ruby-deepviz 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: e6999d5f4123bd1008e08680b767d07182a366bc
+  data.tar.gz: c1789782ba04e29cff292cbcf62b7829334ffd14
+SHA512:
+  metadata.gz: b270f7c5adf1a4d60ee6b16b9ada00d2fb108b6528142610a136ffa3e28fe24cbee0f04b86e5d655325f81113be2553850379f51f09924f12e83ec44fbfd10a8
+  data.tar.gz: 2e68c2ebf0d5dd8be2ba88047103b65d244c4aaa50348d3f98f12263ee278bd1b9dbeeda848e0970e9189d846422acd8490a5c0eaf1b1970229fcf6ba53e9bb3

data/lib/deepviz/intel.rb

@@ -0,0 +1,274 @@
+require 'deepviz/result'
+
+class Intel
+
+  URL_INTEL_SEARCH            = 'https://api.deepviz.com/intel/search'
+  URL_INTEL_IP                = 'https://api.deepviz.com/intel/network/ip'
+  URL_INTEL_DOMAIN            = 'https://api.deepviz.com/intel/network/domain'
+  URL_INTEL_SEARCH_ADVANCED   = 'https://api.deepviz.com/intel/search/advanced'
+
+  def ip_info(api_key, options={})
+    if api_key == nil or api_key == ''
+      return Result.new(status=INPUT_ERROR, msg='API key cannot be null or empty String')
+    end
+
+    defaults = {
+        :ip => nil,
+        :history => false,
+        :time_delta => nil,
+    }
+
+    options = defaults.merge(options)
+
+    if (!options['ip'].kind_of?(Array) and (options['time_delta'] == nil or options['time_delta'] == '')) or (options['ip'].kind_of?(Array) and options['time_delta'] != nil and options['time_delta'] != '')
+      msg = 'Parameters missing or invalid. You must specify either a list of IPs or time delta'
+      return Result.new(status=INPUT_ERROR, msg=msg)
+    end
+
+    if options['history']
+      _history = 'true'
+    else
+      _history = 'false'
+    end
+
+    if options['ip'] != nil and !options['ip'].kind_of?(Array)
+      msg = 'You must provide one or more IPs in a list'
+      return Result.new(status=INPUT_ERROR, msg=msg)
+    else
+      body = {
+        :ip => options['ip'],
+        :history => _history,
+        :api_key => api_key,
+      }
+    end
+
+    if options['time_delta'] != nil and options['time_delta'] != ''
+      body = {
+          :time_delta => options['time_delta'],
+          :history => _history,
+          :api_key => api_key,
+      }
+    end
+
+    return do_post(body, URL_INTEL_IP)
+  end
+
+  def domain_info(api_key, options={})
+    if api_key == nil or api_key == ''
+      return Result.new(status=INPUT_ERROR, msg='API key cannot be null or empty String')
+    end
+
+    defaults = {
+        :domain => nil,
+        :filters => nil,
+        :history => false,
+        :time_delta => nil,
+    }
+
+    options = defaults.merge(options)
+
+    if (!options['domain'].kind_of?(Array) and (options['time_delta'] == nil or options['time_delta'] == '')) or (options['domain'].kind_of?(Array) and options['time_delta'] != nil and options['time_delta'] != '')
+      msg = 'Parameters missing or invalid. You must specify either a list of domains or time delta'
+      return Result.new(status=INPUT_ERROR, msg=msg)
+    end
+
+    if options['history']
+      _history = 'true'
+    else
+      _history = 'false'
+    end
+
+    if options['filters'] != nil and !options['filters'].kind_of?(Array)
+      msg = 'You must provide one or more output filters in a list'
+      return Result.new(status=INPUT_ERROR, msg=msg)
+    end
+
+    body = {}
+
+    if options['domain'].kind_of?(Array)
+      if options['filters'] != nil
+        body = {
+          :output_filters => options['filters'],
+          :domain => options['domain'],
+          :history => _history,
+          :api_key => api_key,
+        }
+      else
+        body = {
+          :domain => options['domain'],
+          :history => _history,
+          :api_key => api_key,
+        }
+      end
+    end
+
+    if options['time_delta'] != nil and options['time_delta'] != ''
+      if options['filters'] != nil
+        body = {
+          :time_delta => options['time_delta'],
+          :output_filters => options['filters'],
+          :history => _history,
+          :api_key => api_key,
+        }
+      else
+        body = {
+          :time_delta => options['time_delta'],
+          :history => _history,
+          :api_key => api_key,
+        }
+      end
+    end
+
