mihari 7.3.2 → 7.5.0

data/lib/mihari/rule.rb

@@ -103,7 +103,7 @@ module Mihari
     #
     def tags
       data[:tags].uniq.filter_map do |name|
-        Models::Tag.find_or_create_by(name: name)
+        Models::Tag.find_or_create_by(name:)
       end
     end
 
@@ -163,7 +163,7 @@ module Mihari
     # @return [Array<Mihari::Models::Artifact>]
     #
     def unique_artifacts
-      normalized_artifacts.select { |artifact| artifact.unique?(base_time: base_time, artifact_ttl: artifact_ttl) }
+      normalized_artifacts.select { |artifact| artifact.unique?(base_time:, artifact_ttl:) }
     end
 
     #
@@ -221,11 +221,11 @@ module Mihari
       end
     rescue ActiveRecord::RecordNotFound
       Mihari::Models::Rule.new(
-        id: id,
-        title: title,
-        description: description,
-        data: data,
-        taggings: taggings
+        id:,
+        title:,
+        description:,
+        data:,
+        taggings:
       )
     end
 
@@ -319,9 +319,7 @@ module Mihari
       @analyzers ||= queries.deep_dup.map do |params|
         name = params.delete(:analyzer)
         klass = get_analyzer_class(name)
-        klass.from_params(params).tap do |analyzer|
-          analyzer.validate_configuration!
-        end
+        klass.from_params(params).tap(&:validate_configuration!)
       end
     end
 
@@ -363,9 +361,7 @@ module Mihari
         options = params.delete(:options)
 
         klass = get_emitter_class(name)
-        klass.new(rule: self, options: options, **params).tap do |emitter|
-          emitter.validate_configuration!
-        end
+        klass.new(rule: self, options:, **params).tap(&:validate_configuration!)
       end
     end
 
@@ -399,7 +395,7 @@ module Mihari
         options = params.delete(:options)
 
         klass = get_enricher_class(name)
-        klass.new(options: options, **params)
+        klass.new(options:, **params)
       end
     end
 

data/lib/mihari/schemas/emitter.rb

@@ -17,6 +17,7 @@ module Mihari
         required(:emitter).value(Types::String.enum(*Mihari::Emitters::MISP.keys))
         optional(:url).filled(:string)
         optional(:api_key).filled(:string)
+        optional(:attribute_tags).array { filled(:string) }.default([])
         optional(:options).hash(EmitterOptions)
       end
 
@@ -24,6 +25,14 @@ module Mihari
         required(:emitter).value(Types::String.enum(*Mihari::Emitters::TheHive.keys))
         optional(:url).filled(:string)
         optional(:api_key).filled(:string)
+        optional(:observable_tags).array { filled(:string) }.default([])
+        optional(:options).hash(EmitterOptions)
+      end
+
+      Yeti = Dry::Schema.Params do
+        required(:emitter).value(Types::String.enum(*Mihari::Emitters::Yeti.keys))
+        optional(:url).filled(:string)
+        optional(:api_key).filled(:string)
         optional(:options).hash(EmitterOptions)
       end
 

data/lib/mihari/services/feed.rb

@@ -28,10 +28,10 @@ module Mihari
 
         return read_file(url.path) if url.scheme == "file"
 
-        http = HTTP::Factory.build(headers: headers, timeout: timeout)
+        http = HTTP::Factory.build(headers:, timeout:)
 
-        res = http.get(url, params: params) if method == "GET"
-        res = http.post(url, params: params, json: json, form: form) if method == "POST"
+        res = http.get(url, params:) if method == "GET"
+        res = http.post(url, params:, json:, form:) if method == "POST"
 
         body = res.body.to_s
         content_type = res["Content-Type"].to_s

data/lib/mihari/services/getters.rb

@@ -35,7 +35,7 @@ module Mihari
 
     class RuleGetter < Service
       #
-      # @params [String] id
+      # @param [String] id
       #
       # @return [Mihari::Models::Rule]
       #

data/lib/mihari/services/proxies.rb

@@ -61,7 +61,7 @@ module Mihari
       #
       def artifacts
         @artifacts ||= data[:artifacts].map do |data|
-          artifact = Models::Artifact.new(data: data)
+          artifact = Models::Artifact.new(data:)
           artifact.rule_id = rule_id
           artifact.source = source
           artifact

