mihari 7.4.0 → 7.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9ec4774493a408eb666c7a33e671c977f7c400356758aab00ba776b36910bc42
-  data.tar.gz: bf0e0269c1e12d73b064d06ebf41e10686caeb66aaf70ec39f4e3ce7843bc51a
+  metadata.gz: 71b5cf7cdeb320c813848b90973908a3999c839f742b9307ae819c1fbf20829b
+  data.tar.gz: 18b06e35086d2888016d6d1fd7a61c9e62f72e31f6a384e0c1a96f4fde8ab592
 SHA512:
-  metadata.gz: 6dff8b5b3bcd3098bb90e84f1d026325ca5a24d2cffb30761e2c243dfbc81bfef8093bd885ef7e9b07a2338ef2ca1cba10686fd7612a6261205c08f0b9258a15
-  data.tar.gz: 6958e9d9e344b98c29209ce4d5501ded9b8584367cf5556c99e351913e0fe8800d829ccedb53704951a7b29eb5b73950e071ff2460e95ad067aff81dbef2c81d
+  metadata.gz: 2861d810f7ade8e177fd343e706c55a4ef64f734c3f19ae324a58d29c2992b3a11ccc8ad6d6735dff9831b15ce552305e3981c72b9326d55b83f621154f9d2f9
+  data.tar.gz: edf9f41d660252298cb5909eec731a6ca39968eab5d73c3d6eca3d55f8b452337ee22898427e9165312881058f6e2ba474d6f548aac922431c1b483b7a9c9746

data/lib/mihari/clients/base.rb

@@ -87,11 +87,12 @@ module Mihari
       #
       # @param [String] path
       # @param [Hash, nil] json
+      # @param [Hash, nil] headers
       #
       # @return [Hash]
       #
-      def post_json(path, json: {})
-        res = http.post(url_for(path), json:)
+      def post_json(path, json: {}, headers: nil)
+        res = http.post(url_for(path), json:, headers: headers || {})
         JSON.parse res.body.to_s
       end
     end

data/lib/mihari/clients/whois.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+require "whois-parser"
+
+module Mihari
+  module Clients
+    #
+    # Whois client
+    #
+    class Whois
+      # @return [Integer, nil]
+      attr_reader :timeout
+
+      # @return [::Whois::Client]
+      attr_reader :client
+
+      #
+      # @param [Integer, nil] timeout
+      #
+      def initialize(timeout: nil)
+        @timeout = timeout
+
+        @client = lambda do
+          return ::Whois::Client.new if timeout.nil?
+
+          ::Whois::Client.new(timeout:)
+        end.call
+      end
+
+      #
+      # Query IAIA Whois API
+      #
+      # @param [Mihari::Models::Artifact] artifact
+      #
+      # @param [Object] domain
+      def lookup(domain)
+        record = client.lookup(domain)
+        return if record.parser.available?
+
+        Models::WhoisRecord.new(
+          domain:,
+          created_on: get_created_on(record.parser),
+          updated_on: get_updated_on(record.parser),
+          expires_on: get_expires_on(record.parser),
+          registrar: get_registrar(record.parser),
+          contacts: get_contacts(record.parser)
+        )
+      end
+
+      private
+
+      #
+      # Get created_on
+      #
+      # @param [::Whois::Parser] parser
+      #
+      # @return [Date, nil]
+      #
+      def get_created_on(parser)
+        parser.created_on
+      rescue ::Whois::AttributeNotImplemented
+        nil
+      end
+
+      #
+      # Get updated_on
+      #
+      # @param [::Whois::Parser] parser
+      #
+      # @return [Date, nil]
+      #
+      def get_updated_on(parser)
+        parser.updated_on
+      rescue ::Whois::AttributeNotImplemented
+        nil
+      end
+
+      #
+      # Get expires_on
+      #
+      # @param [::Whois::Parser] parser
+      #
+      # @return [Date, nil]
+      #
+      def get_expires_on(parser)
+        parser.expires_on
+      rescue ::Whois::AttributeNotImplemented
+        nil
+      end
+
+      #
+      # Get registrar
+      #
+      # @param [::Whois::Parser] parser
+      #
+      # @return [Hash, nil]
+      #
+      def get_registrar(parser)
+        parser.registrar&.to_h
+      rescue ::Whois::AttributeNotImplemented
+        nil
+      end
+
+      #
+      # Get contacts
+      #
+      # @param [::Whois::Parser] parser
+      #
+      # @return [Array<Hash>, nil]
+      #
+      def get_contacts(parser)
+        parser.contacts.map(&:to_h)
+      rescue ::Whois::AttributeNotImplemented
+        nil
+      end
+    end
+  end
+end