+    return do_post(body, URL_INTEL_DOMAIN)
+  end
+
+  def search(api_key, search_string, options={})
+    if api_key == nil or api_key == ''
+      return Result.new(status=INPUT_ERROR, msg='API key cannot be null or empty String')
+    end
+
+    if search_string == nil or search_string == ''
+      return Result.new(status=INPUT_ERROR, msg='String to be searched cannot be null or empty')
+    end
+
+    defaults = {
+        :start_offset => nil,
+        :elements => nil,
+    }
+
+    options = defaults.merge(options)
+
+    if options['start_offset'] != nil and options['elements'] != nil and options['start_offset'].is_a? Integer and !options['elements'].is_a? Integer
+      result_set = ['start=%d' % options['start_offset'], 'rows=%d' % options['elements']]
+
+      body = {
+        :'result_set' => result_set,
+        :'string' => search_string,
+        :'api_key' => api_key,
+      }
+    else
+      body = {
+          :'string' => search_string,
+          :'api_key' => api_key,
+      }
+    end
+
+    return do_post(body, URL_INTEL_SEARCH)
+  end
+
+  def advanced_search(api_key, options={})
+    if api_key == nil or api_key == ''
+      return Result.new(status=INPUT_ERROR, msg='API key cannot be null or empty String')
+    end
+
+    defaults = {
+        :classification => nil,
+        :created_files => nil,
+        :never_seen => false,
+        :time_delta => nil,
+        :result_set => nil,
+        :sim_hash => nil,
+        :imp_hash => nil,
+        :ip_range => nil,
+        :strings => nil,
+        :country => nil,
+        :domain => nil,
+        :rules => nil,
+        :asn => nil,
+        :url => nil,
+        :ip => nil,
+    }
+
+    options = defaults.merge(options)
+
+    body = {
+        :api_key => api_key
+    }
+
+    if options['created_files'].kind_of?(Array)
+      body[:created_files] = options['created_files']
+    end
+
+    _never_seen = 'false'
+    if options[:never_seen] != nil and options[:never_seen]
+      _never_seen = 'true'
+    end
+    body[:never_seen] = _never_seen
+
+    if options['result_set'].kind_of?(Array)
+      body[:result_set] = options['result_set']
+    end
+
+    if options['sim_hash'].kind_of?(Array)
+      body[:sim_hash] = options['sim_hash']
+    end
+
+    if options['imp_hash'].kind_of?(Array)
+      body[:imp_hash] = options['imp_hash']
+    end
+
+    if options['strings'].kind_of?(Array)
+      body[:strings] = options['strings']
+    end
+
+    if options['country'].kind_of?(Array)
+      body[:country] = options['country']
+    end
+
+    if options['classification'] != nil
+      body[:classification] =  options['classification']
+    end
+
+    if options['domain'].kind_of?(Array)
+      body[:domain] = options['domain']
+    end
+
+    if options['rules'].kind_of?(Array)
+      body[:rules] = options['rules']
+    end
+
+    if options['time_delta'] != nil
+      body[:time_delta] =  options['time_delta']
+    end
+
+    if options['asn'].kind_of?(Array)
+      body[:asn] = options['asn']
+    end
+
+    if options['url'].kind_of?(Array)
+      body[:url] = options['url']
+    end
+
+    if options['ip'].kind_of?(Array)
+      body[:ip] = options['ip']
+    end
+
+    if options['ip_range'] != nil
+      body[:ip_range] =  options['ip_range']
+    end
+
+    return do_post(body, URL_INTEL_SEARCH_ADVANCED)
+  end
+
+  def do_post(body, api_uri)
+    begin
+      response = Unirest.post(api_uri,
+                              headers:{ 'Content-Type' => 'application/json' },
+                              parameters:body.to_json)
+    rescue Exception
+      return Result.new(status=NETWORK_ERROR, msg='%s - Error while connecting to Deepviz: %s' % [response.code, response.body['errmsg']])
+    end
+
+    if response.code == 200
+      return Result.new(status=SUCCESS, msg=response.body['data'])
+    else
+      if response.code >= 500
+        return Result.new(status=SERVER_ERROR, msg='%s - Error while connecting to Deepviz: %s' % [response.code, response.body['errmsg']])
+      else
+        return Result.new(status=CLIENT_ERROR, msg='%s - Error while connecting to Deepviz: %s' % [response.code, response.body['errmsg']])
+      end
+    end
+  end
+
+  private :do_post
+end

