misp 0.1.0 → 0.1.4

Sign up to get free protection for your applications and to get access to all the features.
data/lib/misp/event.rb CHANGED
@@ -2,68 +2,99 @@
2
2
 
3
3
  module MISP
4
4
  class Event < Base
5
+ # @return [String]
5
6
  attr_reader :id
7
+ # @return [String]
6
8
  attr_accessor :orgc_id
9
+ # @return [String]
7
10
  attr_accessor :org_id
11
+ # @return [String]
8
12
  attr_accessor :date
13
+ # @return [String]
9
14
  attr_accessor :threat_level_id
15
+ # @return [String]
10
16
  attr_accessor :info
17
+ # @return [Boolean]
11
18
  attr_accessor :published
19
+ # @return [String]
12
20
  attr_reader :uuid
21
+ # @return [String]
13
22
  attr_accessor :attribute_count
23
+ # @return [String]
14
24
  attr_accessor :analysis
25
+ # @return [String]
15
26
  attr_accessor :timestamp
27
+ # @return [String]
16
28
  attr_accessor :distribution
29
+ # @return [Boolean]
17
30
  attr_accessor :proposal_email_lock
31
+ # @return [Boolean]
18
32
  attr_accessor :locked
33
+ # @return [String]
19
34
  attr_accessor :publish_timestamp
35
+ # @return [String]
20
36
  attr_accessor :sharing_group_id
37
+ # @return [Boolean]
21
38
  attr_accessor :disable_correlation
39
+ # @return [String]
22
40
  attr_accessor :event_creator_email
23
41
 
42
+ # @return [MISP::Org, nil]
24
43
  attr_accessor :org
44
+ # @return [MISP::Orgc, nil]
25
45
  attr_accessor :orgc
26
46
 
47
+ # @return [Array<MISP::SharingGroup>]
27
48
  attr_accessor :sharing_groups
49
+ # @return [Array<MISP::Attribute>]
28
50
  attr_accessor :attributes
51
+ # @return [Array<MISP::Attribute>]
29
52
  attr_accessor :shadow_attributes
53
+ # @return [Array<MISP::Event>]
30
54
  attr_accessor :related_events
55
+ # @return [Array<<MISP::Galaxy>]
31
56
  attr_accessor :galaxies
57
+ # @return [Array<<MISP::Tag>]
32
58
  attr_accessor :tags
33
59
 
