mihari 7.5.0 → 7.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 71b5cf7cdeb320c813848b90973908a3999c839f742b9307ae819c1fbf20829b
-  data.tar.gz: 18b06e35086d2888016d6d1fd7a61c9e62f72e31f6a384e0c1a96f4fde8ab592
+  metadata.gz: 2fd0c07fe2661f57d6db5b409c527789c5e17d23e7691d5ac241ff5b36a20698
+  data.tar.gz: d7f2a832b3cb364aca8bdfad71cf762f72dc707892d2697ef8bb272bcb794b1d
 SHA512:
-  metadata.gz: 2861d810f7ade8e177fd343e706c55a4ef64f734c3f19ae324a58d29c2992b3a11ccc8ad6d6735dff9831b15ce552305e3981c72b9326d55b83f621154f9d2f9
-  data.tar.gz: edf9f41d660252298cb5909eec731a6ca39968eab5d73c3d6eca3d55f8b452337ee22898427e9165312881058f6e2ba474d6f548aac922431c1b483b7a9c9746
+  metadata.gz: 39c5c92cf79721ed6d98b09a63a3d609eab8e8da9ba5badb1cd1a9f01fcb04d8f11edaa3b50fd7e0aed6dcb44f7befb77166e9bbf8399bac4d6592eafd943763
+  data.tar.gz: 7c06bd2ca9616605aa9601d198a413529f92205861dcafbfd86e84fa5bca6e2344d42ef558f27ee4c358f09778679fdaa2018954a6d34bfa534f2a3fa155042d

data/.shadowenv.d/000_unset_all.lisp

@@ -35,5 +35,6 @@
 (env/set "THEHIVE_API_KEY" ())
 (env/set "THEHIVE_URL" ())
 (env/set "URLSCAN_API_KEY" ())
+(env/set "VALIDIN_API_KEY" ())
 (env/set "VIRUSTOTAL_API_KEY" ())
 (env/set "ZOOMEYE_API_KEY" ())

data/Rakefile

@@ -55,17 +55,21 @@ namespace :build do
 
     puts "Swagger doc is built in #{elapsed}s"
   end
+
+  desc "Build frontend assets"
+  task :frontend do
+    # Build frontend assets
+    sh "cd frontend && npm install && npm run docs && npm run build-only"
+    # Copy built assets into ./lib/web/public/
+    sh "rm -rf ./lib/mihari/web/public/"
+    sh "mkdir -p ./lib/mihari/web/public/"
+    sh "cp -r frontend/dist/* ./lib/mihari/web/public"
+  end
 end
 
 task :build do
   Rake::Task["build:swagger"].invoke
-
-  # Build ReDocs docs & frontend assets
-  sh "cd frontend && npm install && npm run docs && npm run build-only"
-  # Copy built assets into ./lib/web/public/
-  sh "rm -rf ./lib/mihari/web/public/"
-  sh "mkdir -p ./lib/mihari/web/public/"
-  sh "cp -r frontend/dist/* ./lib/mihari/web/public"
+  Rake::Task["build:frontend"].invoke
 end
 
 # require it later enables doing pre-build step (= build the frontend app)

data/lib/mihari/analyzers/validin.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require "mihari/clients/validin"
+
+module Mihari
+  module Analyzers
+    #
+    # Validin analyzer
+    #
+    class Validin < Base
+      include Concerns::Refangable
+
+      # @return [String, nil]
+      attr_reader :type
+
+      # @return [String, nil]
+      attr_reader :username
+
+      # @return [String, nil]
+      attr_reader :api_key
+
+      #
+      # @param [String] query
+      # @param [Hash, nil] options
+      # @param [String, nil] api_key
+      #
+      def initialize(query, options: nil, api_key: nil)
+        super(refang(query), options:)
+
+        @type = DataType.type(query)
+
+        @api_key = api_key || Mihari.config.validin_api_key
+      end
+
+      def artifacts
+        case type
+        when "domain"
+          dns_history_search
+        when "ip"
+          reverse_ip_search
+        else
+          raise ValueError, "#{query}(type: #{type || "unknown"}) is not supported." unless valid_type?
+        end
+      end
+
+      private
+
+      def dns_history_search
+        res = client.dns_history_search(query)
+        (res.dig("records", "A") || []).filter_map do |r|
+          r["value"]
+        end
+      end
+
+      def reverse_ip_search
+        res = client.dns_history_search(query)
+        (res.dig("records", "A") || []).filter_map do |r|
+          r["value"]
+        end
+      end
+
+      def client
+        Clients::Validin.new(api_key:, timeout:)
+      end
+
+      #
+      # Check whether a type is valid or not
+      #
+      # @return [Boolean]
+      #
+      def valid_type?
+        %w[ip domain].include? type
+      end
+    end
+  end
+end

