misp 0.1.0 → 0.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
data/lib/misp/event.rb CHANGED
@@ -2,68 +2,99 @@
2
2
 
3
3
  module MISP
4
4
  class Event < Base
5
+ # @return [String]
5
6
  attr_reader :id
7
+ # @return [String]
6
8
  attr_accessor :orgc_id
9
+ # @return [String]
7
10
  attr_accessor :org_id
11
+ # @return [String]
8
12
  attr_accessor :date
13
+ # @return [String]
9
14
  attr_accessor :threat_level_id
15
+ # @return [String]
10
16
  attr_accessor :info
17
+ # @return [Boolean]
11
18
  attr_accessor :published
19
+ # @return [String]
12
20
  attr_reader :uuid
21
+ # @return [String]
13
22
  attr_accessor :attribute_count
23
+ # @return [String]
14
24
  attr_accessor :analysis
25
+ # @return [String]
15
26
  attr_accessor :timestamp
27
+ # @return [String]
16
28
  attr_accessor :distribution
29
+ # @return [Boolean]
17
30
  attr_accessor :proposal_email_lock
31
+ # @return [Boolean]
18
32
  attr_accessor :locked
33
+ # @return [String]
19
34
  attr_accessor :publish_timestamp
35
+ # @return [String]
20
36
  attr_accessor :sharing_group_id
37
+ # @return [Boolean]
21
38
  attr_accessor :disable_correlation
39
+ # @return [String]
22
40
  attr_accessor :event_creator_email
23
41
 
42
+ # @return [MISP::Org, nil]
24
43
  attr_accessor :org
44
+ # @return [MISP::Orgc, nil]
25
45
  attr_accessor :orgc
26
46
 
47
+ # @return [Array<MISP::SharingGroup>]
27
48
  attr_accessor :sharing_groups
49
+ # @return [Array<MISP::Attribute>]
28
50
  attr_accessor :attributes
51
+ # @return [Array<MISP::Attribute>]
29
52
  attr_accessor :shadow_attributes
53
+ # @return [Array<MISP::Event>]
30
54
  attr_accessor :related_events
55
+ # @return [Array<<MISP::Galaxy>]
31
56
  attr_accessor :galaxies
57
+ # @return [Array<<MISP::Tag>]
32
58
  attr_accessor :tags
33
59
 
