shadowbq-threatinator 0.5.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (389) hide show
  1. checksums.yaml +7 -0
  2. data/CHANGELOG.md +66 -0
  3. data/CONTRIBUTING.md +119 -0
  4. data/Gemfile +38 -0
  5. data/LICENSE +165 -0
  6. data/README.md +101 -0
  7. data/Rakefile +47 -0
  8. data/VERSION +1 -0
  9. data/bin/threatinator +5 -0
  10. data/bin/threatinator_loader +21 -0
  11. data/feeds/ET_block-ip_reputation.feed +27 -0
  12. data/feeds/ET_compromised-ip_reputation.feed +20 -0
  13. data/feeds/ET_openbadlist-ip_reputation.feed +36 -0
  14. data/feeds/alienvault-ip_reputation.feed +39 -0
  15. data/feeds/arbor_fastflux-domain_reputation.feed +19 -0
  16. data/feeds/arbor_ssh-ip_reputation.feed +24 -0
  17. data/feeds/autoshun_shunlist.feed +17 -0
  18. data/feeds/bambenek_c2_masterlist-domain_reputation.feed +16 -0
  19. data/feeds/bambenek_c2_masterlist-ip_reputation.feed +16 -0
  20. data/feeds/bambenek_dga_feed-domain_reputation.feed +16 -0
  21. data/feeds/berkeley-ip_reputation.feed +25 -0
  22. data/feeds/bitcash_cz_blacklist.feed +22 -0
  23. data/feeds/blocklist_de_apache-ip_reputation.feed +26 -0
  24. data/feeds/blocklist_de_bots-ip_reputation.feed +26 -0
  25. data/feeds/blocklist_de_ftp-ip_reputation.feed +25 -0
  26. data/feeds/blocklist_de_imap-ip_reputation.feed +25 -0
  27. data/feeds/blocklist_de_pop3-ip_reputation.feed +26 -0
  28. data/feeds/blocklist_de_proftpd-ip_reputation.feed +26 -0
  29. data/feeds/blocklist_de_sip-ip_reputation.feed +25 -0
  30. data/feeds/blocklist_de_ssh-ip_reputation.feed +25 -0
  31. data/feeds/blocklist_de_strongips-ip_reputation.feed +25 -0
  32. data/feeds/botscout-ip_reputation.feed +25 -0
  33. data/feeds/cert_mxpoison-ip_reputation.feed +22 -0
  34. data/feeds/chaosreigns-ip_reputation.feed +37 -0
  35. data/feeds/ciarmy-ip_reputation.feed +20 -0
  36. data/feeds/cruzit-ip_reputation.feed +30 -0
  37. data/feeds/cydef_torexit-ip_reputation.feed +25 -0
  38. data/feeds/dan_me_uk_torlist-ip_reputation.feed +25 -0
  39. data/feeds/danger_bruteforce-ip_reputation.feed +24 -0
  40. data/feeds/dshield_attackers-top1000.feed +34 -0
  41. data/feeds/falconcrest-ip_reputation.feed +19 -0
  42. data/feeds/feodo-domain_reputation.feed +19 -0
  43. data/feeds/feodo-ip_reputation.feed +20 -0
  44. data/feeds/h3x_asprox.feed +18 -0
  45. data/feeds/hosts-file_hphostspartial-domain_reputation.feed +19 -0
  46. data/feeds/infiltrated-ip_reputation.feed +26 -0
  47. data/feeds/infiltrated_vabl-ip_reputation.feed +30 -0
  48. data/feeds/isc_suspicious_high-domain_reputation.feed +26 -0
  49. data/feeds/isc_suspicious_low-domain_reputation.feed +26 -0
  50. data/feeds/isc_suspicious_medium-domain_reputation.feed +26 -0
  51. data/feeds/malc0de-domain_reputation.feed +24 -0
  52. data/feeds/malc0de-ip_reputation.feed +26 -0
  53. data/feeds/malwaredomainlist-url_reputation.feed +18 -0
  54. data/feeds/malwaredomains-domain_reputation.feed +29 -0
  55. data/feeds/malwaredomains_dyndns-domain_reputation.feed +29 -0
  56. data/feeds/malwaredomains_justdomains-domain_reputation.feed +20 -0
  57. data/feeds/mirc-domain_reputation.feed +30 -0
  58. data/feeds/multiproxy-ip_reputation.feed +22 -0
  59. data/feeds/nothink_irc-ip_reputation.feed +23 -0
  60. data/feeds/nothink_ssh-ip_reputation.feed +21 -0
  61. data/feeds/openbl-ip_reputation.feed +21 -0
  62. data/feeds/openphish-url_reputation.feed +24 -0
  63. data/feeds/packetmail_perimeterbad-ip_reputation.feed +28 -0
  64. data/feeds/palevo-domain_reputation.feed +22 -0
  65. data/feeds/palevo-ip_reputation.feed +23 -0
  66. data/feeds/phishtank.feed +22 -0
  67. data/feeds/sigmaproject_atma.feed +27 -0
  68. data/feeds/sigmaproject_spyware.feed +28 -0
  69. data/feeds/sigmaproject_webexploit.feed +26 -0
  70. data/feeds/snort_bpf-ip_reputation.feed +19 -0
  71. data/feeds/spyeye-domain_reputation.feed +18 -0
  72. data/feeds/spyeye-ip_reputation.feed +19 -0
  73. data/feeds/steeman-ip_reputation.feed +20 -0
  74. data/feeds/t-arend-de_ssh-ip_reputation.feed +20 -0
  75. data/feeds/the_haleys_ssh-ip_reputation.feed +20 -0
  76. data/feeds/trustedsec-ip_reputation.feed +18 -0
  77. data/feeds/virbl-ip_reputation.feed +25 -0
  78. data/feeds/vxvault-url_reputation.feed +23 -0
  79. data/feeds/yourcmc_ssh-ip_reputation.feed +20 -0
  80. data/feeds/yoyo_adservers-domain_reputation.feed +17 -0
  81. data/feeds/zeus-domain_reputation.feed +19 -0
  82. data/feeds/zeus-ip_reputation.feed +21 -0
  83. data/lib/threatinator/action.rb +14 -0
  84. data/lib/threatinator/actions/list/action.rb +97 -0
  85. data/lib/threatinator/actions/list/config.rb +12 -0
  86. data/lib/threatinator/actions/list.rb +2 -0
  87. data/lib/threatinator/actions/run/action.rb +57 -0
  88. data/lib/threatinator/actions/run/config.rb +32 -0
  89. data/lib/threatinator/actions/run/coverage_observer.rb +59 -0
  90. data/lib/threatinator/actions/run/output_config.rb +59 -0
  91. data/lib/threatinator/actions/run/status_observer.rb +37 -0
  92. data/lib/threatinator/actions/run.rb +2 -0
  93. data/lib/threatinator/cli/action_builder.rb +33 -0
  94. data/lib/threatinator/cli/list_action_builder.rb +19 -0
  95. data/lib/threatinator/cli/parser.rb +123 -0
  96. data/lib/threatinator/cli/run_action_builder.rb +41 -0
  97. data/lib/threatinator/cli.rb +19 -0
  98. data/lib/threatinator/config/base.rb +35 -0
  99. data/lib/threatinator/config/feed_search.rb +25 -0
  100. data/lib/threatinator/config/logger.rb +14 -0
  101. data/lib/threatinator/config.rb +7 -0
  102. data/lib/threatinator/decoder.rb +24 -0
  103. data/lib/threatinator/decoders/gzip.rb +30 -0
  104. data/lib/threatinator/event.rb +63 -0
  105. data/lib/threatinator/event_builder.rb +70 -0
  106. data/lib/threatinator/exceptions.rb +58 -0
  107. data/lib/threatinator/feed.rb +88 -0
  108. data/lib/threatinator/feed_builder.rb +161 -0
  109. data/lib/threatinator/feed_registry.rb +47 -0
  110. data/lib/threatinator/feed_runner.rb +177 -0
  111. data/lib/threatinator/fetcher.rb +22 -0
  112. data/lib/threatinator/fetchers/http.rb +50 -0
  113. data/lib/threatinator/filter.rb +12 -0
  114. data/lib/threatinator/filters/block.rb +18 -0
  115. data/lib/threatinator/filters/comments.rb +16 -0
  116. data/lib/threatinator/filters/whitespace.rb +19 -0
