shadowbq-threatinator 0.5.0

data/spec/feeds/nothink_ssh-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/nothink_ssh-ip_reputation.feed', :feed do
+  let(:provider) { 'nothink' }
+  let(:name) { 'ssh_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.nothink.org/blacklist/blacklist_ssh_day.txt'
+
+  describe_parsing_the_file feed_data('nothink_ssh_iplist.txt') do
+    it "should have parsed 7 records" do
+      expect(num_records_parsed).to eq(7)
+    end
+    it "should have filtered 3 records" do
+      expect(num_records_filtered).to eq(3)
+    end
+  end
+
+  describe_parsing_a_record '36.39.246.121' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['36.39.246.121'])) }
+    end
+  end
+
+  describe_parsing_a_record '94.32.71.168' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['94.32.71.168'])) }
+    end
+  end
+end

data/spec/feeds/openbl-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/openbl-ip_reputation.feed', :feed do
+  let(:provider) { 'openbl' }
+  let(:name) { 'ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.openbl.org/lists/base.txt'
+
+  describe_parsing_the_file feed_data('openbl_iplist.txt') do
+    it "should have parsed 8 records" do
+      expect(num_records_parsed).to eq(8)
+    end
+    it "should have filtered 4 records" do
+      expect(num_records_filtered).to eq(4)
+    end
+  end
+
+  describe_parsing_a_record '113.171.10.37' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['113.171.10.37'])) }
+    end
+  end
+
+  describe_parsing_a_record '210.209.84.57' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['210.209.84.57'])) }
+    end
+  end
+end

data/spec/feeds/openphish_url_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/openphish-url_reputation.feed', :feed do
+  let(:provider) { 'openphish' }
+  let(:name) { 'url_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://openphish.com/feed.txt'
+
+  describe_parsing_the_file feed_data('openphish-url-reputation.txt') do
+    it "should have parsed 15 records" do
+      expect(num_records_parsed).to eq(15)
+    end
+    it "should have filtered 1 records" do
+      expect(num_records_filtered).to eq(1)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record 'http://107.190.137.202/~akshat/images/fr/webscr.confirmer.secure.connexion.mpp.information.compte.webapps.home/8fa5aed41992b676cf5305ee5c3d4e1e/login.php' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+	  its(:urls) { is_expected.to eq(build(:urls, values: ['http://107.190.137.202/~akshat/images/fr/webscr.confirmer.secure.connexion.mpp.information.compte.webapps.home/8fa5aed41992b676cf5305ee5c3d4e1e/login.php'])) }
+    end
+  end
+
+  describe_parsing_a_record 'http://haraiscompany.com/images/zpsiios/5g60jpjhifajb8rrvx1ixr/?jsp=main' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+	  its(:urls) { is_expected.to eq(build(:urls, values: ['http://haraiscompany.com/images/zpsiios/5g60jpjhifajb8rrvx1ixr/?jsp=main'])) }
+    end
+  end
+end

data/spec/feeds/packetmail_perimeterbad-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/packetmail_perimeterbad-ip_reputation.feed', :feed do
+  let(:provider) { 'packetmail' }
+  let(:name) { 'perimeterbad_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'https://www.packetmail.net/iprep_perimeterbad.txt'
+
+  describe_parsing_the_file feed_data('packetmail_perimeterbad-ip_reputation.txt') do
+    it "should have parsed 8 records" do
+      expect(num_records_parsed).to eq(8)
+    end
+    it "should have filtered 36 records" do
+      expect(num_records_filtered).to eq(36)
+    end
+  end
+
+  describe_parsing_a_record '[03/Sep/2014:13:11:47 -0500]	192.99.152.38	206.82.85.197	403	GET /cc/process.php HTTP/1.1    -	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0	2014-09-03' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['192.99.152.38'])) }
+    end
+  end
+
+  describe_parsing_a_record '[03/Sep/2014:18:06:59 -0500]	69.28.85.204	www.hackbraten.tk	403	HEAD /Hackbraten.zip HTTP/1.1   -	curl/7.32.0	2014-09-03' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['69.28.85.204'])) }
+    end
+  end
+end

data/spec/feeds/palevo-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/palevo-domain_reputation.feed', :feed do
+  let(:provider) { 'abuse_ch' }
+  let(:name) { 'palevo_domain_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'https://palevotracker.abuse.ch/blocklists.php?download=domainblocklist'
+
+  describe_parsing_the_file feed_data('palevo_domainlist.txt') do
+    it "should have parsed 24 records" do
+      expect(num_records_parsed).to eq(24)
+    end
+    it "should have filtered 1 records" do
+      expect(num_records_filtered).to eq(1)
+    end
+  end
+
+  describe_parsing_a_record 'legionarios.servecounterstrike.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:fqdns) { is_expected.to match_array(['legionarios.servecounterstrike.com']) }
+    end
+  end
+
+  describe_parsing_a_record 's.24otuwotefsmd.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:fqdns) { is_expected.to match_array(['s.24otuwotefsmd.com']) }
+    end
+  end
+end