34
60
  def initialize(**attrs)
35
- attrs = normalize_attributes(attrs)
36
-
37
- @id = attrs.dig(:id)
38
- @orgc_id = attrs.dig(:orgc_id)
39
- @org_id = attrs.dig(:org_id)
40
- @date = attrs.dig(:date)
41
- @threat_level_id = attrs.dig(:threat_level_id)
42
- @info = attrs.dig(:info)
43
- @published = attrs.dig(:published) || false
44
- @uuid = attrs.dig(:uuid)
45
- @attribute_count = attrs.dig(:attribute_count)
46
- @analysis = attrs.dig(:analysis)
47
- @timestamp = attrs.dig(:timestamp)
48
- @distribution = attrs.dig(:distribution)
49
- @proposal_email_lock = attrs.dig(:proposal_email_lock)
50
- @locked = attrs.dig(:locked) || false
51
- @publish_timestamp = attrs.dig(:publish_timestamp)
52
- @sharing_group_id = attrs.dig(:sharing_group_id)
53
- @disable_correlation = attrs.dig(:disable_correlation)
54
- @event_creator_email = attrs.dig(:event_creator_email)
55
-
56
- @org = build_attribute(item: attrs.dig(:Org), klass: Org)
57
- @orgc = build_attribute(item: attrs.dig(:Orgc), klass: Orgc)
58
-
59
- @sharing_groups = build_plural_attribute(items: attrs.dig(:SharingGroup), klass: SharingGroup)
60
- @attributes = build_plural_attribute(items: attrs.dig(:Attribute), klass: Attribute)
61
- @shadow_attributes = build_plural_attribute(items: attrs.dig(:ShadowAttribute), klass: Attribute )
62
- @related_events = build_plural_attribute(items: attrs.dig(:RelatedEvent), klass: Attribute)
63
- @galaxies = build_plural_attribute(items: attrs.dig(:Galaxy), klass: Galaxy)
64
- @tags = build_plural_attribute(items: attrs.dig(:Tag), klass: Tag)
65
- end
66
-
61
+ attrs = normalize_attributes(**attrs)
62
+
63
+ @id = attrs[:id]
64
+ @orgc_id = attrs[:orgc_id]
65
+ @org_id = attrs[:org_id]
66
+ @date = attrs[:date]
67
+ @threat_level_id = attrs[:threat_level_id]
68
+ @info = attrs[:info]
69
+ @published = attrs[:published] || false
70
+ @uuid = attrs[:uuid]
71
+ @attribute_count = attrs[:attribute_count]
72
+ @analysis = attrs[:analysis]
73
+ @timestamp = attrs[:timestamp]
74
+ @distribution = attrs[:distribution]
75
+ @proposal_email_lock = attrs[:proposal_email_lock]
76
+ @locked = attrs[:locked] || false
77
+ @publish_timestamp = attrs[:publish_timestamp]
78
+ @sharing_group_id = attrs[:sharing_group_id]
79
+ @disable_correlation = attrs[:disable_correlation]
80
+ @event_creator_email = attrs[:event_creator_email]
81
+
82
+ @org = build_attribute(item: attrs[:Org], klass: Org)
83
+ @orgc = build_attribute(item: attrs[:Orgc], klass: Orgc)
84
+
85
+ @sharing_groups = build_plural_attribute(items: attrs[:SharingGroup], klass: SharingGroup)
86
+ @attributes = build_plural_attribute(items: attrs[:Attribute], klass: Attribute)
87
+ @shadow_attributes = build_plural_attribute(items: attrs[:ShadowAttribute], klass: Attribute )
88
+ @related_events = build_plural_attribute(items: attrs[:RelatedEvent], klass: Attribute)
89
+ @galaxies = build_plural_attribute(items: attrs[:Galaxy], klass: Galaxy)
90
+ @tags = build_plural_attribute(items: attrs[:Tag], klass: Tag)
91
+ end
92
+
93
+ #
94
+ # Returns a hash representation of the attribute data.
95
+ #
96
+ # @return [Hash]
97
+ #
67
98
  def to_h
68
99
  compact(
69
100
  id: id,
@@ -95,53 +126,65 @@ module MISP
95
126
  )
96
127
  end
97
128
 
129
+ #
130
+ # Get an event
131
+ #
132
+ # @return [MISP::Event]
133
+ #
98
134
  def get(id)
99
- _get("/events/#{id}") { |event| Event.new symbolize_keys(event) }
100
- end
101
-
102
- def self.get(id)
103
- new.get id
135
+ _get("/events/#{id}") { |event| Event.new(**event) }
104
136
  end
105
137
 
138
+ #
139
+ # Create an event
140
+ #
141
+ # @param [Hash] **attrs attributes
142
+ #
143
+ # @return [MISP::Event]
144
+ #
106
145
  def create(**attrs)
107
146
  payload = to_h.merge(attrs)
108
- _post("/events/add", wrap(payload)) { |event| Event.new symbolize_keys(event) }
109
- end
110
-
111
- def self.create(**attrs)
112
- new.create attrs
147
+ _post("/events/add", wrap(payload)) { |event| Event.new(**event) }
113
148
  end
114
149
 
150
+ #
151
+ # Delete an event
152
+ #
153
+ # @return [Hash]
154
+ #
115
155
  def delete
116
156
  _delete("/events/#{id}") { |json| json }
117
157
  end
118
158
 
119
- def self.delete(id)
120
- new(id: id).delete
121
- end
122
-
159
+ #
160
+ # List events
161
+ #
162
+ # @return [Array<MISP::Event>]
163
+ #
123
164
  def list
124
165
  _get("/events/index") do |events|
125
166
  events.map do |event|
126
- Event.new symbolize_keys(event)
167
+ Event.new(**event)
127
168
  end
128
169
  end
129
170
  end
130
171
 