  117. data/lib/threatinator/logger.rb +66 -0
  118. data/lib/threatinator/logging.rb +20 -0
  119. data/lib/threatinator/model/base.rb +23 -0
  120. data/lib/threatinator/model/collection.rb +89 -0
  121. data/lib/threatinator/model/observables/fqdn_collection.rb +15 -0
  122. data/lib/threatinator/model/observables/ipv4.rb +33 -0
  123. data/lib/threatinator/model/observables/ipv4_collection.rb +14 -0
  124. data/lib/threatinator/model/observables/url_collection.rb +16 -0
  125. data/lib/threatinator/model/validations/type.rb +21 -0
  126. data/lib/threatinator/model/validations.rb +1 -0
  127. data/lib/threatinator/output.rb +50 -0
  128. data/lib/threatinator/parser.rb +23 -0
  129. data/lib/threatinator/parsers/csv/parser.rb +77 -0
  130. data/lib/threatinator/parsers/csv.rb +7 -0
  131. data/lib/threatinator/parsers/getline/parser.rb +45 -0
  132. data/lib/threatinator/parsers/getline.rb +8 -0
  133. data/lib/threatinator/parsers/json/adapters/oj.rb +65 -0
  134. data/lib/threatinator/parsers/json/parser.rb +45 -0
  135. data/lib/threatinator/parsers/json/record.rb +20 -0
  136. data/lib/threatinator/parsers/json.rb +8 -0
  137. data/lib/threatinator/parsers/xml/node.rb +79 -0
  138. data/lib/threatinator/parsers/xml/node_builder.rb +39 -0
  139. data/lib/threatinator/parsers/xml/parser.rb +44 -0
  140. data/lib/threatinator/parsers/xml/path.rb +70 -0
  141. data/lib/threatinator/parsers/xml/pattern.rb +53 -0
  142. data/lib/threatinator/parsers/xml/record.rb +14 -0
  143. data/lib/threatinator/parsers/xml/sax_document.rb +64 -0
  144. data/lib/threatinator/parsers/xml.rb +8 -0
  145. data/lib/threatinator/plugin_loader.rb +115 -0
  146. data/lib/threatinator/plugins/output/amqp/config.rb +18 -0
  147. data/lib/threatinator/plugins/output/amqp.rb +41 -0
  148. data/lib/threatinator/plugins/output/csv.rb +58 -0
  149. data/lib/threatinator/plugins/output/json/config.rb +14 -0
  150. data/lib/threatinator/plugins/output/json.rb +53 -0
  151. data/lib/threatinator/plugins/output/null.rb +17 -0
  152. data/lib/threatinator/plugins/output/rubydebug.rb +16 -0
  153. data/lib/threatinator/record.rb +22 -0
  154. data/lib/threatinator/registry.rb +53 -0
  155. data/lib/threatinator/util.rb +15 -0
  156. data/lib/threatinator.rb +3 -0
  157. data/spec/feeds/ET_block-ip_reputation_spec.rb +50 -0
  158. data/spec/feeds/ET_compromised-ip_reputation_spec.rb +47 -0
  159. data/spec/feeds/ET_openbadlist-ip_reputation_spec.rb +56 -0
  160. data/spec/feeds/alienvault-ip_reputation_spec.rb +46 -0
  161. data/spec/feeds/arbor_fastflux-domain_reputation_spec.rb +46 -0
  162. data/spec/feeds/arbor_ssh-ip_reputation_spec.rb +46 -0
  163. data/spec/feeds/autoshun_shunlist_spec.rb +38 -0
  164. data/spec/feeds/bambenek_c2_masterlist-domain_reputation_spec.rb +38 -0
  165. data/spec/feeds/bambenek_c2_masterlist-ip_reputation_spec.rb +39 -0
  166. data/spec/feeds/bambenek_dga_feed-domain_reputation_spec.rb +39 -0
  167. data/spec/feeds/berkeley-ip_reputation_spec.rb +47 -0
  168. data/spec/feeds/bitcash_cz_blacklist-ip_reputation_spec.rb +50 -0
  169. data/spec/feeds/blocklist_de_apache-ip_reputation_spec.rb +47 -0
  170. data/spec/feeds/blocklist_de_bots-ip_reputation_spec.rb +47 -0
  171. data/spec/feeds/blocklist_de_ftp-ip_reputation_spec.rb +47 -0
  172. data/spec/feeds/blocklist_de_imap-ip_reputation_spec.rb +47 -0
  173. data/spec/feeds/blocklist_de_pop3-ip_reputation_spec.rb +47 -0
  174. data/spec/feeds/blocklist_de_proftpd-ip_reputation_spec.rb +47 -0
  175. data/spec/feeds/blocklist_de_sip-ip_reputation_spec.rb +47 -0
  176. data/spec/feeds/blocklist_de_ssh-ip_reputation_spec.rb +47 -0
  177. data/spec/feeds/blocklist_de_strongips-ip_reputation_spec.rb +47 -0
  178. data/spec/feeds/botscout-ip_reputation_spec.rb +50 -0
  179. data/spec/feeds/cert_mxpoison-ip_reputation_spec.rb +47 -0
  180. data/spec/feeds/chaosreigns-ip_reputation_spec.rb +50 -0
  181. data/spec/feeds/ciarmy-ip_reputation_spec.rb +47 -0
  182. data/spec/feeds/cruzit-ip_reputation_spec.rb +47 -0
  183. data/spec/feeds/cydef_torexit-ip_reputation_spec.rb +47 -0
  184. data/spec/feeds/dan_me_uk_torlist-ip_reputation_spec.rb +47 -0
  185. data/spec/feeds/danger_bruteforce-ip_reputation_spec.rb +47 -0
  186. data/spec/feeds/data/ET_block-ip_reputation.txt +80 -0
  187. data/spec/feeds/data/ET_compromised-ip_reputation.txt +11 -0
  188. data/spec/feeds/data/ET_openbadlist-ip_reputation.txt +62 -0
  189. data/spec/feeds/data/alienvault-ip_reputation.txt +18 -0
  190. data/spec/feeds/data/arbor_domainlist.txt +11 -0
  191. data/spec/feeds/data/arbor_ssh.txt +16 -0
  192. data/spec/feeds/data/autoshun_shunlist.csv +20 -0
  193. data/spec/feeds/data/bambenek_c2-dommasterlist.csv +30 -0
  194. data/spec/feeds/data/bambenek_c2-ipmasterlist.csv +27 -0
  195. data/spec/feeds/data/bambenek_dga_feed.csv +42 -0
  196. data/spec/feeds/data/berkeley.txt +29 -0
  197. data/spec/feeds/data/bitcash_cz_blacklist.txt +7 -0
  198. data/spec/feeds/data/blocklist_de_apache-ip-reputation.txt +17 -0
  199. data/spec/feeds/data/blocklist_de_bots-ip-reputation.txt +15 -0
  200. data/spec/feeds/data/blocklist_de_ftp-ip-reputation.txt +7 -0
  201. data/spec/feeds/data/blocklist_de_imap-ip-reputation.txt +8 -0
  202. data/spec/feeds/data/blocklist_de_pop3-ip-reputation.txt +11 -0
  203. data/spec/feeds/data/blocklist_de_proftpd-ip-reputation.txt +12 -0
  204. data/spec/feeds/data/blocklist_de_sip-ip-reputation.txt +9 -0
  205. data/spec/feeds/data/blocklist_de_ssh-ip-reputation.txt +10 -0
  206. data/spec/feeds/data/blocklist_de_strongips-ip-reputation.txt +11 -0
  207. data/spec/feeds/data/botscout-ip-reputation.txt +713 -0
  208. data/spec/feeds/data/cert_mxpoison-ip_reputation.txt +17 -0
  209. data/spec/feeds/data/chaosreigns-ip-reputation.txt +26 -0
  210. data/spec/feeds/data/ciarmy-ip-reputation.txt +11 -0
  211. data/spec/feeds/data/cruzit-ip-reputation.txt +14 -0
  212. data/spec/feeds/data/cydef_torexit-ip_reputation.txt +27 -0
  213. data/spec/feeds/data/dan_me_uk_torlist-ip-reputation.txt +11 -0
  214. data/spec/feeds/data/danger_bruteforce-ip_reputation.txt +12 -0
  215. data/spec/feeds/data/dshield_topattackers.xml +4 -0
  216. data/spec/feeds/data/falconcrest_iplist.txt +345 -0