34
60
  def initialize(**attrs)
35
- attrs = normalize_attributes(attrs)
36
-
37
- @id = attrs.dig(:id)
38
- @orgc_id = attrs.dig(:orgc_id)
39
- @org_id = attrs.dig(:org_id)
40
- @date = attrs.dig(:date)
41
- @threat_level_id = attrs.dig(:threat_level_id)
42
- @info = attrs.dig(:info)
43
- @published = attrs.dig(:published) || false
44
- @uuid = attrs.dig(:uuid)
45
- @attribute_count = attrs.dig(:attribute_count)
46
- @analysis = attrs.dig(:analysis)
47
- @timestamp = attrs.dig(:timestamp)
48
- @distribution = attrs.dig(:distribution)
49
- @proposal_email_lock = attrs.dig(:proposal_email_lock)
50
- @locked = attrs.dig(:locked) || false
51
- @publish_timestamp = attrs.dig(:publish_timestamp)
52
- @sharing_group_id = attrs.dig(:sharing_group_id)
53
- @disable_correlation = attrs.dig(:disable_correlation)
54
- @event_creator_email = attrs.dig(:event_creator_email)
55
-
56
- @org = build_attribute(item: attrs.dig(:Org), klass: Org)
57
- @orgc = build_attribute(item: attrs.dig(:Orgc), klass: Orgc)
58
-
59
- @sharing_groups = build_plural_attribute(items: attrs.dig(:SharingGroup), klass: SharingGroup)
60
- @attributes = build_plural_attribute(items: attrs.dig(:Attribute), klass: Attribute)
61
- @shadow_attributes = build_plural_attribute(items: attrs.dig(:ShadowAttribute), klass: Attribute )
62
- @related_events = build_plural_attribute(items: attrs.dig(:RelatedEvent), klass: Attribute)
63
- @galaxies = build_plural_attribute(items: attrs.dig(:Galaxy), klass: Galaxy)
64
- @tags = build_plural_attribute(items: attrs.dig(:Tag), klass: Tag)
65
- end
66
-
61
+ attrs = normalize_attributes(**attrs)
62
+
63
+ @id = attrs[:id]
64
+ @orgc_id = attrs[:orgc_id]
65
+ @org_id = attrs[:org_id]
66
+ @date = attrs[:date]
67
+ @threat_level_id = attrs[:threat_level_id]
68
+ @info = attrs[:info]
69
+ @published = attrs[:published] || false
70
+ @uuid = attrs[:uuid]
71
+ @attribute_count = attrs[:attribute_count]
72
+ @analysis = attrs[:analysis]
73
+ @timestamp = attrs[:timestamp]
74
+ @distribution = attrs[:distribution]
75
+ @proposal_email_lock = attrs[:proposal_email_lock]
76
+ @locked = attrs[:locked] || false
77
+ @publish_timestamp = attrs[:publish_timestamp]
78
+ @sharing_group_id = attrs[:sharing_group_id]
79
+ @disable_correlation = attrs[:disable_correlation]
80
+ @event_creator_email = attrs[:event_creator_email]
81
+
82
+ @org = build_attribute(item: attrs[:Org], klass: Org)
83
+ @orgc = build_attribute(item: attrs[:Orgc], klass: Orgc)
84
+
85
+ @sharing_groups = build_plural_attribute(items: attrs[:SharingGroup], klass: SharingGroup)
86
+ @attributes = build_plural_attribute(items: attrs[:Attribute], klass: Attribute)
87
+ @shadow_attributes = build_plural_attribute(items: attrs[:ShadowAttribute], klass: Attribute )
88
+ @related_events = build_plural_attribute(items: attrs[:RelatedEvent], klass: Attribute)
89
+ @galaxies = build_plural_attribute(items: attrs[:Galaxy], klass: Galaxy)
90
+ @tags = build_plural_attribute(items: attrs[:Tag], klass: Tag)
91
+ end
92
+
93
+ #
94
+ # Returns a hash representation of the attribute data.
95
+ #
96
+ # @return [Hash]
97
+ #
67
98
  def to_h
68
99
  compact(
69
100
  id: id,
@@ -95,53 +126,65 @@ module MISP
95
126
  )
96
127
  end
97
128
 
129
+ #
130
+ # Get an event
131
+ #
132
+ # @return [MISP::Event]
133
+ #
98
134
  def get(id)
99
- _get("/events/#{id}") { |event| Event.new symbolize_keys(event) }
100
- end
101
-
102
- def self.get(id)
103
- new.get id
135
+ _get("/events/#{id}") { |event| Event.new(**event) }
104
136
  end
105
137
 
138
+ #
139
+ # Create an event
140
+ #
141
+ # @param [Hash] **attrs attributes
142
+ #
143
+ # @return [MISP::Event]
144
+ #
106
145
  def create(**attrs)
107
146
  payload = to_h.merge(attrs)
108
- _post("/events/add", wrap(payload)) { |event| Event.new symbolize_keys(event) }
109
- end
110
-
111
- def self.create(**attrs)
112
- new.create attrs
147
+ _post("/events/add", wrap(payload)) { |event| Event.new(**event) }
113
148
  end
114
149
 
150
+ #
151
+ # Delete an event
152
+ #
153
+ # @return [Hash]
154
+ #
115
155
  def delete
116
156
  _delete("/events/#{id}") { |json| json }
117
157
  end
118
158
 
119
- def self.delete(id)
120
- new(id: id).delete
121
- end
122
-
159
+ #
160
+ # List events
161
+ #
162
+ # @return [Array<MISP::Event>]
163
+ #
123
164
  def list
124
165
  _get("/events/index") do |events|
125
166
  events.map do |event|
126
- Event.new symbolize_keys(event)
167
+ Event.new(**event)
127
168
  end
128
169
  end
129
170
  end
130
171
 