131
- def self.list
132
- new.list
133
- end
134
-
172
+ #
173
+ # Update an event
174
+ #
175
+ # @return [MISP::Event]
176
+ #
135
177
  def update(**attrs)
136
- payload = to_h.merge(attrs)
178
+ payload = to_h.merge(**attrs)
137
179
  payload[:timestamp] = nil
138
- _post("/events/#{id}", wrap(payload)) { |event| Event.new symbolize_keys(event) }
139
- end
140
-
141
- def self.update(id, **attrs)
142
- new(id: id).update attrs
180
+ _post("/events/#{id}", wrap(payload)) { |event| Event.new(**event) }
143
181
  end
144
182
 
183
+ #
184
+ # Search for events
185
+ #
186
+ # @return [Array<MISP::Event>]
187
+ #
145
188
  def search(**params)
146
189
  base = {
147
190
  returnFormat: "json",
@@ -150,27 +193,59 @@ module MISP
150
193
  }
151
194
 
152
195
  _post("/events/restSearch", base.merge(params)) do |json|
153
- events = json.dig("response") || []
154
- events.map { |event| Event.new symbolize_keys(event) }
196
+ events = json[:response] || []
197
+ events.map { |event| Event.new(**event) }
155
198
  end
156
199
  end
157
200
 
158
- def self.search(**params)
159
- new.search params
160
- end
161
-
201
+ #
202
+ # Add an attribute to an event. Requires an update or create call afterwards.
203
+ #
204
+ # @return [MISP::Event]
205
+ #
162
206
  def add_attribute(attribute)
163
- attribute = Attribute.new(symbolize_keys(attribute)) unless attribute.is_a?(Attribute)
207
+ attribute = Attribute.new(**attribute) unless attribute.is_a?(Attribute)
164
208
  attributes << attribute
165
209
  self
166
210
  end
167
211
 
212
+ #
213
+ # Add a tag to an event. Requires an update or create call afterwards.
214
+ #
215
+ # @return [MISP::Event]
216
+ #
168
217
  def add_tag(tag)
169
- tag = Tag.new(symbolize_keys(tag)) unless tag.is_a?(MISP::Tag)
218
+ tag = Tag.new(**tag) unless tag.is_a?(MISP::Tag)
170
219
  tags << tag
171
220
  self
172
221
  end
173
222
 
223
+ class << self
224
+ def get(id)
225
+ new.get id
226
+ end
227
+
228
+ def create(**attrs)
229
+ new.create(**attrs)
230
+ end
231
+
232
+ def delete(id)
233
+ new(id: id).delete
234
+ end
235
+
236
+ def list
237
+ new.list
238
+ end
239
+
240
+ def update(id, **attrs)
241
+ new(id: id).update(**attrs)
242
+ end
243
+
244
+ def search(**params)
245
+ new.search(**params)
246
+ end
247
+ end
248
+
174
249
  private
175
250
 
176
251
  def compact(hash)
data/lib/misp/feed.rb CHANGED
@@ -2,56 +2,83 @@
2
2
 
3
3
  module MISP
4
4
  class Feed < Base
5
+ # @return [String]
5
6
  attr_reader :id
7
+ # @return [String]
6
8
  attr_reader :name
9
+ # @return [String]
7
10
  attr_reader :provider
11
+ # @return [String]
8
12
  attr_reader :url
13
+ # @return [String]
9
14
  attr_reader :rules
15
+ # @return [Boolean]
10
16
  attr_reader :enabled
17
+ # @return [String]
11
18
  attr_reader :distribution
19
+ # @return [String]
12
20
  attr_reader :sharing_group_id
21
+ # @return [String]
13
22
  attr_reader :tag_id
23
+ # @return [String]
14
24
  attr_reader :default
25
+ # @return [String]
15
26
  attr_reader :source_format
27
+ # @return [Boolean]
16
28
  attr_reader :fixed_event
29
+ # @return [Boolean]
17
30
  attr_reader :delta_merge
31
+ # @return [String]
18
32
  attr_reader :event_id
33
+ # @return [String]
19
34
  attr_reader :publish
35
+ # @return [String]
20
36
  attr_reader :override_ids
37
+ # @return [String]
21
38
  attr_reader :settings
39
+ # @return [String]
22
40
  attr_reader :input_source
41
+ # @return [Boolean]
23
42
  attr_reader :delete_local_file
43
+ # @return [Boolean]
24
44
  attr_reader :lookup_visible
45
+ # @return [String]
25
46
  attr_reader :headers
47
+ # @return [Boolean]
26
48
  attr_reader :caching_enabled
27
49
 