  217. data/spec/feeds/data/feodo_domainlist.txt +18 -0
  218. data/spec/feeds/data/feodo_iplist.txt +20 -0
  219. data/spec/feeds/data/h3x_asprox.txt +20 -0
  220. data/spec/feeds/data/hosts-file_hphostspartial_domainlist.txt +24 -0
  221. data/spec/feeds/data/infiltrated_iplist.txt +16 -0
  222. data/spec/feeds/data/infiltrated_vabl_iplist.txt +33 -0
  223. data/spec/feeds/data/isc_suspicious_high_domainlist.txt +26 -0
  224. data/spec/feeds/data/isc_suspicious_low_domainlist.txt +34 -0
  225. data/spec/feeds/data/isc_suspicious_medium_domainlist.txt +32 -0
  226. data/spec/feeds/data/malc0de_domainlist.txt +18 -0
  227. data/spec/feeds/data/malc0de_iplist.txt +14 -0
  228. data/spec/feeds/data/malwaredomainlist-url-reputation.txt +8 -0
  229. data/spec/feeds/data/malwaredomains_domainlist.txt +24 -0
  230. data/spec/feeds/data/malwaredomains_dyndns_domainlist.txt +34 -0
  231. data/spec/feeds/data/malwaredomains_justdomains_domainlist.txt +18 -0
  232. data/spec/feeds/data/mirc_domainlist.txt +31 -0
  233. data/spec/feeds/data/multiproxy_iplist.txt +15 -0
  234. data/spec/feeds/data/nothink_irc_iplist.txt +14 -0
  235. data/spec/feeds/data/nothink_ssh_iplist.txt +10 -0
  236. data/spec/feeds/data/openbl_iplist.txt +12 -0
  237. data/spec/feeds/data/openphish-url-reputation.txt +16 -0
  238. data/spec/feeds/data/packetmail_perimeterbad-ip_reputation.txt +44 -0
  239. data/spec/feeds/data/palevo_domainlist.txt +25 -0
  240. data/spec/feeds/data/palevo_iplist.txt +24 -0
  241. data/spec/feeds/data/phishtank-sample.json.gz +0 -0
  242. data/spec/feeds/data/sigmaproject_atma.return.gz +0 -0
  243. data/spec/feeds/data/sigmaproject_spyware.return.gz +0 -0
  244. data/spec/feeds/data/sigmaproject_webexploit.return.gz +0 -0
  245. data/spec/feeds/data/snort_bpf-ip_reputation.txt +16 -0
  246. data/spec/feeds/data/spyeye_domainlist.txt +16 -0
  247. data/spec/feeds/data/spyeye_iplist.txt +19 -0
  248. data/spec/feeds/data/steeman-ip-reputation.txt +13 -0
  249. data/spec/feeds/data/t-arend-de_ssh_iplist.txt +17 -0
  250. data/spec/feeds/data/the_haleys_ssh_iplist.txt +12 -0
  251. data/spec/feeds/data/trustedsec-ip-reputation.txt +12 -0
  252. data/spec/feeds/data/valid.json +2908 -0
  253. data/spec/feeds/data/virbl-ip_reputation.txt +14 -0
  254. data/spec/feeds/data/vxvault-url-reputation.txt +15 -0
  255. data/spec/feeds/data/yourcmc_ssh-ip_reputation.txt +27 -0
  256. data/spec/feeds/data/yoyo_adservers.txt +25 -0
  257. data/spec/feeds/data/zeus-ip_reputation.txt +285 -0
  258. data/spec/feeds/data/zeus_domainlist.txt +27 -0
  259. data/spec/feeds/dshield_attackers-top1000_spec.rb +39 -0
  260. data/spec/feeds/falconcrest-ip_reputation_spec.rb +39 -0
  261. data/spec/feeds/feodo-domain_reputation_spec.rb +47 -0
  262. data/spec/feeds/feodo-ip_reputation_spec.rb +47 -0
  263. data/spec/feeds/h3x_asprox-ip_reputation_spec.rb +50 -0
  264. data/spec/feeds/hosts-file_hphostspartial-domain_reputation_spec.rb +47 -0
  265. data/spec/feeds/infiltrated-ip_reputation_spec.rb +47 -0
  266. data/spec/feeds/infiltrated_vabl-ip_reputation_spec.rb +47 -0
  267. data/spec/feeds/isc_suspicious_high-domain_reputation_spec.rb +47 -0
  268. data/spec/feeds/isc_suspicious_low-domain_reputation_spec.rb +47 -0
  269. data/spec/feeds/isc_suspicious_medium-domain_reputation_spec.rb +47 -0
  270. data/spec/feeds/malc0de-domain_reputation_spec.rb +47 -0
  271. data/spec/feeds/malc0de-ip_reputation_spec.rb +47 -0
  272. data/spec/feeds/malwaredomainlist_url_reputation_spec.rb +50 -0
  273. data/spec/feeds/malwaredomains-domain_reputation_spec.rb +47 -0
  274. data/spec/feeds/malwaredomains_dyndns-domain_reputation_spec.rb +47 -0
  275. data/spec/feeds/malwaredomains_justdomains-domain_reputation_spec.rb +47 -0
  276. data/spec/feeds/mirc-domain_reputation_spec.rb +47 -0
  277. data/spec/feeds/multiproxy-ip_reputation_spec.rb +47 -0
  278. data/spec/feeds/nothink_irc-ip_reputation_spec.rb +47 -0
  279. data/spec/feeds/nothink_ssh-ip_reputation_spec.rb +47 -0
  280. data/spec/feeds/openbl-ip_reputation_spec.rb +47 -0
  281. data/spec/feeds/openphish_url_reputation_spec.rb +50 -0
  282. data/spec/feeds/packetmail_perimeterbad-ip_reputation_spec.rb +47 -0
  283. data/spec/feeds/palevo-domain_reputation_spec.rb +47 -0
  284. data/spec/feeds/palevo-ip_reputation_spec.rb +47 -0
  285. data/spec/feeds/phishtank_spec.rb +41 -0
  286. data/spec/feeds/sigmaproject_atma_spec.rb +62 -0
  287. data/spec/feeds/sigmaproject_spyware_spec.rb +63 -0
  288. data/spec/feeds/sigmaproject_webexploit_spec.rb +62 -0
  289. data/spec/feeds/snort_bpf-ip_reputation_spec.rb +47 -0
  290. data/spec/feeds/spyeye-domain_reputation_spec.rb +47 -0
  291. data/spec/feeds/spyeye-ip_reputation_spec.rb +47 -0
  292. data/spec/feeds/steeman-ip_reputation_spec.rb +50 -0
  293. data/spec/feeds/t-arend-de_ssh-ip_reputation_spec.rb +47 -0
  294. data/spec/feeds/the_haleys_ssh-ip_reputation_spec.rb +47 -0
  295. data/spec/feeds/trustedsec-ip_reputation_spec.rb +47 -0
  296. data/spec/feeds/virbl-ip_reputation_spec.rb +47 -0
  297. data/spec/feeds/vxvault_url_reputation_spec.rb +50 -0
  298. data/spec/feeds/yourcmc_ssh-ip_reputation_spec.rb +47 -0
  299. data/spec/feeds/yoyo_adservers_spec.rb +47 -0
  300. data/spec/feeds/zeus-domain_reputation_spec.rb +47 -0
  301. data/spec/feeds/zeus-ip_reputation_spec.rb +47 -0
  302. data/spec/fixtures/feed/provider1/feed1.feed +6 -0
  303. data/spec/fixtures/parsers/test.xml +13 -0
  304. data/spec/fixtures/parsers/test_self_closing.xml +20 -0
  305. data/spec/fixtures/plugins/bad/threatinator/plugins/test_error1/plugin.rb +1 -0
  306. data/spec/fixtures/plugins/bad/threatinator/plugins/test_missing1/plugin.rb +0 -0
  307. data/spec/fixtures/plugins/fake.rb +19 -0
  308. data/spec/fixtures/plugins/good/threatinator/plugins/test_type1/plugin_a.rb +8 -0
  309. data/spec/fixtures/plugins/good/threatinator/plugins/test_type1/plugin_b.rb +8 -0
  310. data/spec/fixtures/plugins/good/threatinator/plugins/test_type2/plugin_c.rb +8 -0
  311. data/spec/fixtures/plugins/good/threatinator/plugins/test_type2/plugin_d.rb +8 -0
  312. data/spec/fixtures/plugins/good/threatinator/plugins/test_type3/plugin_e.rb +8 -0
  313. data/spec/fixtures/plugins/good/threatinator/plugins/test_type3/plugin_f.rb +8 -0