data/lib/mihari/clients/yeti.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Mihari
+  module Clients
+    #
+    # Yeti API client
+    #
+    class Yeti < Base
+      #
+      # @param [String] base_url
+      # @param [String, nil] api_key
+      # @param [Hash] headers
+      # @param [Integer, nil] timeout
+      #
+      def initialize(base_url, api_key:, headers: {}, timeout: nil)
+        raise(ArgumentError, "api_key is required") unless api_key
+
+        headers["x-yeti-apikey"] = api_key
+        super(base_url, headers:, timeout:)
+      end
+
+      def get_token
+        res = post_json("/api/v2/auth/api-token")
+        res["access_token"]
+      end
+
+      #
+      # @param [Hash] json
+      #
+      # @return [Hash]
+      #
+      def create_observables(json)
+        token = get_token
+        post_json("/api/v2/observables/bulk", json:, headers: {authorization: "Bearer #{token}"})
+      end
+    end
+  end
+end

data/lib/mihari/config.rb

@@ -34,6 +34,8 @@ module Mihari
       thehive_url: nil,
       urlscan_api_key: nil,
       virustotal_api_key: nil,
+      yeti_api_key: nil,
+      yeti_url: nil,
       zoomeye_api_key: nil,
       # sidekiq
       sidekiq_redis_url: nil,
@@ -123,6 +125,12 @@ module Mihari
     # @!attribute [r] virustotal_api_key
     #   @return [String, nil]
 
+    # @!attribute [r] yeti_url
+    #   @return [String, nil]
+
+    # @!attribute [r] yeti_api_key
+    #   @return [String, nil]
+
     # @!attribute [r] zoomeye_api_key
     #   @return [String, nil]
 

data/lib/mihari/data_type.rb

@@ -26,9 +26,7 @@ module Mihari
 
     # @return [Boolean]
     def ip?
-      Try[IPAddr::InvalidAddressError] do
-        IPAddr.new(data).to_s == data
-      end.recover { false }.value!
+      Try[IPAddr::InvalidAddressError] { IPAddr.new(data).to_s == data }.recover { false }.value!
     end
 
     # @return [Boolean]

data/lib/mihari/emitters/yeti.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+module Mihari
+  module Emitters
+    class Yeti < Base
+      # @return [String, nil]
+      attr_reader :url
+
+      # @return [String, nil]
+      attr_reader :api_key
+
+      # @return [Array<Mihari::Models::Artifact>]
+      attr_accessor :artifacts
+
+      #
+      # @param [Mihari::Rule] rule
+      # @param [Hash, nil] options
+      # @param [Hash] params
+      #
+      def initialize(rule:, options: nil, **params)
+        super(rule:, options:)
+
+        @url = params[:url] || Mihari.config.yeti_url
+        @api_key = params[:api_key] || Mihari.config.yeti_api_key
+
+        @artifacts = []
+      end
+
+      #
+      # @return [Boolean]
+      #
+      def configured?
+        api_key? && url?
+      end
+
+      #
+      # Create a Hive alert
+      #
+      # @param [Array<Mihari::Models::Artifact>] artifacts
+      #
+      def call(artifacts)
+        return if artifacts.empty?
+
+        @artifacts = artifacts
+
+        client.create_observables({observables:})
+      end
+
+      #
+      # @return [String]
+      #
+      def target
+        URI(url).host || "N/A"
+      end
+
+      private
+
+      def client
+        Clients::Yeti.new(url, api_key:, timeout:)
+      end
+
+      #
+      # Check whether a URL is set or not
+      #
+      # @return [Boolean]
+      #
+      def url?
+        !url.nil?
+      end
+
+      def acceptable_artifacts
+        artifacts.reject { |artifact| artifact.data_type == "mail" }
+      end
+
+      #
+      # @param [Mihari::Models::Artifact] artifact
+      #
+      # @return [Hash]
+      #
+      def artifact_to_observable(artifact)
+        convert_table = {
+          domain: "hostname",
+          ip: "ipv4"
+        }
+
+        type = lambda do
+          detailed_type = DataType.detailed_type(artifact.data)
+          convert_table[detailed_type.to_sym] || detailed_type || artifact.data_type
+        end.call
+
+        {
+          tags:,
+          type:,
+          value: artifact.data
+        }
+      end
+
+      def tags
+        @tags ||= rule.tags.map(&:name)
+      end
+
+      def observables
+        acceptable_artifacts.map { |artifact| artifact_to_observable(artifact) }
+      end
+    end
+  end
+end

