threatinator 0.1.6 → 0.2.0

data/spec/feeds/dshield_attackers-top1000_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/dshield_attackers-top1000.feed', :feed do
     it "should have filtered 0 records" do
       expect(num_records_filtered).to eq(0)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
 
     describe "the records" do
       it "should total 10" do
@@ -33,7 +30,7 @@ describe 'feeds/dshield_attackers-top1000.feed', :feed do
         subject { event } 
 
         its(:type) { is_expected.to be(:attacker) }
-        its(:ipv4s) { is_expected.to match_array(['150.164.82.10']) }
+        its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['150.164.82.10'])) }
       end
     end
   end

data/spec/feeds/falconcrest-ip_reputation_spec.rb

@@ -0,0 +1,37 @@
+require 'spec_helper'
+
+describe 'feeds/falconcrest-ip_reputation.feed', :feed do
+  let(:provider) { 'falconcrest' }
+  let(:name) { 'ip_reputation' }
+
+  it_fetches_url 'http://www.falconcrest.eu/IPBL.aspx'
+
+  describe_parsing_the_file feed_data('falconcrest_iplist.txt') do
+    it "should have parsed 10 records" do
+      expect(num_records_parsed).to eq(29)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+
+    describe "the records" do
+      it "should total 10" do
+        expect(num_records).to eq(29)
+      end
+
+      it "each record should have generated exactly one event" do
+        counts = events.map { |event_array| event_array.count }
+        expect(counts).to eq([1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1])
+      end
+
+      describe "the event for record 0" do
+        let(:record) { records[0] }
+        let(:event) { events[0].first }
+        subject { event } 
+
+        its(:type) { is_expected.to be(:spamming) }
+        its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['175.44.5.227'])) }
+      end
+    end
+  end
+end

data/spec/feeds/feodo-domain_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/feodo-domain_reputation.feed', :feed do
     it "should have filtered 6 records" do
       expect(num_records_filtered).to eq(6)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record 'buriymishka.ru' do

data/spec/feeds/feodo-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/feodo-ip_reputation.feed', :feed do
     it "should have filtered 6 records" do
       expect(num_records_filtered).to eq(6)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '103.25.59.120' do
@@ -28,7 +25,7 @@ describe 'feeds/feodo-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:c2) }
-      its(:ipv4s) { is_expected.to match_array(['103.25.59.120']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['103.25.59.120'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/feodo-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:c2) }
-      its(:ipv4s) { is_expected.to match_array(['173.236.86.214']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['173.236.86.214'])) }
     end
   end
 end

data/spec/feeds/h3x_asprox-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/h3x_asprox.feed', :feed do
+  let(:provider) { 'h3x' }
+  let(:name) { 'asprox' }
+
+  it_fetches_url 'http://atrack.h3x.eu/api/asprox_all.php'
+
+  describe_parsing_the_file feed_data('h3x_asprox.txt') do
+    it "should have parsed 20 records" do
+      expect(num_records_parsed).to eq(20)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '178.79.161.146:443' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+	  its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['178.79.161.146'])) }
+    end
+  end
+
+  describe_parsing_a_record '162.218.236.73:8080' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+	  its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['162.218.236.73'])) }
+    end
+  end
+end
+
+

data/spec/feeds/hosts-file_hphostspartial-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/hosts-file_hphostspartial-domain_reputation.feed', :feed do
+  let(:provider) { 'hosts-file' }
+  let(:name) { 'hphostspartial_domain_reputation' }
+
+  it_fetches_url 'http://hosts-file.net/hphosts-partial.txt'
+
+  describe_parsing_the_file feed_data('hosts-file_hphostspartial_domainlist.txt') do
+    it "should have parsed 13 records" do
+      expect(num_records_parsed).to eq(13)
+    end
+    it "should have filtered 11 records" do
+      expect(num_records_filtered).to eq(11)
+    end
+  end
+
+  describe_parsing_a_record '127.0.0.1	0.cordelia8.waslittrefxwpc.eu' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['0.cordelia8.waslittrefxwpc.eu']) }
+    end
+  end
+
+  describe_parsing_a_record '127.0.0.1	009.blogfoxnewsators.ru' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['009.blogfoxnewsators.ru']) }
+    end
+  end
+end
+
+

data/spec/feeds/infiltrated-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/infiltrated-ip_reputation.feed', :feed do
     it "should have filtered 2 records" do
       expect(num_records_filtered).to eq(2)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '95.221.71.219' do
@@ -28,7 +25,7 @@ describe 'feeds/infiltrated-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['95.221.71.219']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['95.221.71.219'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/infiltrated-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['94.41.71.52']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['94.41.71.52'])) }
     end
   end
 end