28
50
  def initialize(**attributes)
29
- attributes = normalize_attributes(attributes)
51
+ attributes = normalize_attributes(**attributes)
30
52
 
31
- @id = attributes.dig(:id)
32
- @name = attributes.dig(:name) || "feed name"
33
- @provider = attributes.dig(:provider) || "my provider"
34
- @url = attributes.dig(:url) || "http://example.com"
35
- @rules = attributes.dig(:rules) || ""
36
- @enabled = attributes.dig(:enabled)
37
- @distribution = attributes.dig(:distribution)
38
- @sharing_group_id = attributes.dig(:sharing_group_id)
39
- @tag_id = attributes.dig(:tag_id) || "0"
40
- @default = attributes.dig(:default) || true
41
- @source_format = attributes.dig(:source_format) || "misp"
42
- @fixed_event = attributes.dig(:fixed_event) || true
43
- @delta_merge = attributes.dig(:delta_merge) || false
44
- @event_id = attributes.dig(:event_id) || "0"
45
- @publish = attributes.dig(:publish) || true
46
- @override_ids = attributes.dig(:override_ids) || false
47
- @settings = attributes.dig(:settings) || ""
48
- @input_source = attributes.dig(:input_source) || "network"
49
- @delete_local_file = attributes.dig(:delete_local_file) || false
50
- @lookup_visible = attributes.dig(:lookup_visible) || true
51
- @headers = attributes.dig(:headers) || ""
52
- @caching_enabled = attributes.dig(:caching_enabled) || true
53
+ @id = attributes[:id]
54
+ @name = attributes[:name] || "feed name"
55
+ @provider = attributes[:provider] || "my provider"
56
+ @url = attributes[:url] || "http://example.com"
57
+ @rules = attributes[:rules] || ""
58
+ @enabled = attributes[:enabled]
59
+ @distribution = attributes[:distribution]
60
+ @sharing_group_id = attributes[:sharing_group_id]
61
+ @tag_id = attributes[:tag_id] || "0"
62
+ @default = attributes[:default] || true
63
+ @source_format = attributes[:source_format] || "misp"
64
+ @fixed_event = attributes[:fixed_event] || true
65
+ @delta_merge = attributes[:delta_merge] || false
66
+ @event_id = attributes[:event_id] || "0"
67
+ @publish = attributes[:publish] || true
68
+ @override_ids = attributes[:override_ids] || false
69
+ @settings = attributes[:settings] || ""
70
+ @input_source = attributes[:input_source] || "network"
71
+ @delete_local_file = attributes[:delete_local_file] || false
72
+ @lookup_visible = attributes[:lookup_visible] || true
73
+ @headers = attributes[:headers] || ""
74
+ @caching_enabled = attributes[:caching_enabled] || true
53
75
  end
54
76
 
77
+ #
78
+ # Returns a hash representation of the attribute data.
79
+ #
80
+ # @return [Hash]
81
+ #
55
82
  def to_h
56
83
  {
57
84
  id: id,
@@ -79,32 +106,51 @@ module MISP
79
106
  }.compact
80
107
  end
81
108
 
109
+ #
110
+ # List feeds
111
+ #
112
+ # @return [Array<MISP::Feed>]
113
+ #
82
114
  def list
83
115
  _get("/feeds/index") do |feeds|
84
116
  feeds.map do |feed|
85
- Feed.new symbolize_keys(feed)
117
+ Feed.new(**feed)
86
118
  end
87
119
  end
88
120
  end
89
121
 
90
- def self.list
91
- new.list
92
- end
93
-
122
+ #
123
+ # Create a feed
124
+ #
125
+ # @return [MISP::Feed]
126
+ #
94
127
  def get
95
- _get("/feeds/view/#{id}") { |feed| Feed.new symbolize_keys(feed) }
96
- end
97
-
98
- def self.get(id)
99
- new(id: id).get
128
+ _get("/feeds/view/#{id}") { |feed| Feed.new feed }
100
129
  end
101
130
 