131
- def self.list
132
- new.list
133
- end
134
-
172
+ #
173
+ # Update an event
174
+ #
175
+ # @return [MISP::Event]
176
+ #
135
177
  def update(**attrs)
136
- payload = to_h.merge(attrs)
178
+ payload = to_h.merge(**attrs)
137
179
  payload[:timestamp] = nil
138
- _post("/events/#{id}", wrap(payload)) { |event| Event.new symbolize_keys(event) }
139
- end
140
-
141
- def self.update(id, **attrs)
142
- new(id: id).update attrs
180
+ _post("/events/#{id}", wrap(payload)) { |event| Event.new(**event) }
143
181
  end
144
182
 
183
+ #
184
+ # Search for events
185
+ #
186
+ # @return [Array<MISP::Event>]
187
+ #
145
188
  def search(**params)
146
189
  base = {
147
190
  returnFormat: "json",
@@ -150,27 +193,59 @@ module MISP
150
193
  }
151
194
 
152
195
  _post("/events/restSearch", base.merge(params)) do |json|
153
- events = json.dig("response") || []
154
- events.map { |event| Event.new symbolize_keys(event) }
196
+ events = json[:response] || []
197
+ events.map { |event| Event.new(**event) }
155
198
  end
156
199
  end
157
200
 
158
- def self.search(**params)
159
- new.search params
160
- end
161
-
201
+ #
202
+ # Add an attribute to an event. Requires an update or create call afterwards.
203
+ #
204
+ # @return [MISP::Event]
205
+ #
162
206
  def add_attribute(attribute)
163
- attribute = Attribute.new(symbolize_keys(attribute)) unless attribute.is_a?(Attribute)
207
+ attribute = Attribute.new(**attribute) unless attribute.is_a?(Attribute)
164
208
  attributes << attribute
165
209
  self
166
210
  end
167
211
 
212
+ #
213
+ # Add a tag to an event. Requires an update or create call afterwards.
214
+ #
215
+ # @return [MISP::Event]
216
+ #
168
217
  def add_tag(tag)
169
- tag = Tag.new(symbolize_keys(tag)) unless tag.is_a?(MISP::Tag)
218
+ tag = Tag.new(**tag) unless tag.is_a?(MISP::Tag)
170
219
  tags << tag
171
220
  self
172
221
  end
173
222
 
223
+ class << self
224
+ def get(id)
225
+ new.get id
226
+ end
227
+
228
+ def create(**attrs)
229
+ new.create(**attrs)
230
+ end
231
+
232
+ def delete(id)
233
+ new(id: id).delete
234
+ end
235
+
236
+ def list
237
+ new.list
238
+ end
239
+
240
+ def update(id, **attrs)
241
+ new(id: id).update(**attrs)
242
+ end
243
+
244
+ def search(**params)
245
+ new.search(**params)
246
+ end
247
+ end
248
+
174
249
  private
175
250
 
176
251
  def compact(hash)
data/lib/misp/feed.rb CHANGED
@@ -2,56 +2,83 @@
2
2
 
3
3
  module MISP
4
4
  class Feed < Base
5
+ # @return [String]
5
6
  attr_reader :id
7
+ # @return [String]
6
8
  attr_reader :name
9
+ # @return [String]
7
10
  attr_reader :provider
11
+ # @return [String]
8
12
  attr_reader :url
13
+ # @return [String]
9
14
  attr_reader :rules
15
+ # @return [Boolean]
10
16
  attr_reader :enabled
17
+ # @return [String]
11
18
  attr_reader :distribution
19
+ # @return [String]
12
20
  attr_reader :sharing_group_id
21
+ # @return [String]
13
22
  attr_reader :tag_id
23
+ # @return [String]
14
24
  attr_reader :default
25
+ # @return [String]
15
26
  attr_reader :source_format
27
+ # @return [Boolean]
16
28
  attr_reader :fixed_event
29
+ # @return [Boolean]
17
30
  attr_reader :delta_merge
31
+ # @return [String]
18
32
  attr_reader :event_id
33
+ # @return [String]
19
34
  attr_reader :publish
35
+ # @return [String]
20
36
  attr_reader :override_ids
37
+ # @return [String]
21
38
  attr_reader :settings
39
+ # @return [String]
22
40
  attr_reader :input_source
41
+ # @return [Boolean]
23
42
  attr_reader :delete_local_file
43
+ # @return [Boolean]
24
44
  attr_reader :lookup_visible
45
+ # @return [String]
25
46
  attr_reader :headers
47
+ # @return [Boolean]
26
48
  attr_reader :caching_enabled
27
49
 
