threatinator 0.1.1

data/spec/feeds/palevo-domain_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/palevo-domain_reputation.feed', :feed do
+  let(:provider) { 'abuse_ch' }
+  let(:name) { 'palevo_domain_reputation' }
+
+  it_fetches_url 'https://palevotracker.abuse.ch/blocklists.php?download=domainblocklist'
+
+  describe_parsing_the_file feed_data('palevo_domainlist.txt') do
+    it "should have parsed 24 records" do
+      expect(num_records_parsed).to eq(24)
+    end
+    it "should have filtered 1 records" do
+      expect(num_records_filtered).to eq(1)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record 'legionarios.servecounterstrike.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:fqdns) { is_expected.to match_array(['legionarios.servecounterstrike.com']) }
+    end
+  end
+
+  describe_parsing_a_record 's.24otuwotefsmd.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:fqdns) { is_expected.to match_array(['s.24otuwotefsmd.com']) }
+    end
+  end
+end
+
+

data/spec/feeds/palevo-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/palevo-ip_reputation.feed', :feed do
+  let(:provider) { 'abuse_ch' }
+  let(:name) { 'palevo_ip_reputation' }
+
+  it_fetches_url 'https://palevotracker.abuse.ch/blocklists.php?download=ipblocklist'
+
+  describe_parsing_the_file feed_data('palevo_iplist.txt') do
+    it "should have parsed 23 records" do
+      expect(num_records_parsed).to eq(23)
+    end
+    it "should have filtered 1 records" do
+      expect(num_records_filtered).to eq(1)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '187.214.120.147' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:ipv4s) { is_expected.to match_array(['187.214.120.147']) }
+    end
+  end
+
+  describe_parsing_a_record '67.210.170.169' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:ipv4s) { is_expected.to match_array(['67.210.170.169']) }
+    end
+  end
+end
+
+

data/spec/feeds/phishtank_spec.rb

@@ -0,0 +1,45 @@
+require 'spec_helper'
+
+describe 'feeds/phishtank.feed', :feed do
+  let(:provider) { 'phishtank' }
+  let(:name) { 'phishtank' }
+
+  it_fetches_url 'http://data.phishtank.com/data/online-valid.json.gz'
+
+  describe_parsing_the_file feed_data('phishtank-sample.json.gz') do
+    it "should have parsed 10 records" do
+      expect(num_records_parsed).to eq(10)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+
+    describe "the records" do
+      it "should total 10" do
+        expect(num_records).to eq(10)
+      end
+
+      it "each record should have generated exactly one event" do
+        counts = events.map { |event_array| event_array.count }
+        expect(counts).to eq([1,1,1,1,1,1,1,1,1,1])
+      end
+
+      describe "the event for record 0" do
+        let(:record) { records[0] }
+        let(:event) { events[0].first }
+        subject { event } 
+
+        its(:type) { is_expected.to be(:phishing) }
+        its(:ipv4s) { is_expected.to match_array(['31.14.23.213']) }
+        its(:urls) { pending "Waiting on URL support"; is_expected.to match_array(['http://poste.it-postepay4.phpblack.com/']) }
+      end
+    end
+  end
+
+end
+
+
+

data/spec/feeds/spyeye-domain_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/spyeye-domain_reputation.feed', :feed do
+  let(:provider) { 'abuse_ch' }
+  let(:name) { 'spyeye_domain_reputation' }
+
+  it_fetches_url 'https://spyeyetracker.abuse.ch/blocklist.php?download=domainblocklist'
+
+  describe_parsing_the_file feed_data('spyeye_domainlist.txt') do
+    it "should have parsed 9 records" do
+      expect(num_records_parsed).to eq(9)
+    end
+    it "should have filtered 7 records" do
+      expect(num_records_filtered).to eq(7)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record 'futuretelefonica.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:fqdns) { is_expected.to match_array(["futuretelefonica.com"]) }
+    end
+  end
+
+  describe_parsing_a_record 'helen33nasanorth.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:fqdns) { is_expected.to match_array(["helen33nasanorth.com"]) }
+    end
+  end
+end
+
+