131
+ #
132
+ # Create a feed
133
+ #
134
+ # @param [Hash] **attributes attributes
135
+ #
136
+ # @return [MIPS::Feed]
137
+ #
102
138
  def create(**attributes)
103
- _post("/feeds/add", wrap(attributes)) { |feed| Feed.new symbolize_keys(feed) }
139
+ _post("/feeds/add", wrap(attributes)) { |feed| Feed.new feed }
104
140
  end
105
141
 
106
- def self.create(attributes)
107
- new.create attributes
142
+ class << self
143
+ def list
144
+ new.list
145
+ end
146
+
147
+ def get(id)
148
+ new(id: id).get
149
+ end
150
+
151
+ def create(**attributes)
152
+ new.create attributes
153
+ end
108
154
  end
109
155
  end
110
156
  end
data/lib/misp/galaxy.rb CHANGED
@@ -2,28 +2,40 @@
2
2
 
3
3
  module MISP
4
4
  class Galaxy < Base
5
+ # @return [String]
5
6
  attr_reader :id
7
+ # @return [String]
6
8
  attr_reader :uuid
9
+ # @return [String]
7
10
  attr_reader :name
11
+ # @return [String]
8
12
  attr_reader :type
13
+ # @return [String]
9
14
  attr_reader :description
15
+ # @return [String]
10
16
  attr_reader :version
11
17
 
18
+ # @return [Array<MISP::GalaxyCluster>]
12
19
  attr_reader :galaxy_clusters
13
20
 
14
21
  def initialize(**attributes)
15
- attributes = normalize_attributes(attributes)
22
+ attributes = normalize_attributes(**attributes)
16
23
 
17
- @id = attributes.dig(:id)
18
- @uuid = attributes.dig(:uuid)
19
- @name = attributes.dig(:name)
20
- @type = attributes.dig(:type)
21
- @description = attributes.dig(:description)
22
- @version = attributes.dig(:version)
24
+ @id = attributes[:id]
25
+ @uuid = attributes[:uuid]
26
+ @name = attributes[:name]
27
+ @type = attributes[:type]
28
+ @description = attributes[:description]
29
+ @version = attributes[:version]
23
30
 
24
- @galaxy_clusters = build_plural_attribute(items: attributes.dig(:GalaxyCluster), klass: GalaxyCluster)
31
+ @galaxy_clusters = build_plural_attribute(items: attributes[:GalaxyCluster], klass: GalaxyCluster)
25
32
  end
26
33
 
34
+ #
35
+ # Returns a hash representation of the attribute data.
36
+ #
37
+ # @return [Hash]
38
+ #
27
39
  def to_h
28
40
  {
29
41
  id: id,
@@ -36,24 +48,36 @@ module MISP
36
48
  }.compact
37
49
  end
38
50
 
51
+ #
52
+ # List galaxies
53
+ #
54
+ # @return [Array<Galaxy>]
55
+ #
39
56
  def list
40
57
  _get("/galaxies/") do |galaxies|
41
58
  galaxies.map do |galaxy|
42
- Galaxy.new symbolize_keys(galaxy)
59
+ Galaxy.new(**galaxy)
43
60
  end
44
61
  end
45
62
  end
46
63
 
47
- def self.list
48
- new.list
49
- end
50
-
64
+ #
65
+ # Get a galaxy
66
+ #
67
+ # @return [MISP::Galaxy]
68
+ #
51
69
  def get
52
- _get("/galaxies/view/#{id}") { |galaxy| Galaxy.new symbolize_keys(galaxy) }
70
+ _get("/galaxies/view/#{id}") { |galaxy| Galaxy.new(**galaxy) }
53
71
  end
54
72
 
55
- def self.get(id)
56
- new(id: id).get
73
+ class << self
74
+ def list
75
+ new.list
76
+ end
77
+
78
+ def get(id)
79
+ new(id: id).get
80
+ end
57
81
  end
58
82
  end
59
83
  end
@@ -2,34 +2,50 @@
2
2
 