  314. data/spec/spec_helper.rb +54 -0
  315. data/spec/support/bad_feeds/missing_fetcher.feed +7 -0
  316. data/spec/support/bad_feeds/missing_name.feed +6 -0
  317. data/spec/support/bad_feeds/missing_parser.feed +3 -0
  318. data/spec/support/bad_feeds/missing_provider.feed +5 -0
  319. data/spec/support/factories/event.rb +31 -0
  320. data/spec/support/factories/feed.rb +59 -0
  321. data/spec/support/factories/feed_builder.rb +65 -0
  322. data/spec/support/factories/feed_registry.rb +8 -0
  323. data/spec/support/factories/ipv4.rb +36 -0
  324. data/spec/support/factories/output.rb +11 -0
  325. data/spec/support/factories/record.rb +17 -0
  326. data/spec/support/factories/url.rb +34 -0
  327. data/spec/support/factories/xml_node.rb +33 -0
  328. data/spec/support/helpers/io.rb +11 -0
  329. data/spec/support/helpers/models.rb +13 -0
  330. data/spec/support/shared/action_builder.rb +47 -0
  331. data/spec/support/shared/decoder.rb +70 -0
  332. data/spec/support/shared/feed_runner_observer.rb +136 -0
  333. data/spec/support/shared/feeds.rb +233 -0
  334. data/spec/support/shared/fetcher.rb +48 -0
  335. data/spec/support/shared/filter.rb +14 -0
  336. data/spec/support/shared/io-like.rb +7 -0
  337. data/spec/support/shared/model/collection.rb +164 -0
  338. data/spec/support/shared/output.rb +120 -0
  339. data/spec/support/shared/parsers.rb +51 -0
  340. data/spec/support/shared/record.rb +111 -0
  341. data/spec/threatinator/actions/list/action_spec.rb +148 -0
  342. data/spec/threatinator/actions/run/action_spec.rb +106 -0
  343. data/spec/threatinator/actions/run/config_spec.rb +39 -0
  344. data/spec/threatinator/actions/run/coverage_observer_spec.rb +151 -0
  345. data/spec/threatinator/actions/run/output_config_spec.rb +89 -0
  346. data/spec/threatinator/actions/run/status_observer_spec.rb +86 -0
  347. data/spec/threatinator/cli/list_action_builder_spec.rb +57 -0
  348. data/spec/threatinator/cli/run_action_builder_spec.rb +133 -0
  349. data/spec/threatinator/cli_spec.rb +175 -0
  350. data/spec/threatinator/config/base_spec.rb +39 -0
  351. data/spec/threatinator/config/feed_search_spec.rb +76 -0
  352. data/spec/threatinator/decoders/gzip_spec.rb +75 -0
  353. data/spec/threatinator/event_builder_spec.rb +123 -0
  354. data/spec/threatinator/event_spec.rb +254 -0
  355. data/spec/threatinator/event_spec.rb.new +319 -0
  356. data/spec/threatinator/feed_builder_spec.rb +633 -0
  357. data/spec/threatinator/feed_registry_spec.rb +198 -0
  358. data/spec/threatinator/feed_runner_spec.rb +372 -0
  359. data/spec/threatinator/feed_spec.rb +169 -0
  360. data/spec/threatinator/fetcher_spec.rb +12 -0
  361. data/spec/threatinator/fetchers/http_spec.rb +32 -0
  362. data/spec/threatinator/filter_spec.rb +13 -0
  363. data/spec/threatinator/filters/block_spec.rb +16 -0
  364. data/spec/threatinator/filters/comments_spec.rb +13 -0
  365. data/spec/threatinator/filters/whitespace_spec.rb +12 -0
  366. data/spec/threatinator/logger_spec.rb +29 -0
  367. data/spec/threatinator/model/observables/fqdn_collection_spec.rb +41 -0
  368. data/spec/threatinator/model/observables/ipv4_collection_spec.rb +36 -0
  369. data/spec/threatinator/model/observables/ipv4_spec.rb +75 -0
  370. data/spec/threatinator/model/observables/url_collection_spec.rb +45 -0
  371. data/spec/threatinator/model/validations/type_spec.rb +37 -0
  372. data/spec/threatinator/parser_spec.rb +13 -0
  373. data/spec/threatinator/parsers/csv/parser_spec.rb +202 -0
  374. data/spec/threatinator/parsers/getline/parser_spec.rb +83 -0
  375. data/spec/threatinator/parsers/json/parser_spec.rb +106 -0
  376. data/spec/threatinator/parsers/json/record_spec.rb +30 -0
  377. data/spec/threatinator/parsers/xml/node_spec.rb +335 -0
  378. data/spec/threatinator/parsers/xml/parser_spec.rb +263 -0
  379. data/spec/threatinator/parsers/xml/path_spec.rb +209 -0
  380. data/spec/threatinator/parsers/xml/pattern_spec.rb +72 -0
  381. data/spec/threatinator/parsers/xml/record_spec.rb +27 -0
  382. data/spec/threatinator/plugin_loader_spec.rb +238 -0
  383. data/spec/threatinator/plugins/output/csv_spec.rb +47 -0
  384. data/spec/threatinator/plugins/output/null_spec.rb +17 -0
  385. data/spec/threatinator/plugins/output/rubydebug_spec.rb +37 -0
  386. data/spec/threatinator/record_spec.rb +19 -0
  387. data/spec/threatinator/registry_spec.rb +97 -0
  388. data/spec/threatinator/runner_spec.rb +273 -0
  389. metadata +674 -0
metadata ADDED
@@ -0,0 +1,674 @@
1
+ --- !ruby/object:Gem::Specification
2
+ name: shadowbq-threatinator
3
+ version: !ruby/object:Gem::Version
4
+ version: 0.5.0
5
+ platform: ruby
6
+ authors:
7
+ - Mike Ryan
8
+ - Pierre Lamy
9
+ - Scott MacGregor
10
+ autorequire:
11
+ bindir: bin
12
+ cert_chain: []
13
+ date: 2016-10-25 00:00:00.000000000 Z
14
+ dependencies:
15
+ - !ruby/object:Gem::Dependency
16
+ name: typhoeus
17
+ requirement: !ruby/object:Gem::Requirement
18
+ requirements:
19
+ - - "~>"
20
+ - !ruby/object:Gem::Version
21
+ version: 0.6.0
22
+ type: :runtime
23
+ prerelease: false
24
+ version_requirements: !ruby/object:Gem::Requirement
25
+ requirements:
26
+ - - "~>"
27
+ - !ruby/object:Gem::Version
28
+ version: 0.6.0
29
+ - !ruby/object:Gem::Dependency
30
+ name: nokogiri
31
+ requirement: !ruby/object:Gem::Requirement
32
+ requirements:
33
+ - - "~>"
34
+ - !ruby/object:Gem::Version
35
+ version: '1.6'
36
+ type: :runtime
37
+ prerelease: false
38
+ version_requirements: !ruby/object:Gem::Requirement
39
+ requirements:
40
+ - - "~>"
41
+ - !ruby/object:Gem::Version
42
+ version: '1.6'
43
+ - !ruby/object:Gem::Dependency
44
+ name: docile
45
+ requirement: !ruby/object:Gem::Requirement
46
+ requirements:
47
+ - - "~>"
48
+ - !ruby/object:Gem::Version
49
+ version: '1.1'
50
+ type: :runtime
51
+ prerelease: false
52
+ version_requirements: !ruby/object:Gem::Requirement
53
+ requirements:
54
+ - - "~>"
55
+ - !ruby/object:Gem::Version
56
+ version: '1.1'
57
+ - !ruby/object:Gem::Dependency
58
+ name: virtus
59
+ requirement: !ruby/object:Gem::Requirement
60
+ requirements:
61
+ - - "~>"
62
+ - !ruby/object:Gem::Version
63
+ version: '1.0'
64
+ type: :runtime
65
+ prerelease: false
66
+ version_requirements: !ruby/object:Gem::Requirement
67
+ requirements:
68