data/spec/feeds/palevo-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/palevo-ip_reputation.feed', :feed do
+  let(:provider) { 'abuse_ch' }
+  let(:name) { 'palevo_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'https://palevotracker.abuse.ch/blocklists.php?download=ipblocklist'
+
+  describe_parsing_the_file feed_data('palevo_iplist.txt') do
+    it "should have parsed 23 records" do
+      expect(num_records_parsed).to eq(23)
+    end
+    it "should have filtered 1 records" do
+      expect(num_records_filtered).to eq(1)
+    end
+  end
+
+  describe_parsing_a_record '187.214.120.147' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['187.214.120.147'])) }
+    end
+  end
+
+  describe_parsing_a_record '67.210.170.169' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['67.210.170.169'])) }
+    end
+  end
+end

data/spec/feeds/phishtank_spec.rb

@@ -0,0 +1,41 @@
+require 'spec_helper'
+
+describe 'feeds/phishtank.feed', :feed do
+  let(:provider) { 'phishtank' }
+  let(:name) { 'phishtank' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://data.phishtank.com/data/online-valid.json.gz'
+
+  describe_parsing_the_file feed_data('phishtank-sample.json.gz') do
+    it "should have parsed 10 records" do
+      expect(num_records_parsed).to eq(10)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+
+    describe "the records" do
+      it "should total 10" do
+        expect(num_records).to eq(10)
+      end
+
+      it "each record should have generated exactly one event" do
+        counts = events.map { |event_array| event_array.count }
+        expect(counts).to eq([1,1,1,1,1,1,1,1,1,1])
+      end
+
+      describe "the event for record 0" do
+        let(:record) { records[0] }
+        let(:event) { events[0].first }
+        subject { event }
+
+        its(:type) { is_expected.to be(:phishing) }
+        its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['31.14.23.213'])) }
+        its(:urls) { is_expected.to eq(build(:urls, values: ['http://poste.it-postepay4.phpblack.com/'])) }
+      end
+    end
+  end
+
+end

data/spec/feeds/sigmaproject_atma_spec.rb

@@ -0,0 +1,62 @@
+require 'spec_helper'
+
+describe 'feeds/sigmaproject_atma.feed', :feed do
+  let(:provider) { 'sigmaproject' }
+  let(:name) { 'atma_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=atma'
+
+  describe_parsing_the_file feed_data('sigmaproject_atma.return.gz') do
+    it "should have parsed 10 records" do
+      expect(num_records_parsed).to eq(10)
+    end
+    it "should have filtered 1 records" do
+      expect(num_records_filtered).to eq(1)
+    end
+
+    describe "the records" do
+      it "should total 11" do
+        expect(num_records).to eq(11)
+      end
+
+      it "each record should have generated exactly one event" do
+        counts = events.map { |event_array| event_array.count }
+        expect(counts).to eq([1,1,1,1,1,1,1,1,1,1,0])
+      end
+
+      describe "the event for record 0" do
+        let(:record) { records[0] }
+        let(:event) { events[0].first }
+        subject { event }
+
+        its(:type) { is_expected.to be(:scanning) }
+        its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['106.187.97.158'])) }
+      end
+    end
+  end
+
+  describe_parsing_a_record '117.194.6.38/32' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['117.194.6.38'])) }
+    end
+  end
+
+  describe_parsing_a_record '144.76.42.128/25' do
+    it "should have been filtered" do
+      expect(status).to eq(:filtered)
+    end
+    it "should have parsed 0 event" do
+      expect(events.count).to eq(0)
+    end
+  end
+end

