threatinator 0.1.6 → 0.2.0

data/spec/feeds/palevo-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/palevo-ip_reputation.feed', :feed do
     it "should have filtered 1 records" do
       expect(num_records_filtered).to eq(1)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '187.214.120.147' do
@@ -28,7 +25,7 @@ describe 'feeds/palevo-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:c2) }
-      its(:ipv4s) { is_expected.to match_array(['187.214.120.147']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['187.214.120.147'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/palevo-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:c2) }
-      its(:ipv4s) { is_expected.to match_array(['67.210.170.169']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['67.210.170.169'])) }
     end
   end
 end

data/spec/feeds/phishtank_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/phishtank.feed', :feed do
     it "should have filtered 0 records" do
       expect(num_records_filtered).to eq(0)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
 
     describe "the records" do
       it "should total 10" do
@@ -33,8 +30,8 @@ describe 'feeds/phishtank.feed', :feed do
         subject { event } 
 
         its(:type) { is_expected.to be(:phishing) }
-        its(:ipv4s) { is_expected.to match_array(['31.14.23.213']) }
-        its(:urls) { pending "Waiting on URL support"; is_expected.to match_array(['http://poste.it-postepay4.phpblack.com/']) }
+        its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['31.14.23.213'])) }
+        its(:urls) { is_expected.to eq(build(:urls, values: ['http://poste.it-postepay4.phpblack.com/'])) }
       end
     end
   end

data/spec/feeds/sigmaproject_atma_spec.rb

@@ -0,0 +1,63 @@
+require 'spec_helper'
+
+describe 'feeds/sigmaproject_atma.feed', :feed do
+  let(:provider) { 'sigmaproject' }
+  let(:name) { 'atma_ip_reputation' }
+
+  it_fetches_url 'https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=atma'
+
+  describe_parsing_the_file feed_data('sigmaproject_atma.return.gz') do
+    it "should have parsed 10 records" do
+      expect(num_records_parsed).to eq(10)
+    end
+    it "should have filtered 1 records" do
+      expect(num_records_filtered).to eq(1)
+    end
+
+    describe "the records" do
+      it "should total 11" do
+        expect(num_records).to eq(11)
+      end
+
+      it "each record should have generated exactly one event" do
+        counts = events.map { |event_array| event_array.count }
+        expect(counts).to eq([1,1,1,1,1,1,1,1,1,1,0])
+      end
+
+      describe "the event for record 0" do
+        let(:record) { records[0] }
+        let(:event) { events[0].first }
+        subject { event } 
+
+        its(:type) { is_expected.to be(:scanning) }
+        its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['106.187.97.158'])) }
+      end
+    end
+  end
+  
+  describe_parsing_a_record '117.194.6.38/32' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['117.194.6.38'])) }
+    end
+  end
+
+  describe_parsing_a_record '144.76.42.128/25' do
+    it "should have been filtered" do
+      expect(status).to eq(:filtered)
+    end
+    it "should have parsed 0 event" do
+      expect(events.count).to eq(0)
+    end
+  end
+end
+
+
+

data/spec/feeds/sigmaproject_spyware_spec.rb

@@ -0,0 +1,64 @@
+require 'spec_helper'
+
+describe 'feeds/sigmaproject_spyware.feed', :feed do
+  let(:provider) { 'sigmaproject' }
+  let(:name) { 'spyware_ip_reputation' }
+
+  it_fetches_url 'https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=spyware'
+
+  describe_parsing_the_file feed_data('sigmaproject_spyware.return.gz') do
+    it "should have parsed 5 records" do
+      expect(num_records_parsed).to eq(5)
+    end
+    it "should have filtered 5 records" do
+      expect(num_records_filtered).to eq(5)
+    end
+
+    describe "the records" do
+      it "should total 10" do
+        expect(num_records).to eq(10)
+      end
+
+      it "each record should have generated exactly one event" do
+        counts = events.map { |event_array| event_array.count }
+        expect(counts).to eq([1, 0, 0, 0, 0, 0, 1, 1, 1, 1])
+      end
+
+      describe "the event for record 0" do
+        let(:record) { records[0] }
+        let(:event) { events[0].first }
+        subject { event } 
+
+        its(:type) { is_expected.to be(:c2) }
+        its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['2.60.13.132'])) }
+      end
+    end
+  end
+  
+  describe_parsing_a_record '2.60.13.132/32' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['2.60.13.132'])) }
+    end
+  end
+
+  describe_parsing_a_record '5.3.88.23/27' do
+    it "should have been filtered" do
+      expect(status).to eq(:filtered)
+    end
+    it "should have no events" do
+      expect(events.count).to eq(0)
+    end
+  end
+
+end
+
+
+