+ - - "~>"
69
+ - !ruby/object:Gem::Version
70
+ version: '1.0'
71
+ - !ruby/object:Gem::Dependency
72
+ name: gli
73
+ requirement: !ruby/object:Gem::Requirement
74
+ requirements:
75
+ - - "~>"
76
+ - !ruby/object:Gem::Version
77
+ version: '2.12'
78
+ type: :runtime
79
+ prerelease: false
80
+ version_requirements: !ruby/object:Gem::Requirement
81
+ requirements:
82
+ - - "~>"
83
+ - !ruby/object:Gem::Version
84
+ version: '2.12'
85
+ - !ruby/object:Gem::Dependency
86
+ name: activemodel
87
+ requirement: !ruby/object:Gem::Requirement
88
+ requirements:
89
+ - - "~>"
90
+ - !ruby/object:Gem::Version
91
+ version: '4.0'
92
+ type: :runtime
93
+ prerelease: false
94
+ version_requirements: !ruby/object:Gem::Requirement
95
+ requirements:
96
+ - - "~>"
97
+ - !ruby/object:Gem::Version
98
+ version: '4.0'
99
+ - !ruby/object:Gem::Dependency
100
+ name: equalizer
101
+ requirement: !ruby/object:Gem::Requirement
102
+ requirements:
103
+ - - "~>"
104
+ - !ruby/object:Gem::Version
105
+ version: 0.0.10
106
+ type: :runtime
107
+ prerelease: false
108
+ version_requirements: !ruby/object:Gem::Requirement
109
+ requirements:
110
+ - - "~>"
111
+ - !ruby/object:Gem::Version
112
+ version: 0.0.10
113
+ - !ruby/object:Gem::Dependency
114
+ name: addressable
115
+ requirement: !ruby/object:Gem::Requirement
116
+ requirements:
117
+ - - "~>"
118
+ - !ruby/object:Gem::Version
119
+ version: '2.3'
120
+ type: :runtime
121
+ prerelease: false
122
+ version_requirements: !ruby/object:Gem::Requirement
123
+ requirements:
124
+ - - "~>"
125
+ - !ruby/object:Gem::Version
126
+ version: '2.3'
127
+ - !ruby/object:Gem::Dependency
128
+ name: log4r
129
+ requirement: !ruby/object:Gem::Requirement
130
+ requirements:
131
+ - - "~>"
132
+ - !ruby/object:Gem::Version
133
+ version: '1.1'
134
+ type: :runtime
135
+ prerelease: false
136
+ version_requirements: !ruby/object:Gem::Requirement
137
+ requirements:
138
+ - - "~>"
139
+ - !ruby/object:Gem::Version
140
+ version: '1.1'
141
+ - !ruby/object:Gem::Dependency
142
+ name: ruby-ip
143
+ requirement: !ruby/object:Gem::Requirement
144
+ requirements:
145
+ - - "~>"
146
+ - !ruby/object:Gem::Version
147
+ version: 0.9.3
148
+ type: :runtime
149
+ prerelease: false
150
+ version_requirements: !ruby/object:Gem::Requirement
151
+ requirements:
152
+ - - "~>"
153
+ - !ruby/object:Gem::Version
154
+ version: 0.9.3
155
+ - !ruby/object:Gem::Dependency
156
+ name: bunny
157
+ requirement: !ruby/object:Gem::Requirement
158
+ requirements:
159
+ - - "~>"
160
+ - !ruby/object:Gem::Version
161
+ version: '2.5'
162
+ type: :runtime
163
+ prerelease: false
164
+ version_requirements: !ruby/object:Gem::Requirement
165
+ requirements:
166
+ - - "~>"
167
+ - !ruby/object:Gem::Version
168
+ version: '2.5'
169
+ - !ruby/object:Gem::Dependency
170
+ name: domain_name_validator
171
+ requirement: !ruby/object:Gem::Requirement
172
+ requirements:
173
+ - - "~>"
174
+ - !ruby/object:Gem::Version
175
+ version: '0.5'
176
+ type: :runtime
177
+ prerelease: false
178
+ version_requirements: !ruby/object:Gem::Requirement
179
+ requirements:
180
+ - - "~>"
181
+ - !ruby/object:Gem::Version
182
+ version: '0.5'
183
+ - !ruby/object:Gem::Dependency
184
+ name: oj
185
+ requirement: !ruby/object:Gem::Requirement
186
+ requirements:
187
+ - - "~>"
188
+ - !ruby/object:Gem::Version
189
+ version: '2.9'
190
+ type: :runtime
191
+ prerelease: false
192
+ version_requirements: !ruby/object:Gem::Requirement
193
+ requirements:
194
+ - - "~>"
195
+ - !ruby/object:Gem::Version
196
+ version: '2.9'
197
+ - !ruby/object:Gem::Dependency
198
+ name: jeweler
199
+ requirement: !ruby/object:Gem::Requirement
200
+ requirements:
201
+ - - "~>"
202
+ - !ruby/object:Gem::Version
203
+ version: '2.0'
204
+ type: :development
205
+ prerelease: false
206
+ version_requirements: !ruby/object:Gem::Requirement
207
+ requirements:
208
+ - - "~>"
209
+ - !ruby/object:Gem::Version
210
+ version: '2.0'
211
+ - !ruby/object:Gem::Dependency
212
+ name: pry
213
+ requirement: !ruby/object:Gem::Requirement
214
+ requirements:
215
+ - - "~>"
216
+ - !ruby/object:Gem::Version
217
+ version: 0.10.0
218
+ type: :development
219
+ prerelease: false
220
+ version_requirements: !ruby/object:Gem::Requirement
221
+ requirements:
222
+ - - "~>"
223
+ - !ruby/object:Gem::Version
224
+ version: 0.10.0
225
+ - !ruby/object:Gem::Dependency
226
+ name: pry-rescue
227
+ requirement: !ruby/object:Gem::Requirement
228
+ requirements:
229
+ - - ">="
230
+ - !ruby/object:Gem::Version
231
+ version: '0'
232
+ type: :development
233
+ prerelease: false
234
+ version_requirements: !ruby/object:Gem::Requirement
235
+ requirements:
236
+ - - ">="
237
+ - !ruby/object:Gem::Version
238
+ version: '0'
239
+ - !ruby/object:Gem::Dependency
240
+ name: pry-stack_explorer
241
+ requirement: !ruby/object:Gem::Requirement
242
+ requirements:
243
+ - - ">="
244
+ - !ruby/object:Gem::Version
245
+ version: '0'
246
+ type: :development
247
+ prerelease: false
248
+ version_requirements: !ruby/object:Gem::Requirement
249
+ requirements:
250
+ - - ">="
251
+ - !ruby/object:Gem::Version
252
+ version: '0'
253
+ description: This is a fork of the cikl/threatinator project
254
+ email: shadowbq@gmail.com
255
+ executables:
256
+ - threatinator
257
+ - threatinator_loader
258
+ extensions: []
259
+ extra_rdoc_files:
260
+ - LICENSE
261
+ - README.md
262
+ files:
263
+ - CHANGELOG.md
264
+ - CONTRIBUTING.md
265
+ - Gemfile
266
+ - LICENSE
267
+ - README.md
268
+ - Rakefile
269
+ - VERSION
270
+ - bin/threatinator
271
+ - bin/threatinator_loader
272
+ - feeds/ET_block-ip_reputation.feed
273
+ - feeds/ET_compromised-ip_reputation.feed
274
+ - feeds/ET_openbadlist-ip_reputation.feed
275
+ - feeds/alienvault-ip_reputation.feed
276
+ - feeds/arbor_fastflux-domain_reputation.feed
277
+ - feeds/arbor_ssh-ip_reputation.feed
278
+ - feeds/autoshun_shunlist.feed
279
+ - feeds/bambenek_c2_masterlist-domain_reputation.feed
280
+ - feeds/bambenek_c2_masterlist-ip_reputation.feed
281
+ - feeds/bambenek_dga_feed-domain_reputation.feed
282
+ - feeds/berkeley-ip_reputation.feed
283
+ - feeds/bitcash_cz_blacklist.feed
284
+ - feeds/blocklist_de_apache-ip_reputation.feed
285
+ - feeds/blocklist_de_bots-ip_reputation.feed
286
+ - feeds/blocklist_de_ftp-ip_reputation.feed