data/lib/mihari/services/renderer.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "tilt/jbuilder"
 
 module Mihari

data/lib/mihari/services/searchers.rb

@@ -35,7 +35,7 @@ module Mihari
         ResultValue.new(
           total: klass.count_by_filter(filter),
           results: klass.search_by_filter(filter),
-          filter: filter
+          filter:
         )
       end
 

data/lib/mihari/sidekiq/application.rb

@@ -5,9 +5,9 @@ require "sidekiq"
 require "mihari/sidekiq/jobs"
 
 Sidekiq.configure_server do |config|
-  config.redis = { url: Mihari.config.sidekiq_redis_url.to_s }
+  config.redis = {url: Mihari.config.sidekiq_redis_url.to_s}
 end
 
 Sidekiq.configure_client do |config|
-  config.redis = { url: Mihari.config.sidekiq_redis_url.to_s }
+  config.redis = {url: Mihari.config.sidekiq_redis_url.to_s}
 end

data/lib/mihari/structs/censys.rb

@@ -48,8 +48,8 @@ module Mihari
           return nil if country.nil?
 
           Mihari::Models::Geolocation.new(
-            country: country,
-            country_code: country_code
+            country:,
+            country_code:
           )
         end
 
@@ -126,10 +126,10 @@ module Mihari
         def artifact
           Models::Artifact.new(
             data: ip,
-            metadata: metadata,
+            metadata:,
             autonomous_system: autonomous_system.as,
             geolocation: location.geolocation,
-            ports: ports
+            ports:
           )
         end
 

data/lib/mihari/structs/google_public_dns.rb

@@ -4,8 +4,8 @@ module Mihari
   module Structs
     module GooglePublicDNS
       INT_TYPE_TO_TYPE =
-        { 1 => :A, 38 => :A6, 28 => :AAAA, 18 => :AFSDB, 255 => :ANY, 42 => :APL, 34 => :ATMA, 252 => :AXFR, 37 => :CERT,
-          5 => :CNAME, 49 => :DHCID, 32_769 => :DLV, 39 => :DNAME, 48 => :DNSKEY, 43 => :DS, 31 => :EID, 102 => :GID, 27 => :GPOS, 13 => :HINFO, 45 => :IPSECKEY, 20 => :ISDN, 251 => :IXFR, 25 => :KEY, 36 => :KX, 29 => :LOC, 254 => :MAILA, 253 => :MAILB, 7 => :MB, 3 => :MD, 4 => :MF, 8 => :MG, 14 => :MINFO, 9 => :MR, 15 => :MX, 35 => :NAPTR, 32 => :NIMLOC, 2 => :NS, 22 => :NSAP, 23 => :NSAP_PTR, 47 => :NSEC, 50 => :NSEC3, 51 => :NSEC3PARAMS, 10 => :NULL, 30 => :NXT, 41 => :OPT, 12 => :PTR, 26 => :PX, 17 => :RP, 46 => :RRSIG, 21 => :RT, 24 => :SIG, 40 => :SINK, 6 => :SOA, 33 => :SRV, 44 => :SSHFP, 250 => :TSIG, 16 => :TXT, 101 => :UID, 100 => :UINFO, 103 => :UNSPEC, 11 => :WKS, 19 => :X25 }.freeze
+        {1 => :A, 38 => :A6, 28 => :AAAA, 18 => :AFSDB, 255 => :ANY, 42 => :APL, 34 => :ATMA, 252 => :AXFR, 37 => :CERT,
+         5 => :CNAME, 49 => :DHCID, 32_769 => :DLV, 39 => :DNAME, 48 => :DNSKEY, 43 => :DS, 31 => :EID, 102 => :GID, 27 => :GPOS, 13 => :HINFO, 45 => :IPSECKEY, 20 => :ISDN, 251 => :IXFR, 25 => :KEY, 36 => :KX, 29 => :LOC, 254 => :MAILA, 253 => :MAILB, 7 => :MB, 3 => :MD, 4 => :MF, 8 => :MG, 14 => :MINFO, 9 => :MR, 15 => :MX, 35 => :NAPTR, 32 => :NIMLOC, 2 => :NS, 22 => :NSAP, 23 => :NSAP_PTR, 47 => :NSEC, 50 => :NSEC3, 51 => :NSEC3PARAMS, 10 => :NULL, 30 => :NXT, 41 => :OPT, 12 => :PTR, 26 => :PX, 17 => :RP, 46 => :RRSIG, 21 => :RT, 24 => :SIG, 40 => :SINK, 6 => :SOA, 33 => :SRV, 44 => :SSHFP, 250 => :TSIG, 16 => :TXT, 101 => :UID, 100 => :UINFO, 103 => :UNSPEC, 11 => :WKS, 19 => :X25}.freeze
 