data/spec/feeds/sigmaproject_spyware_spec.rb

@@ -0,0 +1,63 @@
+require 'spec_helper'
+
+describe 'feeds/sigmaproject_spyware.feed', :feed do
+  let(:provider) { 'sigmaproject' }
+  let(:name) { 'spyware_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=spyware'
+
+  describe_parsing_the_file feed_data('sigmaproject_spyware.return.gz') do
+    it "should have parsed 5 records" do
+      expect(num_records_parsed).to eq(5)
+    end
+    it "should have filtered 5 records" do
+      expect(num_records_filtered).to eq(5)
+    end
+
+    describe "the records" do
+      it "should total 10" do
+        expect(num_records).to eq(10)
+      end
+
+      it "each record should have generated exactly one event" do
+        counts = events.map { |event_array| event_array.count }
+        expect(counts).to eq([1, 0, 0, 0, 0, 0, 1, 1, 1, 1])
+      end
+
+      describe "the event for record 0" do
+        let(:record) { records[0] }
+        let(:event) { events[0].first }
+        subject { event }
+
+        its(:type) { is_expected.to be(:c2) }
+        its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['2.60.13.132'])) }
+      end
+    end
+  end
+
+  describe_parsing_a_record '2.60.13.132/32' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['2.60.13.132'])) }
+    end
+  end
+
+  describe_parsing_a_record '5.3.88.23/27' do
+    it "should have been filtered" do
+      expect(status).to eq(:filtered)
+    end
+    it "should have no events" do
+      expect(events.count).to eq(0)
+    end
+  end
+
+end

data/spec/feeds/sigmaproject_webexploit_spec.rb

@@ -0,0 +1,62 @@
+require 'spec_helper'
+
+describe 'feeds/sigmaproject_webexploit.feed', :feed do
+  let(:provider) { 'sigmaproject' }
+  let(:name) { 'webexploit_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=webexploit'
+
+  describe_parsing_the_file feed_data('sigmaproject_webexploit.return.gz') do
+    it "should have parsed 9 records" do
+      expect(num_records_parsed).to eq(9)
+    end
+    it "should have filtered 1 records" do
+      expect(num_records_filtered).to eq(1)
+    end
+
+    describe "the records" do
+      it "should total 10" do
+        expect(num_records).to eq(10)
+      end
+
+      it "each record should have generated exactly one event" do
+        counts = events.map { |event_array| event_array.count }
+        expect(counts).to eq([1, 1, 1, 1, 0, 1, 1, 1, 1, 1])
+      end
+
+      describe "the event for record 0" do
+        let(:record) { records[0] }
+        let(:event) { events[0].first }
+        subject { event }
+
+        its(:type) { is_expected.to be(:attacker) }
+        its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['2.95.241.135'])) }
+      end
+    end
+  end
+
+  describe_parsing_a_record '2.60.13.132/32' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:attacker) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['2.60.13.132'])) }
+    end
+  end
+
+  describe_parsing_a_record '10.1.20.33/27' do
+    it "should have been filtered" do
+      expect(status).to eq(:filtered)
+    end
+    it "should not have parsed any events" do
+      expect(events.count).to eq(0)
+    end
+  end
+end

data/spec/feeds/snort_bpf-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/snort_bpf-ip_reputation.feed', :feed do
+  let(:provider) { 'snort' }
+  let(:name) { 'bpf_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://labs.snort.org/feeds/ip-filter.blf'
+
+  describe_parsing_the_file feed_data('snort_bpf-ip_reputation.txt') do
+    it "should have parsed 16 records" do
+      expect(num_records_parsed).to eq(16)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '193.106.31.12' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['193.106.31.12'])) }
+    end
+  end
+
+  describe_parsing_a_record '76.74.184.23' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['76.74.184.23'])) }
+    end
+  end
+end

data/spec/feeds/spyeye-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/spyeye-domain_reputation.feed', :feed do
+  let(:provider) { 'abuse_ch' }
+  let(:name) { 'spyeye_domain_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'https://spyeyetracker.abuse.ch/blocklist.php?download=domainblocklist'
+
+  describe_parsing_the_file feed_data('spyeye_domainlist.txt') do
+    it "should have parsed 9 records" do
+      expect(num_records_parsed).to eq(9)
+    end
+    it "should have filtered 7 records" do
+      expect(num_records_filtered).to eq(7)
+    end
+  end
+
+  describe_parsing_a_record 'futuretelefonica.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:fqdns) { is_expected.to match_array(["futuretelefonica.com"]) }
+    end
+  end
+
+  describe_parsing_a_record 'helen33nasanorth.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:fqdns) { is_expected.to match_array(["helen33nasanorth.com"]) }
+    end
+  end
+end

data/spec/feeds/spyeye-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/spyeye-ip_reputation.feed', :feed do
+  let(:provider) { 'abuse_ch' }
+  let(:name) { 'spyeye_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'https://spyeyetracker.abuse.ch/blocklist.php?download=ipblocklist'
+
+  describe_parsing_the_file feed_data('spyeye_iplist.txt') do
+    it "should have parsed 12 records" do
+      expect(num_records_parsed).to eq(12)
+    end
+    it "should have filtered 7 records" do
+      expect(num_records_filtered).to eq(7)
+    end
+  end
+
+  describe_parsing_a_record '188.190.126.173' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['188.190.126.173'])) }
+    end
+  end
+
+  describe_parsing_a_record '91.220.62.190' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['91.220.62.190'])) }
+    end
+  end
+end