287
+ - feeds/blocklist_de_imap-ip_reputation.feed
288
+ - feeds/blocklist_de_pop3-ip_reputation.feed
289
+ - feeds/blocklist_de_proftpd-ip_reputation.feed
290
+ - feeds/blocklist_de_sip-ip_reputation.feed
291
+ - feeds/blocklist_de_ssh-ip_reputation.feed
292
+ - feeds/blocklist_de_strongips-ip_reputation.feed
293
+ - feeds/botscout-ip_reputation.feed
294
+ - feeds/cert_mxpoison-ip_reputation.feed
295
+ - feeds/chaosreigns-ip_reputation.feed
296
+ - feeds/ciarmy-ip_reputation.feed
297
+ - feeds/cruzit-ip_reputation.feed
298
+ - feeds/cydef_torexit-ip_reputation.feed
299
+ - feeds/dan_me_uk_torlist-ip_reputation.feed
300
+ - feeds/danger_bruteforce-ip_reputation.feed
301
+ - feeds/dshield_attackers-top1000.feed
302
+ - feeds/falconcrest-ip_reputation.feed
303
+ - feeds/feodo-domain_reputation.feed
304
+ - feeds/feodo-ip_reputation.feed
305
+ - feeds/h3x_asprox.feed
306
+ - feeds/hosts-file_hphostspartial-domain_reputation.feed
307
+ - feeds/infiltrated-ip_reputation.feed
308
+ - feeds/infiltrated_vabl-ip_reputation.feed
309
+ - feeds/isc_suspicious_high-domain_reputation.feed
310
+ - feeds/isc_suspicious_low-domain_reputation.feed
311
+ - feeds/isc_suspicious_medium-domain_reputation.feed
312
+ - feeds/malc0de-domain_reputation.feed
313
+ - feeds/malc0de-ip_reputation.feed
314
+ - feeds/malwaredomainlist-url_reputation.feed
315
+ - feeds/malwaredomains-domain_reputation.feed
316
+ - feeds/malwaredomains_dyndns-domain_reputation.feed
317
+ - feeds/malwaredomains_justdomains-domain_reputation.feed
318
+ - feeds/mirc-domain_reputation.feed
319
+ - feeds/multiproxy-ip_reputation.feed
320
+ - feeds/nothink_irc-ip_reputation.feed
321
+ - feeds/nothink_ssh-ip_reputation.feed
322
+ - feeds/openbl-ip_reputation.feed
323
+ - feeds/openphish-url_reputation.feed
324
+ - feeds/packetmail_perimeterbad-ip_reputation.feed
325
+ - feeds/palevo-domain_reputation.feed
326
+ - feeds/palevo-ip_reputation.feed
327
+ - feeds/phishtank.feed
328
+ - feeds/sigmaproject_atma.feed
329
+ - feeds/sigmaproject_spyware.feed
330
+ - feeds/sigmaproject_webexploit.feed
331
+ - feeds/snort_bpf-ip_reputation.feed
332
+ - feeds/spyeye-domain_reputation.feed
333
+ - feeds/spyeye-ip_reputation.feed
334
+ - feeds/steeman-ip_reputation.feed
335
+ - feeds/t-arend-de_ssh-ip_reputation.feed
336
+ - feeds/the_haleys_ssh-ip_reputation.feed
337
+ - feeds/trustedsec-ip_reputation.feed
338
+ - feeds/virbl-ip_reputation.feed
339
+ - feeds/vxvault-url_reputation.feed
340
+ - feeds/yourcmc_ssh-ip_reputation.feed
341
+ - feeds/yoyo_adservers-domain_reputation.feed
342
+ - feeds/zeus-domain_reputation.feed
343
+ - feeds/zeus-ip_reputation.feed
344
+ - lib/threatinator.rb
345
+ - lib/threatinator/action.rb
346
+ - lib/threatinator/actions/list.rb
347
+ - lib/threatinator/actions/list/action.rb
348
+ - lib/threatinator/actions/list/config.rb
349
+ - lib/threatinator/actions/run.rb
350
+ - lib/threatinator/actions/run/action.rb
351
+ - lib/threatinator/actions/run/config.rb
352
+ - lib/threatinator/actions/run/coverage_observer.rb
353
+ - lib/threatinator/actions/run/output_config.rb
354
+ - lib/threatinator/actions/run/status_observer.rb
355
+ - lib/threatinator/cli.rb
356
+ - lib/threatinator/cli/action_builder.rb
357
+ - lib/threatinator/cli/list_action_builder.rb
358
+ - lib/threatinator/cli/parser.rb
359
+ - lib/threatinator/cli/run_action_builder.rb
360
+ - lib/threatinator/config.rb
361
+ - lib/threatinator/config/base.rb
362
+ - lib/threatinator/config/feed_search.rb
363
+ - lib/threatinator/config/logger.rb
364
+ - lib/threatinator/decoder.rb
365
+ - lib/threatinator/decoders/gzip.rb
366
+ - lib/threatinator/event.rb
367
+ - lib/threatinator/event_builder.rb
368
+ - lib/threatinator/exceptions.rb
369
+ - lib/threatinator/feed.rb
370
+ - lib/threatinator/feed_builder.rb
371
+ - lib/threatinator/feed_registry.rb
372
+ - lib/threatinator/feed_runner.rb
373
+ - lib/threatinator/fetcher.rb
374
+ - lib/threatinator/fetchers/http.rb
375
+ - lib/threatinator/filter.rb
376
+ - lib/threatinator/filters/block.rb
377
+ - lib/threatinator/filters/comments.rb
378
+ - lib/threatinator/filters/whitespace.rb
379
+ - lib/threatinator/logger.rb
380
+ - lib/threatinator/logging.rb
381
+ - lib/threatinator/model/base.rb
382
+ - lib/threatinator/model/collection.rb
383
+ - lib/threatinator/model/observables/fqdn_collection.rb
384
+ - lib/threatinator/model/observables/ipv4.rb
385
+ - lib/threatinator/model/observables/ipv4_collection.rb
386
+ - lib/threatinator/model/observables/url_collection.rb
387
+ - lib/threatinator/model/validations.rb
388
+ - lib/threatinator/model/validations/type.rb
389
+ - lib/threatinator/output.rb
390
+ - lib/threatinator/parser.rb
391
+ - lib/threatinator/parsers/csv.rb
392
+ - lib/threatinator/parsers/csv/parser.rb
393
+ - lib/threatinator/parsers/getline.rb
394
+ - lib/threatinator/parsers/getline/parser.rb
395
+ - lib/threatinator/parsers/json.rb
396
+ - lib/threatinator/parsers/json/adapters/oj.rb
397
+ - lib/threatinator/parsers/json/parser.rb
398
+ - lib/threatinator/parsers/json/record.rb
399
+ - lib/threatinator/parsers/xml.rb
400
+ - lib/threatinator/parsers/xml/node.rb
401
+ - lib/threatinator/parsers/xml/node_builder.rb
402
+ - lib/threatinator/parsers/xml/parser.rb
403
+ - lib/threatinator/parsers/xml/path.rb
404
+ - lib/threatinator/parsers/xml/pattern.rb
405
+ - lib/threatinator/parsers/xml/record.rb
406
+ - lib/threatinator/parsers/xml/sax_document.rb
407
+ - lib/threatinator/plugin_loader.rb
408
+ - lib/threatinator/plugins/output/amqp.rb
409
+ - lib/threatinator/plugins/output/amqp/config.rb
410
+ - lib/threatinator/plugins/output/csv.rb
411
+ - lib/threatinator/plugins/output/json.rb
412
+ - lib/threatinator/plugins/output/json/config.rb
413
+ - lib/threatinator/plugins/output/null.rb
414
+ - lib/threatinator/plugins/output/rubydebug.rb
415
+ - lib/threatinator/record.rb
416
+ - lib/threatinator/registry.rb
417
+ - lib/threatinator/util.rb
418
+ - spec/feeds/ET_block-ip_reputation_spec.rb
419
+ - spec/feeds/ET_compromised-ip_reputation_spec.rb
420
+ - spec/feeds/ET_openbadlist-ip_reputation_spec.rb
421
+ - spec/feeds/alienvault-ip_reputation_spec.rb
422
+ - spec/feeds/arbor_fastflux-domain_reputation_spec.rb
423
+ - spec/feeds/arbor_ssh-ip_reputation_spec.rb