data/lib/mihari/enrichers/whois.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "whois-parser"
-
 module Mihari
   module Enrichers
     #
@@ -18,22 +16,15 @@ module Mihari
       def call(artifact)
         return if artifact.domain.nil?
 
-        domain = PublicSuffix.domain(artifact.domain)
-        record = memoized_lookup(domain)
-        return if record.parser.available?
-
-        artifact.whois_record ||= Models::WhoisRecord.new(
-          domain:,
-          created_on: get_created_on(record.parser),
-          updated_on: get_updated_on(record.parser),
-          expires_on: get_expires_on(record.parser),
-          registrar: get_registrar(record.parser),
-          contacts: get_contacts(record.parser)
-        )
+        artifact.whois_record ||= memoized_lookup(PublicSuffix.domain(artifact.domain))
       end
 
       private
 
+      def client
+        @client ||= Clients::Whois.new(timeout:)
+      end
+
       #
       # @param [Mihari::Models::Artifact] artifact
       #
@@ -53,85 +44,9 @@ module Mihari
       # @return [Mihari::Models::WhoisRecord, nil]
       #
       def memoized_lookup(domain)
-        whois.lookup domain
+        client.lookup domain
       end
       memo_wise :memoized_lookup
-
-      #
-      # @return [::Whois::Client]
-      #
-      def whois
-        @whois ||= lambda do
-          return ::Whois::Client.new if timeout.nil?
-
-          ::Whois::Client.new(timeout:)
-        end.call
-      end
-
-      #
-      # Get created_on
-      #
-      # @param [::Whois::Parser] parser
-      #
-      # @return [Date, nil]
-      #
-      def get_created_on(parser)
-        parser.created_on
-      rescue ::Whois::AttributeNotImplemented
-        nil
-      end
-
-      #
-      # Get updated_on
-      #
-      # @param [::Whois::Parser] parser
-      #
-      # @return [Date, nil]
-      #
-      def get_updated_on(parser)
-        parser.updated_on
-      rescue ::Whois::AttributeNotImplemented
-        nil
-      end
-
-      #
-      # Get expires_on
-      #
-      # @param [::Whois::Parser] parser
-      #
-      # @return [Date, nil]
-      #
-      def get_expires_on(parser)
-        parser.expires_on
-      rescue ::Whois::AttributeNotImplemented
-        nil
-      end
-
-      #
-      # Get registrar
-      #
-      # @param [::Whois::Parser] parser
-      #
-      # @return [Hash, nil]
-      #
-      def get_registrar(parser)
-        parser.registrar&.to_h
-      rescue ::Whois::AttributeNotImplemented
-        nil
-      end
-
-      #
-      # Get contacts
-      #
-      # @param [::Whois::Parser] parser
-      #
-      # @return [Array<Hash>, nil]
-      #
-      def get_contacts(parser)
-        parser.contacts.map(&:to_h)
-      rescue ::Whois::AttributeNotImplemented
-        nil
-      end
     end
   end
 end

data/lib/mihari/schemas/emitter.rb

@@ -29,6 +29,13 @@ module Mihari
         optional(:options).hash(EmitterOptions)
       end
 
+      Yeti = Dry::Schema.Params do
+        required(:emitter).value(Types::String.enum(*Mihari::Emitters::Yeti.keys))
+        optional(:url).filled(:string)
+        optional(:api_key).filled(:string)
+        optional(:options).hash(EmitterOptions)
+      end
+
       Slack = Dry::Schema.Params do
         required(:emitter).value(Types::String.enum(*Mihari::Emitters::Slack.keys))
         optional(:webhook_url).filled(:string)

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "7.4.0"
+  VERSION = "7.5.0"
 end