      expose :id, documentation: { type: String, required: true }
-      expose :title, documentation: { type: String, required: true }
-      expose :description, documentation: { type: String, required: true }
-      expose :yaml, documentation: { type: String, required: true }
-      expose :created_at, documentation: { type: DateTime, required: true }, as: :createdAt
-      expose :updated_at, documentation: { type: DateTime, required: true }, as: :updatedAt
-      expose :tags, using: Entities::Tag, documentation: { type: Entities::Tag, is_array: true, required: true }
+      expose :id, documentation: {type: String, required: true}
+      expose :title, documentation: {type: String, required: true}
+      expose :description, documentation: {type: String, required: true}
+      expose :yaml, documentation: {type: String, required: true}
+      expose :created_at, documentation: {type: DateTime, required: true}, as: :createdAt
+      expose :updated_at, documentation: {type: DateTime, required: true}, as: :updatedAt
+      expose :tags, using: Entities::Tag, documentation: {type: Entities::Tag, is_array: true, required: true}
     end
 
     class RulesWithPagination < Pagination
-      expose :results, using: Entities::Rule, documentation: { type: Entities::Rule, is_array: true, required: true }
+      expose :results, using: Entities::Rule, documentation: {type: Entities::Rule, is_array: true, required: true}
     end
   end
 end

data/lib/mihari/entities/tag.rb

@@ -3,12 +3,12 @@
 module Mihari
   module Entities
     class Tag < Grape::Entity
-      expose :id, documentation: { type: Integer, required: true }
-      expose :name, documentation: { type: String, required: true }
+      expose :id, documentation: {type: Integer, required: true}
+      expose :name, documentation: {type: String, required: true}
     end
 
     class TagsWithPagination < Pagination
-      expose :results, using: Entities::Tag, documentation: { type: Entities::Tag, is_array: true, required: true }
+      expose :results, using: Entities::Tag, documentation: {type: Entities::Tag, is_array: true, required: true}
     end
   end
 end

data/lib/mihari/entities/vulnerability.rb

@@ -3,8 +3,8 @@
 module Mihari
   module Entities
     class Vulnerability < Grape::Entity
-      expose :name, documentation: { type: String, required: true }
-      expose :created_at, documentation: { type: DateTime, required: true }, as: :createdAt
+      expose :name, documentation: {type: String, required: true}
+      expose :created_at, documentation: {type: DateTime, required: true}, as: :createdAt
     end
   end
 end

data/lib/mihari/entities/whois.rb

@@ -3,15 +3,15 @@
 module Mihari
   module Entities
     class WhoisRecord < Grape::Entity
-      expose :domain, documentation: { type: String, required: true }
-      expose :created_on, documentation: { type: Date, required: false }, as: :createdOn
-      expose :updated_on, documentation: { type: Date, required: false }, as: :updatedOn
-      expose :expires_on, documentation: { type: Date, required: false }, as: :expiresOn
-      expose :registrar, documentation: { type: Hash, required: false }
-      expose :contacts, documentation: { type: Hash, is_array: true, required: true } do |whois_record, _options|
+      expose :domain, documentation: {type: String, required: true}
+      expose :created_on, documentation: {type: Date, required: false}, as: :createdOn
+      expose :updated_on, documentation: {type: Date, required: false}, as: :updatedOn
+      expose :expires_on, documentation: {type: Date, required: false}, as: :expiresOn
+      expose :registrar, documentation: {type: Hash, required: false}
+      expose :contacts, documentation: {type: Hash, is_array: true, required: true} do |whois_record, _options|
         whois_record.contacts.map(&:to_camelback_keys)
       end
-      expose :created_at, documentation: { type: DateTime, required: true }, as: :createdAt
+      expose :created_at, documentation: {type: DateTime, required: true}, as: :createdAt
     end
   end
 end

data/lib/mihari/errors.rb

@@ -74,7 +74,7 @@ module Mihari
     end
 
     def detail
-      { status_code: status_code, body: body }
+      {status_code:, body:}
     end
   end
 

data/lib/mihari/models/artifact.rb

@@ -159,8 +159,8 @@ module Mihari
       #
       def unique?(base_time: nil, artifact_ttl: nil)
         artifact = self.class.joins(:alert).where(
-          data: data,
-          alert: { rule_id: rule_id }
+          data:,
+          alert: {rule_id:}
         ).order(created_at: :desc).first
         return true if artifact.nil?
 

data/lib/mihari/models/port.rb

@@ -19,7 +19,7 @@ module Mihari
         #
         def build_by_ip(ip, enricher: Enrichers::Shodan.new)
           enricher.result(ip).fmap do |res|
-            (res&.ports || []).map { |port| new(port: port) }
+            (res&.ports || []).map { |port| new(port:) }
           end.value_or []
         end
       end

data/lib/mihari/models/tag.rb

@@ -6,6 +6,9 @@ module Mihari
     # Tag model
     #
     class Tag < ActiveRecord::Base
+      # @!attribute [rw] name
+      #   @return [String]
+
       has_many :taggings, dependent: :destroy
 
       include SearchCop