       class Answer < Dry::Struct
         # @!attribute [r] name
@@ -30,7 +30,7 @@ module Mihari
             new(
               name: d.fetch("name"),
               data: d.fetch("data"),
-              resource_type: resource_type
+              resource_type:
             )
           end
         end

data/lib/mihari/structs/greynoise.rb

@@ -30,8 +30,8 @@ module Mihari
         #
         def geolocation
           Mihari::Models::Geolocation.new(
-            country: country,
-            country_code: country_code
+            country:,
+            country_code:
           )
         end
 

data/lib/mihari/structs/onyphe.rb

@@ -29,9 +29,9 @@ module Mihari
         def artifact
           Mihari::Models::Artifact.new(
             data: ip,
-            metadata: metadata,
+            metadata:,
             autonomous_system: as,
-            geolocation: geolocation
+            geolocation:
           )
         end
 
@@ -43,7 +43,7 @@ module Mihari
 
           Mihari::Models::Geolocation.new(
             country: NormalizeCountry(country_code, to: :short),
-            country_code: country_code
+            country_code:
           )
         end
 

data/lib/mihari/structs/shodan.rb

@@ -20,7 +20,7 @@ module Mihari
 
           Mihari::Models::Geolocation.new(
             country: country_name,
-            country_code: country_code
+            country_code:
           )
         end
 
@@ -106,7 +106,7 @@ module Mihari
 
             new(
               asn: d["asn"],
-              hostnames: hostnames,
+              hostnames:,
               location: Location.from_dynamic!(d.fetch("location")),
               domains: d.fetch("domains"),
               ip_str: d.fetch("ip_str"),
@@ -205,20 +205,20 @@ module Mihari
 
             ports = collect_ports_by_ip(match.ip_str).map { |port| Models::Port.new(number: port) }
             reverse_dns_names = collect_hostnames_by_ip(match.ip_str).map do |name|
-              Models::ReverseDnsName.new(name: name)
+              Models::ReverseDnsName.new(name:)
             end
-            cpes = collect_cpes_by_ip(match.ip_str).map { |name| Models::CPE.new(name: name) }
-            vulnerabilities = collect_vulns_by_ip(match.ip_str).map { |name| Models::Vulnerability.new(name: name) }
+            cpes = collect_cpes_by_ip(match.ip_str).map { |name| Models::CPE.new(name:) }
+            vulnerabilities = collect_vulns_by_ip(match.ip_str).map { |name| Models::Vulnerability.new(name:) }
 
             Mihari::Models::Artifact.new(
               data: match.ip_str,
-              metadata: metadata,
+              metadata:,
               autonomous_system: match.autonomous_system,
               geolocation: match.location.geolocation,
-              ports: ports,
-              reverse_dns_names: reverse_dns_names,
-              cpes: cpes,
-              vulnerabilities: vulnerabilities
+              ports:,
+              reverse_dns_names:,
+              cpes:,
+              vulnerabilities:
             )
           end
         end

data/lib/mihari/structs/urlscan.rb

@@ -53,7 +53,7 @@ module Mihari
         #
         def artifacts
           values = [page.url, page.domain, page.ip].compact
-          values.map { |value| Mihari::Models::Artifact.new(data: value, metadata: metadata) }
+          values.map { |value| Mihari::Models::Artifact.new(data: value, metadata:) }
         end
 
         class << self

data/lib/mihari/structs/virustotal_intelligence.rb

@@ -56,7 +56,7 @@ module Mihari
         # @return [Mihari::Models::Artifact]
         #
         def artifact
-          Models::Artifact.new(data: value, metadata: metadata)
+          Models::Artifact.new(data: value, metadata:)
         end
 
         class << self
@@ -74,7 +74,7 @@ module Mihari
             new(
               type: d.fetch("type"),
               id: d.fetch("id"),
-              context_attributes: context_attributes,
+              context_attributes:,
               metadata: d
             )
           end