data/spec/feeds/infiltrated_vabl-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/infiltrated_vabl-ip_reputation.feed', :feed do
+  let(:provider) { 'infiltrated' }
+  let(:name) { 'vabl_ip_reputation' }
+
+  it_fetches_url 'http://www.infiltrated.net/vabl.txt'
+
+  describe_parsing_the_file feed_data('infiltrated_vabl_iplist.txt') do
+    it "should have parsed 21 records" do
+      expect(num_records_parsed).to eq(21)
+    end
+    it "should have filtered 12 records" do
+      expect(num_records_filtered).to eq(12)
+    end
+  end
+
+  describe_parsing_a_record '108.59.1.205 | BRU | VABL | 20110609 | e22b6e201b3533a0dd1ac8bb47426169 | 30633 | 108.59.0.0/20 | LEASEWEB-US | US | - | LEASEWEB USA INC' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['108.59.1.205'])) }
+    end
+  end
+
+  describe_parsing_a_record '109.169.60.121 | BRU | VABL | 20110621 | 8850509672ee7d983d9a511e31b13a9a | 29761 | 109.169.60.0/23 | OC3-NETWORKS-AS-NUMB | US | BMTRADAGROUP.COM | RAPIDSWITCH LTD' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['109.169.60.121'])) }
+    end
+  end
+end
+
+

data/spec/feeds/isc_suspicious_high-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/isc_suspicious_high-domain_reputation.feed', :feed do
+  let(:provider) { 'isc' }
+  let(:name) { 'suspicious_high_domain_reputation' }
+
+  it_fetches_url 'https://isc.sans.edu/feeds/suspiciousdomains_High.txt'
+
+  describe_parsing_the_file feed_data('isc_suspicious_high_domainlist.txt') do
+    it "should have parsed 9 records" do
+      expect(num_records_parsed).to eq(9)
+    end
+    it "should have filtered 17 records" do
+      expect(num_records_filtered).to eq(17)
+    end
+  end
+
+  describe_parsing_a_record '1-verygoods.ru' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['1-verygoods.ru']) }
+    end
+  end
+
+  describe_parsing_a_record '123kochi.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['123kochi.com']) }
+    end
+  end
+end
+
+

data/spec/feeds/isc_suspicious_low-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/isc_suspicious_low-domain_reputation.feed', :feed do
+  let(:provider) { 'isc' }
+  let(:name) { 'suspicious_low_domain_reputation' }
+
+  it_fetches_url 'https://isc.sans.edu/feeds/suspiciousdomains_Low.txt'
+
+  describe_parsing_the_file feed_data('isc_suspicious_low_domainlist.txt') do
+    it "should have parsed 17 records" do
+      expect(num_records_parsed).to eq(17)
+    end
+    it "should have filtered 17 records" do
+      expect(num_records_filtered).to eq(17)
+    end
+  end
+
+  describe_parsing_a_record '10kpictures.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['10kpictures.com']) }
+    end
+  end
+
+  describe_parsing_a_record '1492tapasbar.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['1492tapasbar.com']) }
+    end
+  end
+end
+
+

data/spec/feeds/isc_suspicious_medium-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/isc_suspicious_medium-domain_reputation.feed', :feed do
+  let(:provider) { 'isc' }
+  let(:name) { 'suspicious_medium_domain_reputation' }
+
+  it_fetches_url 'https://isc.sans.edu/feeds/suspiciousdomains_Medium.txt'
+
+  describe_parsing_the_file feed_data('isc_suspicious_medium_domainlist.txt') do
+    it "should have parsed 15 records" do
+      expect(num_records_parsed).to eq(15)
+    end
+    it "should have filtered 17 records" do
+      expect(num_records_filtered).to eq(17)
+    end
+  end
+
+  describe_parsing_a_record '114oldest.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['114oldest.com']) }
+    end
+  end
+
+  describe_parsing_a_record '168asia.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['168asia.com']) }
+    end
+  end
+end
+
+

data/spec/feeds/malc0de-domain_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/malc0de-domain_reputation.feed', :feed do
     it "should have filtered 6 records" do
       expect(num_records_filtered).to eq(6)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record 'PRIMARY opencandy.com blockeddomain.hosts' do

data/spec/feeds/malc0de-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/malc0de-ip_reputation.feed', :feed do
     it "should have filtered 4 records" do
       expect(num_records_filtered).to eq(4)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '216.151.164.53' do
@@ -28,7 +25,7 @@ describe 'feeds/malc0de-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:malware_host) }
-      its(:ipv4s) { is_expected.to match_array(['216.151.164.53']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['216.151.164.53'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/malc0de-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:malware_host) }
-      its(:ipv4s) { is_expected.to match_array(['176.32.99.47']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['176.32.99.47'])) }
     end
   end
 end