data/spec/feeds/sigmaproject_webexploit_spec.rb

@@ -0,0 +1,63 @@
+require 'spec_helper'
+
+describe 'feeds/sigmaproject_webexploit.feed', :feed do
+  let(:provider) { 'sigmaproject' }
+  let(:name) { 'webexploit_ip_reputation' }
+
+  it_fetches_url 'https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=webexploit'
+
+  describe_parsing_the_file feed_data('sigmaproject_webexploit.return.gz') do
+    it "should have parsed 9 records" do
+      expect(num_records_parsed).to eq(9)
+    end
+    it "should have filtered 1 records" do
+      expect(num_records_filtered).to eq(1)
+    end
+
+    describe "the records" do
+      it "should total 10" do
+        expect(num_records).to eq(10)
+      end
+
+      it "each record should have generated exactly one event" do
+        counts = events.map { |event_array| event_array.count }
+        expect(counts).to eq([1, 1, 1, 1, 0, 1, 1, 1, 1, 1])
+      end
+
+      describe "the event for record 0" do
+        let(:record) { records[0] }
+        let(:event) { events[0].first }
+        subject { event } 
+
+        its(:type) { is_expected.to be(:attacker) }
+        its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['2.95.241.135'])) }
+      end
+    end
+  end
+  
+  describe_parsing_a_record '2.60.13.132/32' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:attacker) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['2.60.13.132'])) }
+    end
+  end
+
+  describe_parsing_a_record '10.1.20.33/27' do
+    it "should have been filtered" do
+      expect(status).to eq(:filtered)
+    end
+    it "should not have parsed any events" do
+      expect(events.count).to eq(0)
+    end
+  end
+end
+
+
+

data/spec/feeds/snort_bpf-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/snort_bpf-ip_reputation.feed', :feed do
+  let(:provider) { 'snort' }
+  let(:name) { 'bpf_ip_reputation' }
+
+  it_fetches_url 'http://labs.snort.org/feeds/ip-filter.blf'
+
+  describe_parsing_the_file feed_data('snort_bpf-ip_reputation.txt') do
+    it "should have parsed 16 records" do
+      expect(num_records_parsed).to eq(16)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '193.106.31.12' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['193.106.31.12'])) }
+    end
+  end
+
+  describe_parsing_a_record '76.74.184.23' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['76.74.184.23'])) }
+    end
+  end
+end
+
+

data/spec/feeds/spyeye-domain_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/spyeye-domain_reputation.feed', :feed do
     it "should have filtered 7 records" do
       expect(num_records_filtered).to eq(7)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record 'futuretelefonica.com' do

data/spec/feeds/spyeye-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/spyeye-ip_reputation.feed', :feed do
     it "should have filtered 7 records" do
       expect(num_records_filtered).to eq(7)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '188.190.126.173' do
@@ -28,7 +25,7 @@ describe 'feeds/spyeye-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:c2) }
-      its(:ipv4s) { is_expected.to match_array(['188.190.126.173']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['188.190.126.173'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/spyeye-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:c2) }
-      its(:ipv4s) { is_expected.to match_array(['91.220.62.190']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['91.220.62.190'])) }
     end
   end
 end

data/spec/feeds/steeman-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/steeman-ip_reputation.feed', :feed do
+  let(:provider) { 'steeman' }
+  let(:name) { 'ip_reputation' }
+
+  it_fetches_url 'http://jeroen.steeman.org/FS-PlainText'
+
+  describe_parsing_the_file feed_data('steeman-ip-reputation.txt') do
+    it "should have parsed 11 records" do
+      expect(num_records_parsed).to eq(11)
+    end
+    it "should have filtered 2 records" do
+      expect(num_records_filtered).to eq(2)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '1.10.221.78' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+	  its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['1.10.221.78'])) }
+    end
+  end
+
+  describe_parsing_a_record '1.168.163.133' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+	  its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['1.168.163.133'])) }
+    end
+  end
+end
+
+

data/spec/feeds/t-arend-de_ssh-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/t-arend-de_ssh-ip_reputation.feed', :feed do
     it "should have filtered 3 records" do
       expect(num_records_filtered).to eq(3)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record 'sshd: 121.15.167.243' do
@@ -28,7 +25,7 @@ describe 'feeds/t-arend-de_ssh-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:c2) }
-      its(:ipv4s) { is_expected.to match_array(['121.15.167.243']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['121.15.167.243'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/t-arend-de_ssh-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:c2) }
-      its(:ipv4s) { is_expected.to match_array(['122.224.128.222']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['122.224.128.222'])) }
     end
   end
 end

data/spec/feeds/the_haleys_ssh-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/the_haleys_ssh-ip_reputation.feed', :feed do
     it "should have filtered 1 records" do
       expect(num_records_filtered).to eq(1)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record 'ALL : 1.30.20.146' do
@@ -28,7 +25,7 @@ describe 'feeds/the_haleys_ssh-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['1.30.20.146']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['1.30.20.146'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/the_haleys_ssh-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['1.93.25.234']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['1.93.25.234'])) }
     end
   end
 end

data/spec/feeds/trustedsec-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/trustedsec-ip_reputation.feed', :feed do
+  let(:provider) { 'trustedsec' }
+  let(:name) { 'ip_reputation' }
+
+  it_fetches_url 'https://www.trustedsec.com/banlist.txt'
+
+  describe_parsing_the_file feed_data('trustedsec-ip-reputation.txt') do
+    it "should have parsed 11 records" do
+      expect(num_records_parsed).to eq(11)
+    end
+    it "should have filtered 1 records" do
+      expect(num_records_filtered).to eq(1)
+    end
+  end
+
+  describe_parsing_a_record '100.42.74.90' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['100.42.74.90'])) }
+    end
+  end
+
+  describe_parsing_a_record '101.108.127.106' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['101.108.127.106'])) }
+    end
+  end
+end
+
+