data/lib/mihari/clients/validin.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Mihari
+  module Clients
+    #
+    # Validin API client
+    #
+    class Validin < Base
+      #
+      # @param [String] base_url
+      # @param [String, nil] api_key
+      # @param [Hash] headers
+      # @param [Integer, nil] timeout
+      #
+      def initialize(
+        base_url = "https://app.validin.com",
+        api_key:,
+        headers: {},
+        timeout: nil
+      )
+        raise(ArgumentError, "api_key is required") if api_key.nil?
+
+        headers["Authorization"] = "Bearer #{api_key}"
+
+        super(base_url, headers:, timeout:)
+      end
+
+      #
+      # @param [String] domain
+      #
+      # @return [Hash]
+      #
+      def dns_history_search(domain)
+        get_json "/api/axon/domain/dns/history/#{domain}/A"
+      end
+
+      #
+      # @param [String] ip
+      #
+      # @return [Hash]
+      #
+      def search_reverse_ip(ip)
+        get_json "/api/axon/ip/dns/history/#{ip}"
+      end
+    end
+  end
+end

data/lib/mihari/config.rb

@@ -33,6 +33,7 @@ module Mihari
       thehive_api_key: nil,
       thehive_url: nil,
       urlscan_api_key: nil,
+      validin_api_key: nil,
       virustotal_api_key: nil,
       yeti_api_key: nil,
       yeti_url: nil,
@@ -122,6 +123,9 @@ module Mihari
     # @!attribute [r] urlscan_api_key
     #   @return [String, nil]
 
+    # @!attribute [r] validin_api_key
+    #   @return [String, nil]
+
     # @!attribute [r] virustotal_api_key
     #   @return [String, nil]
 

data/lib/mihari/schemas/analyzer.rb

@@ -15,6 +15,7 @@ module Mihari
         Mihari::Analyzers::Onyphe.keys,
         Mihari::Analyzers::Shodan.keys,
         Mihari::Analyzers::Urlscan.keys,
+        Mihari::Analyzers::Validin.keys,
         Mihari::Analyzers::VirusTotalIntelligence.keys
       ].each do |keys|
         key = keys.first

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "7.5.0"
+  VERSION = "7.6.1"
 end

data/lib/mihari/web/endpoints/alerts.rb

@@ -52,7 +52,7 @@ module Mihari
           end
 
           desc "Delete an alert", {
-            success: {code: 204, model: Entities::Message},
+            success: {code: 204},
             failure: [{code: 404, model: Entities::ErrorMessage}],
             summary: "Delete an alert"
           }
@@ -60,11 +60,9 @@ module Mihari
             requires :id, type: Integer
           end
           delete "/:id" do
-            status 204
-
             id = params["id"].to_i
             result = Services::AlertDestroyer.result(id)
-            return present({message: ""}, with: Entities::Message) if result.success?
+            return if result.success?
 
             case result.failure
             when ActiveRecord::RecordNotFound

data/lib/mihari/web/endpoints/artifacts.rb

@@ -87,7 +87,7 @@ module Mihari
           end
 
           desc "Delete an artifact", {
-            success: {code: 204, model: Entities::Message},
+            success: {code: 204},
             failure: [{code: 404, model: Entities::ErrorMessage}],
             summary: "Delete an artifact"
           }
@@ -99,7 +99,7 @@ module Mihari
 
             id = params["id"].to_i
             result = Services::ArtifactDestroyer.result(id)
-            return present({message: ""}, with: Entities::Message) if result.success?
+            return if result.success?
 
             case result.failure
             when ActiveRecord::RecordNotFound

data/lib/mihari/web/endpoints/configs.rb

@@ -15,12 +15,7 @@ module Mihari
           }
           get "/" do
             configs = Services::ConfigSearcher.call
-            present(
-              {
-                results: configs
-              },
-              with: Entities::Configs
-            )
+            present({results: configs}, with: Entities::Configs)
           end
         end
       end

data/lib/mihari/web/endpoints/rules.rb

@@ -167,7 +167,7 @@ module Mihari
           end
 
           desc "Delete a rule", {
-            success: {code: 204, model: Entities::Message},
+            success: {code: 204},
             failure: [{code: 404, model: Entities::ErrorMessage}],
             summary: "Delete a rule"
           }
@@ -179,7 +179,7 @@ module Mihari
 
             id = params[:id].to_s
             result = Services::RuleDestroyer.result(id)
-            return present({message: "ID:#{id} is deleted"}, with: Entities::Message) if result.success?
+            return if result.success?
 
             case result.failure
             when ActiveRecord::RecordNotFound

data/lib/mihari/web/endpoints/tags.rb

@@ -32,7 +32,7 @@ module Mihari
           end
 
           desc "Delete a tag", {
-            success: {code: 204, model: Entities::Message},
+            success: {code: 204},
             failure: [{code: 404, model: Entities::ErrorMessage}],
             summary: "Delete a tag"
           }
@@ -44,7 +44,7 @@ module Mihari
 
             id = params[:id].to_i
             result = Services::TagDestroyer.result(id)
-            return present({message: ""}, with: Entities::Message) if result.success?
+            return if result.success?
 
             case result.failure
             when ActiveRecord::RecordNotFound