424
+ - spec/feeds/autoshun_shunlist_spec.rb
425
+ - spec/feeds/bambenek_c2_masterlist-domain_reputation_spec.rb
426
+ - spec/feeds/bambenek_c2_masterlist-ip_reputation_spec.rb
427
+ - spec/feeds/bambenek_dga_feed-domain_reputation_spec.rb
428
+ - spec/feeds/berkeley-ip_reputation_spec.rb
429
+ - spec/feeds/bitcash_cz_blacklist-ip_reputation_spec.rb
430
+ - spec/feeds/blocklist_de_apache-ip_reputation_spec.rb
431
+ - spec/feeds/blocklist_de_bots-ip_reputation_spec.rb
432
+ - spec/feeds/blocklist_de_ftp-ip_reputation_spec.rb
433
+ - spec/feeds/blocklist_de_imap-ip_reputation_spec.rb
434
+ - spec/feeds/blocklist_de_pop3-ip_reputation_spec.rb
435
+ - spec/feeds/blocklist_de_proftpd-ip_reputation_spec.rb
436
+ - spec/feeds/blocklist_de_sip-ip_reputation_spec.rb
437
+ - spec/feeds/blocklist_de_ssh-ip_reputation_spec.rb
438
+ - spec/feeds/blocklist_de_strongips-ip_reputation_spec.rb
439
+ - spec/feeds/botscout-ip_reputation_spec.rb
440
+ - spec/feeds/cert_mxpoison-ip_reputation_spec.rb
441
+ - spec/feeds/chaosreigns-ip_reputation_spec.rb
442
+ - spec/feeds/ciarmy-ip_reputation_spec.rb
443
+ - spec/feeds/cruzit-ip_reputation_spec.rb
444
+ - spec/feeds/cydef_torexit-ip_reputation_spec.rb
445
+ - spec/feeds/dan_me_uk_torlist-ip_reputation_spec.rb
446
+ - spec/feeds/danger_bruteforce-ip_reputation_spec.rb
447
+ - spec/feeds/data/ET_block-ip_reputation.txt
448
+ - spec/feeds/data/ET_compromised-ip_reputation.txt
449
+ - spec/feeds/data/ET_openbadlist-ip_reputation.txt
450
+ - spec/feeds/data/alienvault-ip_reputation.txt
451
+ - spec/feeds/data/arbor_domainlist.txt
452
+ - spec/feeds/data/arbor_ssh.txt
453
+ - spec/feeds/data/autoshun_shunlist.csv
454
+ - spec/feeds/data/bambenek_c2-dommasterlist.csv
455
+ - spec/feeds/data/bambenek_c2-ipmasterlist.csv
456
+ - spec/feeds/data/bambenek_dga_feed.csv
457
+ - spec/feeds/data/berkeley.txt
458
+ - spec/feeds/data/bitcash_cz_blacklist.txt
459
+ - spec/feeds/data/blocklist_de_apache-ip-reputation.txt
460
+ - spec/feeds/data/blocklist_de_bots-ip-reputation.txt
461
+ - spec/feeds/data/blocklist_de_ftp-ip-reputation.txt
462
+ - spec/feeds/data/blocklist_de_imap-ip-reputation.txt
463
+ - spec/feeds/data/blocklist_de_pop3-ip-reputation.txt
464
+ - spec/feeds/data/blocklist_de_proftpd-ip-reputation.txt
465
+ - spec/feeds/data/blocklist_de_sip-ip-reputation.txt
466
+ - spec/feeds/data/blocklist_de_ssh-ip-reputation.txt
467
+ - spec/feeds/data/blocklist_de_strongips-ip-reputation.txt
468
+ - spec/feeds/data/botscout-ip-reputation.txt
469
+ - spec/feeds/data/cert_mxpoison-ip_reputation.txt
470
+ - spec/feeds/data/chaosreigns-ip-reputation.txt
471
+ - spec/feeds/data/ciarmy-ip-reputation.txt
472
+ - spec/feeds/data/cruzit-ip-reputation.txt
473
+ - spec/feeds/data/cydef_torexit-ip_reputation.txt
474
+ - spec/feeds/data/dan_me_uk_torlist-ip-reputation.txt
475
+ - spec/feeds/data/danger_bruteforce-ip_reputation.txt
476
+ - spec/feeds/data/dshield_topattackers.xml
477
+ - spec/feeds/data/falconcrest_iplist.txt
478
+ - spec/feeds/data/feodo_domainlist.txt
479
+ - spec/feeds/data/feodo_iplist.txt
480
+ - spec/feeds/data/h3x_asprox.txt
481
+ - spec/feeds/data/hosts-file_hphostspartial_domainlist.txt
482
+ - spec/feeds/data/infiltrated_iplist.txt
483
+ - spec/feeds/data/infiltrated_vabl_iplist.txt
484
+ - spec/feeds/data/isc_suspicious_high_domainlist.txt
485
+ - spec/feeds/data/isc_suspicious_low_domainlist.txt
486
+ - spec/feeds/data/isc_suspicious_medium_domainlist.txt
487
+ - spec/feeds/data/malc0de_domainlist.txt
488
+ - spec/feeds/data/malc0de_iplist.txt
489
+ - spec/feeds/data/malwaredomainlist-url-reputation.txt
490
+ - spec/feeds/data/malwaredomains_domainlist.txt
491
+ - spec/feeds/data/malwaredomains_dyndns_domainlist.txt
492
+ - spec/feeds/data/malwaredomains_justdomains_domainlist.txt
493
+ - spec/feeds/data/mirc_domainlist.txt
494
+ - spec/feeds/data/multiproxy_iplist.txt
495
+ - spec/feeds/data/nothink_irc_iplist.txt
496
+ - spec/feeds/data/nothink_ssh_iplist.txt
497
+ - spec/feeds/data/openbl_iplist.txt
498
+ - spec/feeds/data/openphish-url-reputation.txt
499
+ - spec/feeds/data/packetmail_perimeterbad-ip_reputation.txt
500
+ - spec/feeds/data/palevo_domainlist.txt
501
+ - spec/feeds/data/palevo_iplist.txt
502
+ - spec/feeds/data/phishtank-sample.json.gz
503
+ - spec/feeds/data/sigmaproject_atma.return.gz
504
+ - spec/feeds/data/sigmaproject_spyware.return.gz
505
+ - spec/feeds/data/sigmaproject_webexploit.return.gz
506
+ - spec/feeds/data/snort_bpf-ip_reputation.txt
507
+ - spec/feeds/data/spyeye_domainlist.txt
508
+ - spec/feeds/data/spyeye_iplist.txt
509
+ - spec/feeds/data/steeman-ip-reputation.txt
510
+ - spec/feeds/data/t-arend-de_ssh_iplist.txt
511
+ - spec/feeds/data/the_haleys_ssh_iplist.txt
512
+ - spec/feeds/data/trustedsec-ip-reputation.txt
513
+ - spec/feeds/data/valid.json
514
+ - spec/feeds/data/virbl-ip_reputation.txt
515
+ - spec/feeds/data/vxvault-url-reputation.txt
516
+ - spec/feeds/data/yourcmc_ssh-ip_reputation.txt
517
+ - spec/feeds/data/yoyo_adservers.txt
518
+ - spec/feeds/data/zeus-ip_reputation.txt
519
+ - spec/feeds/data/zeus_domainlist.txt
520
+ - spec/feeds/dshield_attackers-top1000_spec.rb
521
+ - spec/feeds/falconcrest-ip_reputation_spec.rb
522
+ - spec/feeds/feodo-domain_reputation_spec.rb
523
+ - spec/feeds/feodo-ip_reputation_spec.rb
524
+ - spec/feeds/h3x_asprox-ip_reputation_spec.rb
525
+ - spec/feeds/hosts-file_hphostspartial-domain_reputation_spec.rb
526
+ - spec/feeds/infiltrated-ip_reputation_spec.rb
527
+ - spec/feeds/infiltrated_vabl-ip_reputation_spec.rb
528
+ - spec/feeds/isc_suspicious_high-domain_reputation_spec.rb
529
+ - spec/feeds/isc_suspicious_low-domain_reputation_spec.rb
530
+ - spec/feeds/isc_suspicious_medium-domain_reputation_spec.rb
531
+ - spec/feeds/malc0de-domain_reputation_spec.rb
532
+ - spec/feeds/malc0de-ip_reputation_spec.rb
533
+ - spec/feeds/malwaredomainlist_url_reputation_spec.rb
534
+ - spec/feeds/malwaredomains-domain_reputation_spec.rb
535
+ - spec/feeds/malwaredomains_dyndns-domain_reputation_spec.rb
536
+ - spec/feeds/malwaredomains_justdomains-domain_reputation_spec.rb
537
+ - spec/feeds/mirc-domain_reputation_spec.rb
538
+ - spec/feeds/multiproxy-ip_reputation_spec.rb
539
+ - spec/feeds/nothink_irc-ip_reputation_spec.rb
540