28
50
  def initialize(**attributes)
29
- attributes = normalize_attributes(attributes)
51
+ attributes = normalize_attributes(**attributes)
30
52
 
31
- @id = attributes.dig(:id)
32
- @name = attributes.dig(:name) || "feed name"
33
- @provider = attributes.dig(:provider) || "my provider"
34
- @url = attributes.dig(:url) || "http://example.com"
35
- @rules = attributes.dig(:rules) || ""
36
- @enabled = attributes.dig(:enabled)
37
- @distribution = attributes.dig(:distribution)
38
- @sharing_group_id = attributes.dig(:sharing_group_id)
39
- @tag_id = attributes.dig(:tag_id) || "0"
40
- @default = attributes.dig(:default) || true
41
- @source_format = attributes.dig(:source_format) || "misp"
42
- @fixed_event = attributes.dig(:fixed_event) || true
43
- @delta_merge = attributes.dig(:delta_merge) || false
44
- @event_id = attributes.dig(:event_id) || "0"
45
- @publish = attributes.dig(:publish) || true
46
- @override_ids = attributes.dig(:override_ids) || false
47
- @settings = attributes.dig(:settings) || ""
48
- @input_source = attributes.dig(:input_source) || "network"
49
- @delete_local_file = attributes.dig(:delete_local_file) || false
50
- @lookup_visible = attributes.dig(:lookup_visible) || true
51
- @headers = attributes.dig(:headers) || ""
52
- @caching_enabled = attributes.dig(:caching_enabled) || true
53
+ @id = attributes[:id]
54
+ @name = attributes[:name] || "feed name"
55
+ @provider = attributes[:provider] || "my provider"
56
+ @url = attributes[:url] || "http://example.com"
57
+ @rules = attributes[:rules] || ""
58
+ @enabled = attributes[:enabled]
59
+ @distribution = attributes[:distribution]
60
+ @sharing_group_id = attributes[:sharing_group_id]
61
+ @tag_id = attributes[:tag_id] || "0"
62
+ @default = attributes[:default] || true
63
+ @source_format = attributes[:source_format] || "misp"
64
+ @fixed_event = attributes[:fixed_event] || true
65
+ @delta_merge = attributes[:delta_merge] || false
66
+ @event_id = attributes[:event_id] || "0"
67
+ @publish = attributes[:publish] || true
68
+ @override_ids = attributes[:override_ids] || false
69
+ @settings = attributes[:settings] || ""
70
+ @input_source = attributes[:input_source] || "network"
71
+ @delete_local_file = attributes[:delete_local_file] || false
72
+ @lookup_visible = attributes[:lookup_visible] || true
73
+ @headers = attributes[:headers] || ""
74
+ @caching_enabled = attributes[:caching_enabled] || true
53
75
  end
54
76
 
77
+ #
78
+ # Returns a hash representation of the attribute data.
79
+ #
80
+ # @return [Hash]
81
+ #
55
82
  def to_h
56
83
  {
57
84
  id: id,
@@ -79,32 +106,51 @@ module MISP
79
106
  }.compact
80
107
  end
81
108
 
109
+ #
110
+ # List feeds
111
+ #
112
+ # @return [Array<MISP::Feed>]
113
+ #
82
114
  def list
83
115
  _get("/feeds/index") do |feeds|
84
116
  feeds.map do |feed|
85
- Feed.new symbolize_keys(feed)
117
+ Feed.new(**feed)
86
118
  end
87
119
  end
88
120
  end
89
121
 
90
- def self.list
91
- new.list
92
- end
93
-
122
+ #
123
+ # Create a feed
124
+ #
125
+ # @return [MISP::Feed]
126
+ #
94
127
  def get
95
- _get("/feeds/view/#{id}") { |feed| Feed.new symbolize_keys(feed) }
96
- end
97
-
98
- def self.get(id)
99
- new(id: id).get
128
+ _get("/feeds/view/#{id}") { |feed| Feed.new feed }
100
129
  end
101
130
 