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "7.3.2"
+  VERSION = "7.5.0"
 end

data/lib/mihari/web/api.rb

@@ -24,7 +24,7 @@ module Mihari
       mount Endpoints::Rules
       mount Endpoints::Tags
 
-      add_swagger_documentation(api_version: "v1", info: { title: "Mihari API" })
+      add_swagger_documentation(api_version: "v1", info: {title: "Mihari API"})
     end
   end
 end

data/lib/mihari/web/application.rb

@@ -97,7 +97,7 @@ module Mihari
             Host: host,
             Threads: threads,
             Verbose: verbose,
-            worker_timeout: worker_timeout
+            worker_timeout:
           ) do |_|
             Launchy.open("http://#{host}:#{port}") if !Mihari.development? && open
           rescue Launchy::CommandNotFoundError

data/lib/mihari/web/endpoints/alerts.rb

@@ -33,7 +33,7 @@ module Mihari
 
           desc "Get an alert", {
             success: Entities::Alert,
-            failure: [{ code: 404, model: Entities::ErrorMessage }],
+            failure: [{code: 404, model: Entities::ErrorMessage}],
             summary: "Get an alert"
           }
           params do
@@ -46,14 +46,14 @@ module Mihari
 
             case result.failure
             when ActiveRecord::RecordNotFound
-              error!({ message: "ID:#{id} not found" }, 404)
+              error!({message: "ID:#{id} not found"}, 404)
             end
             raise result.failure
           end
 
           desc "Delete an alert", {
-            success: { code: 204, model: Entities::Message },
-            failure: [{ code: 404, model: Entities::ErrorMessage }],
+            success: {code: 204, model: Entities::Message},
+            failure: [{code: 404, model: Entities::ErrorMessage}],
             summary: "Delete an alert"
           }
           params do
@@ -64,26 +64,26 @@ module Mihari
 
             id = params["id"].to_i
             result = Services::AlertDestroyer.result(id)
-            return present({ message: "" }, with: Entities::Message) if result.success?
+            return present({message: ""}, with: Entities::Message) if result.success?
 
             case result.failure
             when ActiveRecord::RecordNotFound
-              error!({ message: "ID:#{id} not found" }, 404)
+              error!({message: "ID:#{id} not found"}, 404)
             end
             raise result.failure
           end
 
           desc "Create an alert", {
-            success: { code: 201, model: Entities::Alert },
+            success: {code: 201, model: Entities::Alert},
             failure: [
-              { code: 404, model: Entities::ErrorMessage }
+              {code: 404, model: Entities::ErrorMessage}
             ],
             summary: "Create an alert"
           }
           params do
-            requires :ruleId, type: String, documentation: { param_type: "body" }
-            requires :artifacts, type: Array, documentation: { type: String, is_array: true, param_type: "body" }
-            optional :source, type: String, documentation: { param_type: "body" }
+            requires :ruleId, type: String, documentation: {param_type: "body"}
+            requires :artifacts, type: Array, documentation: {type: String, is_array: true, param_type: "body"}
+            optional :source, type: String, documentation: {param_type: "body"}
           end
           post "/" do
             status 201
@@ -93,7 +93,7 @@ module Mihari
 
             case result.failure
             when ActiveRecord::RecordNotFound
-              error!({ message: "Rule:#{params["ruleId"]} not found" }, 404)
+              error!({message: "Rule:#{params["ruleId"]} not found"}, 404)
             end
             raise result.failure
           end

data/lib/mihari/web/endpoints/artifacts.rb

@@ -33,7 +33,7 @@ module Mihari
 
           desc "Get an artifact", {
             success: Entities::Artifact,
-            failure: [{ code: 404, model: Entities::ErrorMessage }],
+            failure: [{code: 404, model: Entities::ErrorMessage}],
             summary: "Get an artifact"
           }
           params do
@@ -46,14 +46,14 @@ module Mihari
 