data/spec/feeds/spyeye-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/spyeye-ip_reputation.feed', :feed do
+  let(:provider) { 'abuse_ch' }
+  let(:name) { 'spyeye_ip_reputation' }
+
+  it_fetches_url 'https://spyeyetracker.abuse.ch/blocklist.php?download=ipblocklist'
+
+  describe_parsing_the_file feed_data('spyeye_iplist.txt') do
+    it "should have parsed 12 records" do
+      expect(num_records_parsed).to eq(12)
+    end
+    it "should have filtered 7 records" do
+      expect(num_records_filtered).to eq(7)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '188.190.126.173' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:ipv4s) { is_expected.to match_array(['188.190.126.173']) }
+    end
+  end
+
+  describe_parsing_a_record '91.220.62.190' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:ipv4s) { is_expected.to match_array(['91.220.62.190']) }
+    end
+  end
+end
+
+

data/spec/feeds/t-arend-de_ssh-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/t-arend-de_ssh-ip_reputation.feed', :feed do
+  let(:provider) { 't-arend-de' }
+  let(:name) { 'ssh_ip_reputation' }
+
+  it_fetches_url 'http://www.t-arend.de/linux/badguys.txt'
+
+  describe_parsing_the_file feed_data('t-arend-de_ssh_iplist.txt') do
+    it "should have parsed 14 records" do
+      expect(num_records_parsed).to eq(14)
+    end
+    it "should have filtered 3 records" do
+      expect(num_records_filtered).to eq(3)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record 'sshd: 121.15.167.243' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:ipv4s) { is_expected.to match_array(['121.15.167.243']) }
+    end
+  end
+
+  describe_parsing_a_record 'sshd: 122.224.128.222' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:ipv4s) { is_expected.to match_array(['122.224.128.222']) }
+    end
+  end
+end
+
+

data/spec/feeds/the_haleys_ssh-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/the_haleys_ssh-ip_reputation.feed', :feed do
+  let(:provider) { 'the_haleys' }
+  let(:name) { 'ssh_ip_reputation' }
+
+  it_fetches_url 'http://charles.the-haleys.org/ssh_dico_attack_hdeny_format.php/hostsdeny.txt'
+
+  describe_parsing_the_file feed_data('the_haleys_ssh_iplist.txt') do
+    it "should have parsed 11 records" do
+      expect(num_records_parsed).to eq(11)
+    end
+    it "should have filtered 1 records" do
+      expect(num_records_filtered).to eq(1)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record 'ALL : 1.30.20.146' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['1.30.20.146']) }
+    end
+  end
+
+  describe_parsing_a_record 'ALL : 1.93.25.234' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['1.93.25.234']) }
+    end
+  end
+end
+
+

data/spec/feeds/yourcmc_ssh-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/yourcmc_ssh-ip_reputation.feed', :feed do
+  let(:provider) { 'yourcmc' }
+  let(:name) { 'ssh-ip_reputation' }
+
+  it_fetches_url 'http://vmx.yourcmc.ru/BAD_HOSTS.IP4'
+
+  describe_parsing_the_file feed_data('yourcmc_ssh-ip_reputation.txt') do
+    it "should have parsed 16 records" do
+      expect(num_records_parsed).to eq(16)
+    end
+    it "should have filtered 11 records" do
+      expect(num_records_filtered).to eq(11)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '109.120.157.63' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+    describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['109.120.157.63']) }
+    end
+  end
+
+  describe_parsing_a_record '109.165.15.113' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+    describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['109.165.15.113']) }
+    end
+  end
+end
+
+

data/spec/feeds/zeus-domain_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/zeus-domain_reputation.feed', :feed do
+  let(:provider) { 'abuse_ch' }
+  let(:name) { 'zeus_domain_reputation' }
+
+  it_fetches_url 'https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist'
+
+  describe_parsing_the_file feed_data('zeus_domainlist.txt') do
+    it "should have parsed 21 records" do
+      expect(num_records_parsed).to eq(21)
+    end
+    it "should have filtered 6 records" do
+      expect(num_records_filtered).to eq(6)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record 'aconfideeeeeracia200.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:fqdns) { is_expected.to match_array(["aconfideeeeeracia200.com"]) }
+    end
+  end
+
+  describe_parsing_a_record 'advanc420.co.vu' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:fqdns) { is_expected.to match_array(["advanc420.co.vu"]) }
+    end
+  end
+end
+
+