+ - spec/feeds/nothink_ssh-ip_reputation_spec.rb
541
+ - spec/feeds/openbl-ip_reputation_spec.rb
542
+ - spec/feeds/openphish_url_reputation_spec.rb
543
+ - spec/feeds/packetmail_perimeterbad-ip_reputation_spec.rb
544
+ - spec/feeds/palevo-domain_reputation_spec.rb
545
+ - spec/feeds/palevo-ip_reputation_spec.rb
546
+ - spec/feeds/phishtank_spec.rb
547
+ - spec/feeds/sigmaproject_atma_spec.rb
548
+ - spec/feeds/sigmaproject_spyware_spec.rb
549
+ - spec/feeds/sigmaproject_webexploit_spec.rb
550
+ - spec/feeds/snort_bpf-ip_reputation_spec.rb
551
+ - spec/feeds/spyeye-domain_reputation_spec.rb
552
+ - spec/feeds/spyeye-ip_reputation_spec.rb
553
+ - spec/feeds/steeman-ip_reputation_spec.rb
554
+ - spec/feeds/t-arend-de_ssh-ip_reputation_spec.rb
555
+ - spec/feeds/the_haleys_ssh-ip_reputation_spec.rb
556
+ - spec/feeds/trustedsec-ip_reputation_spec.rb
557
+ - spec/feeds/virbl-ip_reputation_spec.rb
558
+ - spec/feeds/vxvault_url_reputation_spec.rb
559
+ - spec/feeds/yourcmc_ssh-ip_reputation_spec.rb
560
+ - spec/feeds/yoyo_adservers_spec.rb
561
+ - spec/feeds/zeus-domain_reputation_spec.rb
562
+ - spec/feeds/zeus-ip_reputation_spec.rb
563
+ - spec/fixtures/feed/provider1/feed1.feed
564
+ - spec/fixtures/parsers/test.xml
565
+ - spec/fixtures/parsers/test_self_closing.xml
566
+ - spec/fixtures/plugins/bad/threatinator/plugins/test_error1/plugin.rb
567
+ - spec/fixtures/plugins/bad/threatinator/plugins/test_missing1/plugin.rb
568
+ - spec/fixtures/plugins/fake.rb
569
+ - spec/fixtures/plugins/good/threatinator/plugins/test_type1/plugin_a.rb
570
+ - spec/fixtures/plugins/good/threatinator/plugins/test_type1/plugin_b.rb
571
+ - spec/fixtures/plugins/good/threatinator/plugins/test_type2/plugin_c.rb
572
+ - spec/fixtures/plugins/good/threatinator/plugins/test_type2/plugin_d.rb
573
+ - spec/fixtures/plugins/good/threatinator/plugins/test_type3/plugin_e.rb
574
+ - spec/fixtures/plugins/good/threatinator/plugins/test_type3/plugin_f.rb
575
+ - spec/spec_helper.rb
576
+ - spec/support/bad_feeds/missing_fetcher.feed
577
+ - spec/support/bad_feeds/missing_name.feed
578
+ - spec/support/bad_feeds/missing_parser.feed
579
+ - spec/support/bad_feeds/missing_provider.feed
580
+ - spec/support/factories/event.rb
581
+ - spec/support/factories/feed.rb
582
+ - spec/support/factories/feed_builder.rb
583
+ - spec/support/factories/feed_registry.rb
584
+ - spec/support/factories/ipv4.rb
585
+ - spec/support/factories/output.rb
586
+ - spec/support/factories/record.rb
587
+ - spec/support/factories/url.rb
588
+ - spec/support/factories/xml_node.rb
589
+ - spec/support/helpers/io.rb
590
+ - spec/support/helpers/models.rb
591
+ - spec/support/shared/action_builder.rb
592
+ - spec/support/shared/decoder.rb
593
+ - spec/support/shared/feed_runner_observer.rb
594
+ - spec/support/shared/feeds.rb
595
+ - spec/support/shared/fetcher.rb
596
+ - spec/support/shared/filter.rb
597
+ - spec/support/shared/io-like.rb
598
+ - spec/support/shared/model/collection.rb
599
+ - spec/support/shared/output.rb
600
+ - spec/support/shared/parsers.rb
601
+ - spec/support/shared/record.rb
602
+ - spec/threatinator/actions/list/action_spec.rb
603
+ - spec/threatinator/actions/run/action_spec.rb
604
+ - spec/threatinator/actions/run/config_spec.rb
605
+ - spec/threatinator/actions/run/coverage_observer_spec.rb
606
+ - spec/threatinator/actions/run/output_config_spec.rb
607
+ - spec/threatinator/actions/run/status_observer_spec.rb
608
+ - spec/threatinator/cli/list_action_builder_spec.rb
609
+ - spec/threatinator/cli/run_action_builder_spec.rb
610
+ - spec/threatinator/cli_spec.rb
611
+ - spec/threatinator/config/base_spec.rb
612
+ - spec/threatinator/config/feed_search_spec.rb
613
+ - spec/threatinator/decoders/gzip_spec.rb
614
+ - spec/threatinator/event_builder_spec.rb
615
+ - spec/threatinator/event_spec.rb
616
+ - spec/threatinator/event_spec.rb.new
617
+ - spec/threatinator/feed_builder_spec.rb
618
+ - spec/threatinator/feed_registry_spec.rb
619
+ - spec/threatinator/feed_runner_spec.rb
620
+ - spec/threatinator/feed_spec.rb
621
+ - spec/threatinator/fetcher_spec.rb
622
+ - spec/threatinator/fetchers/http_spec.rb
623
+ - spec/threatinator/filter_spec.rb
624
+ - spec/threatinator/filters/block_spec.rb
625
+ - spec/threatinator/filters/comments_spec.rb
626
+ - spec/threatinator/filters/whitespace_spec.rb
627
+ - spec/threatinator/logger_spec.rb
628
+ - spec/threatinator/model/observables/fqdn_collection_spec.rb
629
+ - spec/threatinator/model/observables/ipv4_collection_spec.rb
630
+ - spec/threatinator/model/observables/ipv4_spec.rb
631
+ - spec/threatinator/model/observables/url_collection_spec.rb
632
+ - spec/threatinator/model/validations/type_spec.rb
633
+ - spec/threatinator/parser_spec.rb
634
+ - spec/threatinator/parsers/csv/parser_spec.rb
635
+ - spec/threatinator/parsers/getline/parser_spec.rb
636
+ - spec/threatinator/parsers/json/parser_spec.rb
637
+ - spec/threatinator/parsers/json/record_spec.rb
638
+ - spec/threatinator/parsers/xml/node_spec.rb
639
+ - spec/threatinator/parsers/xml/parser_spec.rb
640
+ - spec/threatinator/parsers/xml/path_spec.rb
641
+ - spec/threatinator/parsers/xml/pattern_spec.rb
642
+ - spec/threatinator/parsers/xml/record_spec.rb
643
+ - spec/threatinator/plugin_loader_spec.rb
644
+ - spec/threatinator/plugins/output/csv_spec.rb
645
+ - spec/threatinator/plugins/output/null_spec.rb
646
+ - spec/threatinator/plugins/output/rubydebug_spec.rb
647
+ - spec/threatinator/record_spec.rb
648
+ - spec/threatinator/registry_spec.rb
649
+ - spec/threatinator/runner_spec.rb
650
+ homepage: http://github.com/shadowbq/threatinator
651
+ licenses:
652
+ - LGLv3
653
+ metadata: {}
654
+ post_install_message:
655
+ rdoc_options: []
656
+ require_paths:
657
+ - lib
658
+ required_ruby_version: !ruby/object:Gem::Requirement
659
+ requirements:
660
+ - - ">="
661
+ - !ruby/object:Gem::Version
662
+ version: '0'
663
+ required_rubygems_version: !ruby/object:Gem::Requirement
664
+ requirements:
665
+ - - ">="
666
+ - !ruby/object:Gem::Version
667
+ version: '0'
668
+ requirements: []
669
+ rubyforge_project:
670
+ rubygems_version: 2.4.8
671
+ signing_key:
672
+ specification_version: 4
673
+ summary: Shadowbq-Threatinator is a library and tool for parsing threat data feeds.
674
+ test_files: []