data/lib/deepviz/result.rb

@@ -0,0 +1,27 @@
+SUCCESS = 'DEEPVIZ_STATUS_SUCCESS'                  # Request successfully submitted
+PROCESSING = 'DEEPVIZ_STATUS_PROCESSING'
+INPUT_ERROR = 'DEEPVIZ_STATUS_INPUT_ERROR'
+SERVER_ERROR = 'DEEPVIZ_STATUS_SERVER_ERROR'        # Http 5xx
+CLIENT_ERROR = 'DEEPVIZ_STATUS_CLIENT_ERROR'        # Http 4xx
+NETWORK_ERROR = 'DEEPVIZ_STATUS_NETWORK_ERROR'      # Cannot contact Deepviz
+INTERNAL_ERROR = 'DEEPVIZ_STATUS_INTERNAL_ERROR'
+
+
+class Result
+  attr_reader :status
+  attr_writer :status
+  attr_reader :msg
+  attr_writer :msg
+
+  @status = nil
+  @msg = nil
+
+  def initialize(status, msg)
+    @status = status
+    @msg = msg
+  end
+
+  def to_s
+    'Result(status=%s, msg=%s)' % [@status, @msg]
+  end
+end

data/lib/deepviz/sandbox.rb

@@ -0,0 +1,250 @@
+require 'json'
+require 'unirest'
+require 'deepviz/result'
+
+
+class Sandbox
+
+  URL_UPLOAD_SAMPLE   = 'https://api.deepviz.com/sandbox/submit'
+  URL_DOWNLOAD_REPORT = 'https://api.deepviz.com/general/report'
+  URL_DOWNLOAD_SAMPLE = 'https://api.deepviz.com/sandbox/sample'
+  URL_DOWNLOAD_BULK   = 'https://api.deepviz.com/sandbox/sample/bulk/retrieve'
+  URL_REQUEST_BULK    = 'https://api.deepviz.com/sandbox/sample/bulk/request'
+
+
+  def upload_sample(api_key, path)
+    if api_key == nil or api_key == ''
+      return Result.new(status=INPUT_ERROR, msg='API key cannot be null or empty String')
+    end
+
+    if path == nil or path == ''
+      return Result.new(status=INPUT_ERROR, msg='File path cannot be null or empty String')
+    else
+      if !File.exist?(path)
+        return Result.new(status=INPUT_ERROR, msg='File does not exists')
+      else
+        if File.directory?(path)
+          return Result.new(status=INPUT_ERROR, msg='Path is a directory instead of a file')
+        else
+          if !File.readable?(path)
+            return Result.new(status=INPUT_ERROR, msg='Cannot open file "%s"' % File.absolute_path(path))
+          end
+        end
+      end
+    end
+
+    begin
+      response = Unirest.post(URL_UPLOAD_SAMPLE,
+                              headers:{ 'Content-Type' => 'application/json' },
+                              parameters:{ :api_key => api_key, :source => 'ruby_deepviz', :file => File.new(path, 'rb') })
+    rescue Exception
+      return Result.new(status=NETWORK_ERROR, msg='%s - Error while connecting to Deepviz: %s' % [response.code, body['errmsg']])
+    end
+
+    if response.code == 200
+      return Result.new(status=SUCCESS, msg=response.body['data'])
+    else
+      if response.code >= 500
+        return Result.new(status=SERVER_ERROR, msg='%s - Error while connecting to Deepviz: %s' % [response.code, response.body['errmsg']])
+      else
+        return Result.new(status=CLIENT_ERROR, msg='%s - Error while connecting to Deepviz: %s' % [response.code, response.body['errmsg']])
+      end
+    end
+  end
+
+
+  def upload_folder(api_key, path)
+    if api_key == nil or api_key == ''
+      return Result.new(status=INPUT_ERROR, msg='API key cannot be null or empty String')
+    end
+
+    if path == nil or path == ''
+      return Result.new(status=INPUT_ERROR, msg='Folder path cannot be null or empty String')
+    else
+      if !File.exist?(path)
+        return Result.new(status=INPUT_ERROR, msg='Directory does not exists')
+      else
+        if !File.directory?(path)
+          return Result.new(status=INPUT_ERROR, msg='Path is a file instead of a directory')
+        end
+      end
+    end
+
+    if Dir.entries(path).length <= 2