3
3
  module MISP
4
4
  class GalaxyCluster < Base
5
+ # @return [String]
5
6
  attr_reader :id
7
+ # @return [String]
6
8
  attr_reader :uuid
9
+ # @return [String]
7
10
  attr_reader :type
11
+ # @return [String]
8
12
  attr_reader :value
13
+ # @return [String]
9
14
  attr_reader :tag_name
15
+ # @return [String]
10
16
  attr_reader :description
17
+ # @return [String]
11
18
  attr_reader :galaxy_id
19
+ # @return [String]
12
20
  attr_reader :source
21
+ # @return [Array<String>]
13
22
  attr_reader :authors
23
+ # @return [String]
14
24
  attr_reader :tag_id
25
+ # @return [Hash]
15
26
  attr_reader :meta
16
27
 
17
28
  def initialize(**attributes)
18
- attributes = normalize_attributes(attributes)
29
+ attributes = normalize_attributes(**attributes)
19
30
 
20
- @id = attributes.dig(:id)
21
- @uuid = attributes.dig(:uuid)
22
- @type = attributes.dig(:type)
23
- @value = attributes.dig(:value)
24
- @tag_name = attributes.dig(:tag_name)
25
- @description = attributes.dig(:description)
26
- @galaxy_id = attributes.dig(:galaxy_id)
27
- @source = attributes.dig(:source)
28
- @authors = attributes.dig(:authors)
29
- @tag_id = attributes.dig(:tag_id)
30
- @meta = attributes.dig(:meta)
31
+ @id = attributes[:id]
32
+ @uuid = attributes[:uuid]
33
+ @type = attributes[:type]
34
+ @value = attributes[:value]
35
+ @tag_name = attributes[:tag_name]
36
+ @description = attributes[:description]
37
+ @galaxy_id = attributes[:galaxy_id]
38
+ @source = attributes[:source]
39
+ @authors = attributes[:authors]
40
+ @tag_id = attributes[:tag_id]
41
+ @meta = attributes[:meta]
31
42
  end
32
43
 
44
+ #
45
+ # Returns a hash representation of the attribute data.
46
+ #
47
+ # @return [Hash]
48
+ #
33
49
  def to_h
34
50
  {
35
51
  id: id,
data/lib/misp/org.rb CHANGED
@@ -2,18 +2,26 @@
2
2
 
3
3
  module MISP
4
4
  class Org < Base
5
+ # @return [String]
5
6
  attr_reader :id
7
+ # @return [String]
6
8
  attr_reader :name
9
+ # @return [String]
7
10
  attr_reader :uuid
8
11
 
9
12
  def initialize(**attributes)
10
- attributes = normalize_attributes(attributes)
13
+ attributes = normalize_attributes(**attributes)
11
14
 
12
- @id = attributes.dig(:id)
13
- @name = attributes.dig(:name)
14
- @uuid = attributes.dig(:uuid)
15
+ @id = attributes[:id]
16
+ @name = attributes[:name]
17
+ @uuid = attributes[:uuid]
15
18
  end
16
19
 
20
+ #
21
+ # Returns a hash representation of the attribute data.
22
+ #
23
+ # @return [Hash]
24
+ #
17
25
  def to_h
18
26
  {
19
27
  id: id,
data/lib/misp/orgc.rb CHANGED
@@ -2,18 +2,26 @@
2
2
 
3
3
  module MISP
4
4
  class Orgc < Base
5
+ # @return [String]
5
6
  attr_reader :id
7
+ # @return [String]
6
8
  attr_reader :name
9
+ # @return [String]
7
10
  attr_reader :uuid
8
11
 
9
12
  def initialize(**attributes)
10
- attributes = normalize_attributes(attributes)
13
+ attributes = normalize_attributes(**attributes)
11
14
 
12
- @id = attributes.dig(:id)
13
- @name = attributes.dig(:name)
14
- @uuid = attributes.dig(:uuid)
15
+ @id = attributes[:id]
16
+ @name = attributes[:name]
17
+ @uuid = attributes[:uuid]
15
18
  end
16
19
 
20
+ #
21
+ # Returns a hash representation of the attribute data.
22
+ #
23
+ # @return [Hash]
24
+ #
17
25
  def to_h
18
26
  {
19
27
  id: id,