131
+ #
132
+ # Create a feed
133
+ #
134
+ # @param [Hash] **attributes attributes
135
+ #
136
+ # @return [MIPS::Feed]
137
+ #
102
138
  def create(**attributes)
103
- _post("/feeds/add", wrap(attributes)) { |feed| Feed.new symbolize_keys(feed) }
139
+ _post("/feeds/add", wrap(attributes)) { |feed| Feed.new feed }
104
140
  end
105
141
 
106
- def self.create(attributes)
107
- new.create attributes
142
+ class << self
143
+ def list
144
+ new.list
145
+ end
146
+
147
+ def get(id)
148
+ new(id: id).get
149
+ end
150
+
151
+ def create(**attributes)
152
+ new.create attributes
153
+ end
108
154
  end
109
155
  end
110
156
  end
data/lib/misp/galaxy.rb CHANGED
@@ -2,28 +2,40 @@
2
2
 
3
3
  module MISP
4
4
  class Galaxy < Base
5
+ # @return [String]
5
6
  attr_reader :id
7
+ # @return [String]
6
8
  attr_reader :uuid
9
+ # @return [String]
7
10
  attr_reader :name
11
+ # @return [String]
8
12
  attr_reader :type
13
+ # @return [String]
9
14
  attr_reader :description
15
+ # @return [String]
10
16
  attr_reader :version
11
17
 
18
+ # @return [Array<MISP::GalaxyCluster>]
12
19
  attr_reader :galaxy_clusters
13
20
 
14
21
  def initialize(**attributes)
15
- attributes = normalize_attributes(attributes)
22
+ attributes = normalize_attributes(**attributes)
16
23
 
17
- @id = attributes.dig(:id)
18
- @uuid = attributes.dig(:uuid)
19
- @name = attributes.dig(:name)
20
- @type = attributes.dig(:type)
21
- @description = attributes.dig(:description)
22
- @version = attributes.dig(:version)
24
+ @id = attributes[:id]
25
+ @uuid = attributes[:uuid]
26
+ @name = attributes[:name]
27
+ @type = attributes[:type]
28
+ @description = attributes[:description]
29
+ @version = attributes[:version]
23
30
 
24
- @galaxy_clusters = build_plural_attribute(items: attributes.dig(:GalaxyCluster), klass: GalaxyCluster)
31
+ @galaxy_clusters = build_plural_attribute(items: attributes[:GalaxyCluster], klass: GalaxyCluster)
25
32
  end
26
33
 
34
+ #
35
+ # Returns a hash representation of the attribute data.
36
+ #
37
+ # @return [Hash]
38
+ #
27
39
  def to_h
28
40
  {
29
41
  id: id,
@@ -36,24 +48,36 @@ module MISP
36
48
  }.compact
37
49
  end
38
50
 
51
+ #
52
+ # List galaxies
53
+ #
54
+ # @return [Array<Galaxy>]
55
+ #
39
56
  def list
40
57
  _get("/galaxies/") do |galaxies|
41
58
  galaxies.map do |galaxy|
42
- Galaxy.new symbolize_keys(galaxy)
59
+ Galaxy.new(**galaxy)
43
60
  end
44
61
  end
45
62
  end
46
63
 
47
- def self.list
48
- new.list
49
- end
50
-
64
+ #
65
+ # Get a galaxy
66
+ #
67
+ # @return [MISP::Galaxy]
68
+ #
51
69
  def get
52
- _get("/galaxies/view/#{id}") { |galaxy| Galaxy.new symbolize_keys(galaxy) }
70
+ _get("/galaxies/view/#{id}") { |galaxy| Galaxy.new(**galaxy) }
53
71
  end
54
72
 
55
- def self.get(id)
56
- new(id: id).get
73
+ class << self
74
+ def list
75
+ new.list
76
+ end
77
+
78
+ def get(id)
79
+ new(id: id).get
80
+ end
57
81
  end
58
82
  end
59
83
  end
@@ -2,34 +2,50 @@
2
2
 