+      return Result.new(status=INPUT_ERROR, msg='Empty folder')
+    end
+
+    Dir.foreach(path) { |x|
+      if x != '.' and x != '..'
+        file_path = File.join(path, x)
+        result = upload_sample(api_key, file_path)
+        if result.status != SUCCESS
+          result.msg = '"Unable to upload file "%s"' % file_path
+          return result
+        end
+      end
+    }
+
+    return Result.new(status=SUCCESS, msg='Every file in folder has been uploaded')
+  end
+
+
+  def download_sample(api_key, md5, path)
+    if api_key == nil or api_key == ''
+      return Result.new(status=INPUT_ERROR, msg='API key cannot be null or empty String')
+    end
+
+    if md5 == nil or md5 == ''
+      return Result.new(status=INPUT_ERROR, msg='MD5 cannot be null or empty String')
+    end
+
+    if path == nil or path == ''
+      return Result.new(status=INPUT_ERROR, msg='Destination path cannot be null or empty String')
+    else
+      if File.exist?(path) and !File.directory?(path)
+        return Result.new(status=INPUT_ERROR, msg='Invalid destination folder')
+      end
+    end
+
+    body = {
+        :api_key => api_key,
+        :md5 => md5
+    }
+
+    begin
+      response = Unirest.post(URL_DOWNLOAD_SAMPLE,
+                              headers:{ 'Accept' => 'application/json' },
+                              parameters:body.to_json)
+    rescue Exception
+      return Result.new(status=NETWORK_ERROR, msg='%s - Error while connecting to Deepviz: %s' % [response.code, body['errmsg']])
+    end
+
+    if response.code == 200
+      dest_path = File.absolute_path(File.join(path, md5))
+      open(dest_path, 'wb') do |file|
+        file.write(response.body)
+      end
+
+      return Result.new(status=SUCCESS, msg='Sample downloaded to "%s"' % dest_path)
+    else
+      if response.code >= 500
+        return Result.new(status=SERVER_ERROR, msg='%s - Error while connecting to Deepviz: %s' % [response.code, response.body['errmsg']])
+      else
+        return Result.new(status=CLIENT_ERROR, msg='%s - Error while connecting to Deepviz: %s' % [response.code, response.body['errmsg']])
+      end
+    end
+  end
+
+
+  def sample_result(api_key, md5)
+    return sample_report(api_key, md5, ['classification'])
+  end
+
+
+  def sample_report(api_key, md5, filters=nil)
+    if api_key == nil or api_key == ''
+      return Result.new(status=INPUT_ERROR, msg='API key cannot be null or empty String')
+    end
+
+    if md5 == nil or md5 == ''
+      return Result.new(status=INPUT_ERROR, msg='MD5 cannot be null or empty String')
+    end
+
+    if filters != nil
+      body = {:api_key => api_key, :md5 => md5, :output_filters => filters}
+    else
+      body = {:api_key => api_key, :md5 => md5}
+    end
+
+    return do_post(body, URL_DOWNLOAD_REPORT)
+  end
+
+
+  def bulk_download_request(api_key, md5_list)
+    if api_key == nil or api_key == ''
+      return Result.new(status=INPUT_ERROR, msg='API key cannot be null or empty String')
+    end
+
+    if !md5_list.kind_of?(Array)
+      return Result.new(status=INPUT_ERROR, msg='MD5 list empty or invalid')
+    end
+
+    body = {
+        :api_key => api_key,
+        :hashes => md5_list
+    }
+
+    return do_post(body, URL_REQUEST_BULK)
+  end
+
+
+  def bulk_download_retrieve(api_key, id_request, path)
+    if api_key == nil or api_key == ''
+      return Result.new(status=INPUT_ERROR, msg='API key cannot be null or empty String')
+    end
+
+    if id_request == nil or id_request == ''