             case result.failure
             when ActiveRecord::RecordNotFound
-              error!({ message: "ID:#{id} not found" }, 404)
+              error!({message: "ID:#{id} not found"}, 404)
             end
             raise result.failure
           end
 
           desc "Enrich an artifact", {
-            success: { code: 201, model: Entities::Message },
-            failure: [{ code: 400, model: Entities::ErrorMessage }, { code: 404, model: Entities::ErrorMessage }],
+            success: {code: 201, model: Entities::Message},
+            failure: [{code: 400, model: Entities::ErrorMessage}, {code: 404, model: Entities::ErrorMessage}],
             summary: "Enrich an artifact"
           }
           params do
@@ -75,20 +75,20 @@ module Mihari
             end.to_result
 
             message = queued ? "ID:#{id}'s enrichment is queued" : "ID:#{id}'s enrichment is successful"
-            return present({ message: message, queued: queued }, with: Entities::QueueMessage) if result.success?
+            return present({message:, queued:}, with: Entities::QueueMessage) if result.success?
 
             case result.failure
             when UnenrichableError
-              error!({ message: result.failure.message }, 400)
+              error!({message: result.failure.message}, 400)
             when ActiveRecord::RecordNotFound
-              error!({ message: "ID:#{id} not found" }, 404)
+              error!({message: "ID:#{id} not found"}, 404)
             end
             raise result.failure
           end
 
           desc "Delete an artifact", {
-            success: { code: 204, model: Entities::Message },
-            failure: [{ code: 404, model: Entities::ErrorMessage }],
+            success: {code: 204, model: Entities::Message},
+            failure: [{code: 404, model: Entities::ErrorMessage}],
             summary: "Delete an artifact"
           }
           params do
@@ -99,11 +99,11 @@ module Mihari
 
             id = params["id"].to_i
             result = Services::ArtifactDestroyer.result(id)
-            return present({ message: "" }, with: Entities::Message) if result.success?
+            return present({message: ""}, with: Entities::Message) if result.success?
 
             case result.failure
             when ActiveRecord::RecordNotFound
-              error!({ message: "ID:#{id} not found" }, 404)
+              error!({message: "ID:#{id} not found"}, 404)
             end
             raise result.failure
           end

data/lib/mihari/web/endpoints/configs.rb

@@ -10,12 +10,17 @@ module Mihari
         namespace :configs do
           desc "list configs", {
             is_array: true,
-            success: Entities::Config,
+            success: Entities::Configs,
             summary: "List configs"
           }
           get "/" do
             configs = Services::ConfigSearcher.call
-            present(configs, with: Entities::Config)
+            present(
+              {
+                results: configs
+              },
+              with: Entities::Configs
+            )
           end
         end
       end

data/lib/mihari/web/endpoints/ip_addresses.rb

@@ -11,15 +11,15 @@ module Mihari
           desc "Get IP address data", {
             success: Entities::IPAddress,
             failure: [
-              { code: 404, model: Entities::ErrorMessage },
-              { code: 422, model: Entities::ErrorMessage }
+              {code: 404, model: Entities::ErrorMessage},
+              {code: 422, model: Entities::ErrorMessage}
             ],
             summary: "Get IP address data"
           }
           params do
             requires :ip, type: String
           end
-          get "/:ip", requirements: { ip: %r{[^/]+} } do
+          get "/:ip", requirements: {ip: %r{[^/]+}} do
             ip = params[:ip].to_s
             result = Services::IPGetter.result(ip)
             if result.success?
@@ -37,8 +37,8 @@ module Mihari
             failure = result.failure
             case failure
             when Mihari::StatusError
-              error!({ message: "IP:#{ip} not found" }, failure.status_code) if failure.status_code == 404
-              error!({ message: "IP format invalid" }, failure.status_code) if failure.status_code == 422
+              error!({message: "IP:#{ip} not found"}, failure.status_code) if failure.status_code == 404
+              error!({message: "IP format invalid"}, failure.status_code) if failure.status_code == 422
             end
             raise failure
           end