3
3
  module MISP
4
4
  class GalaxyCluster < Base
5
+ # @return [String]
5
6
  attr_reader :id
7
+ # @return [String]
6
8
  attr_reader :uuid
9
+ # @return [String]
7
10
  attr_reader :type
11
+ # @return [String]
8
12
  attr_reader :value
13
+ # @return [String]
9
14
  attr_reader :tag_name
15
+ # @return [String]
10
16
  attr_reader :description
17
+ # @return [String]
11
18
  attr_reader :galaxy_id
19
+ # @return [String]
12
20
  attr_reader :source
21
+ # @return [Array<String>]
13
22
  attr_reader :authors
23
+ # @return [String]
14
24
  attr_reader :tag_id
25
+ # @return [Hash]
15
26
  attr_reader :meta
16
27
 
17
28
  def initialize(**attributes)
18
- attributes = normalize_attributes(attributes)
29
+ attributes = normalize_attributes(**attributes)
19
30
 
20
- @id = attributes.dig(:id)
21
- @uuid = attributes.dig(:uuid)
22
- @type = attributes.dig(:type)
23
- @value = attributes.dig(:value)
24
- @tag_name = attributes.dig(:tag_name)
25
- @description = attributes.dig(:description)
26
- @galaxy_id = attributes.dig(:galaxy_id)
27
- @source = attributes.dig(:source)
28
- @authors = attributes.dig(:authors)
29
- @tag_id = attributes.dig(:tag_id)
30
- @meta = attributes.dig(:meta)
31
+ @id = attributes[:id]
32
+ @uuid = attributes[:uuid]
33
+ @type = attributes[:type]
34
+ @value = attributes[:value]
35
+ @tag_name = attributes[:tag_name]
36
+ @description = attributes[:description]
37
+ @galaxy_id = attributes[:galaxy_id]
38
+ @source = attributes[:source]
39
+ @authors = attributes[:authors]
40
+ @tag_id = attributes[:tag_id]
41
+ @meta = attributes[:meta]
31
42
  end
32
43
 
44
+ #
45
+ # Returns a hash representation of the attribute data.
46
+ #
47
+ # @return [Hash]
48
+ #
33
49
  def to_h
34
50
  {
35
51
  id: id,
data/lib/misp/org.rb CHANGED
@@ -2,18 +2,26 @@
2
2
 
3
3
  module MISP
4
4
  class Org < Base
5
+ # @return [String]
5
6
  attr_reader :id
7
+ # @return [String]
6
8
  attr_reader :name
9
+ # @return [String]
7
10
  attr_reader :uuid
8
11
 
9
12
  def initialize(**attributes)
10
- attributes = normalize_attributes(attributes)
13
+ attributes = normalize_attributes(**attributes)
11
14
 
12
- @id = attributes.dig(:id)
13
- @name = attributes.dig(:name)
14
- @uuid = attributes.dig(:uuid)
15
+ @id = attributes[:id]
16
+ @name = attributes[:name]
17
+ @uuid = attributes[:uuid]
15
18
  end
16
19
 
20
+ #
21
+ # Returns a hash representation of the attribute data.
22
+ #
23
+ # @return [Hash]
24
+ #
17
25
  def to_h
18
26
  {
19
27
  id: id,
data/lib/misp/orgc.rb CHANGED
@@ -2,18 +2,26 @@
2
2
 
3
3
  module MISP
4
4
  class Orgc < Base
5
+ # @return [String]
5
6
  attr_reader :id
7
+ # @return [String]
6
8
  attr_reader :name
9
+ # @return [String]
7
10
  attr_reader :uuid
8
11
 
9
12
  def initialize(**attributes)
10
- attributes = normalize_attributes(attributes)
13
+ attributes = normalize_attributes(**attributes)
11
14
 
12
- @id = attributes.dig(:id)
13
- @name = attributes.dig(:name)
14
- @uuid = attributes.dig(:uuid)
15
+ @id = attributes[:id]
16
+ @name = attributes[:name]
17
+ @uuid = attributes[:uuid]
15
18
  end
16
19
 
20
+ #
21
+ # Returns a hash representation of the attribute data.
22
+ #
23
+ # @return [Hash]
24
+ #
17
25
  def to_h
18
26
  {
19
27
  id: id,