+      return Result.new(status=INPUT_ERROR, msg='Request ID cannot be null or empty String')
+    end
+
+    if path == nil or path == ''
+      return Result.new(status=INPUT_ERROR, msg='Destination path cannot be null or empty String')
+    else
+      if File.exist?(path) and !File.directory?(path)
+        return Result.new(status=INPUT_ERROR, msg='Invalid destination folder')
+      end
+    end
+
+    body = {
+        :api_key => api_key,
+        :id_request => id_request.to_s
+    }
+
+    begin
+      response = Unirest.post(URL_DOWNLOAD_BULK,
+                              headers: { 'Accept' => 'application/json' },
+                              parameters: body.to_json)
+    rescue Exception
+      return Result.new(status=NETWORK_ERROR, msg='%s - Error while connecting to Deepviz: %s' % [response.code, body['errmsg']])
+    end
+
+    if response.code == 200
+      dest_path = File.absolute_path(File.join(path, 'bulk_request_%s.zip' % id_request.to_s))
+      open(dest_path, 'wb') do |file|
+        file.write(response.body)
+      end
+
+      return Result.new(status=SUCCESS, msg='Archive downloaded to "%s"' % dest_path)
+    elsif response.code == 428
+        return Result.new(status=PROCESSING, msg='%s - Your request is being processed. Please try again in a few minutes' % response.code)
+    else
+      if response.code >= 500
+        return Result.new(status=SERVER_ERROR, msg='%s - Error while connecting to Deepviz: %s' % [response.code, response.body['errmsg']])
+      else
+        return Result.new(status=CLIENT_ERROR, msg='%s - Error while connecting to Deepviz: %s' % [response.code, response.body['errmsg']])
+      end
+    end
+  end
+
+  def do_post(body, api_uri)
+    begin
+      response = Unirest.post(api_uri,
+                              headers:{ 'Content-Type' => 'application/json' },
+                              parameters:body.to_json)
+    rescue Exception
+      return Result.new(status=NETWORK_ERROR, msg='%s - Error while connecting to Deepviz: %s' % [response.code, response.body['errmsg']])
+    end
+
+    if response.code == 200
+      return Result.new(status=SUCCESS, msg=response.body['data'])
+    else
+      if response.code >= 500
+        return Result.new(status=SERVER_ERROR, msg='%s - Error while connecting to Deepviz: %s' % [response.code, response.body['errmsg']])
+      else
+        return Result.new(status=CLIENT_ERROR, msg='%s - Error while connecting to Deepviz: %s' % [response.code, response.body['errmsg']])
+      end
+    end
+  end
+
+  private :do_post
+end

data/lib/deepviz/version.rb

@@ -0,0 +1,3 @@
+module Deepviz
+  VERSION = '1.0.0'
+end

metadata

@@ -0,0 +1,89 @@
+--- !ruby/object:Gem::Specification
+name: ruby-deepviz
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Saferbytes S.r.l.s.
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2016-02-16 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.12.a
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.12.a
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: unirest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.1.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.1.2
+description: 
+email: info@deepviz.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/deepviz/intel.rb
+- lib/deepviz/result.rb
+- lib/deepviz/sandbox.rb
+- lib/deepviz/version.rb
+homepage: https://www.deepviz.com
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.2.2
+signing_key: 
+specification_version: 4
+summary: ruby-deepviz is a Ruby wrapper for deepviz.com REST APIs
+test_files: []