urlhaus_monitor 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0c76d3e7849c7a747f538e71ec181064e3c1ddfd782a776dd575e36787ef3474
-  data.tar.gz: 7e63116b773fd023bf94a93461765b7d2b89c63fb996968d8c95769e4f90d64e
+  metadata.gz: 75302864cc798a6416eb7555f623d2f4fdfaed0e6b4c84699d389f7fea4b507c
+  data.tar.gz: ee06d211fe279b4e94bf00e61efe41855ce6e84284404e3c12485fee636a7f82
 SHA512:
-  metadata.gz: 88566b40be5de7f2d002bd660b2e74090cc7e2e616503b6c1d8219d9e32aff7e40491d17d81e1b1bc1f6cd9f7a90da3796fceb7e42156d06306f5781bb35a1af
-  data.tar.gz: bc6304a7279c0ff154f0c9c1c9a735136f5e9a91fd45e049c70dfc2ccdab0f408f04d7e6ac26db1dcd8e5af7d3f68bf4c74c1950008c835f6cb571f737fbd3fa
+  metadata.gz: ba1d9cb86ca0e123f3e64458d769b7916dfa1ad5cfef8126c6c757504e4412dd5048b09b93f8e0600b2551ed9cb3d785009914e33708b1f93f6804acf95c4800
+  data.tar.gz: ce75f0beaca133ce632659b90c007ee449446f7f70e43cdc604cdfc7ee90b950246bb3ebbf82eab36f85dd8c7165a40bdee67ab523081b12d8adc1c193ae784d

data/lib/urlhaus_monitor/entry.rb

@@ -15,16 +15,13 @@ module URLhausMonitor
 
     def initialize(line)
       parts = CSV.parse(line.chomp).flatten
-      raise ArgumentError, "#{line} is not valid." unless parts.length == 8
+      raise ArgumentError, "#{line} is not valid." unless parts.length == 8 || parts.length == 9
 
-      @date_added = parts.shift
-      @url = parts.shift
-      @url_status = parts.shift
-      @threat = parts.shift
-      @host = parts.shift
-      @ip_address = parts.shift
-      @asnumber = parts.shift
-      @country = parts.shift
+      if parts.length == 8
+        parse_without_tags parts
+      else
+        parse_with_tags parts
+      end
     end
 
     def defanged_url
@@ -32,38 +29,92 @@ module URLhausMonitor
     end
 
     def defanged_host
-      @defanged_host ||=  host.gsub(/\./, "[.]")
+      @defanged_host ||= host.gsub(/\./, "[.]")
+    end
+
+    def title
+      "#{defanged_url} (#{defanged_host} / #{ip_address} / #{date_added}) : #{threat}"
     end
 
     def vt_link
-      "https://www.virustotal.com/#/domain/#{host}"
+      return nil unless _vt_link
+
+      {
+        type: "button",
+        text: "Lookup on VirusTotal",
+        url: _vt_link,
+      }
+    end
+
+    def urlscan_link
+      return nil unless _urlscan_link
+
+      {
+        type: "button",
+        text: "Lookup on urlscan.io",
+        url: _urlscan_link,
+      }
     end
 
     def urlhaus_link
-      "https://urlhaus.abuse.ch/host/#{host}/"
+      return nil unless _urlhaus_link
+
+      {
+        type: "button",
+        text: "Lookup on URLhaus",
+        url: _urlhaus_link,
+      }
     end
 
-    def title
-      "#{defanged_url} (#{defanged_host} / #{ip_address}) (#{date_added})"
+    def actions
+      [vt_link, urlscan_link, urlhaus_link].compact
     end
 
     def to_attachements
       [
         {
-          fallback: "urlhaus link",
-          title: defanged_host,
-          title_link: urlhaus_link,
-          footer: "urlhaus.abuse.ch",
-          footer_icon: "http://www.google.com/s2/favicons?domain=urlhaus.abuse.ch"
-        },
-        {
-          fallback: "vt link",
-          title: defanged_host,
-          title_link: vt_link,
-          footer: "virustotal.com",
-          footer_icon: "http://www.google.com/s2/favicons?domain=virustotal.com"
+          text: defanged_host,
+          fallback: "VT & urlscan.io links",
+          actions: actions
         }
       ]
     end
+
+    private
+
+    def _vt_link
+      "https://www.virustotal.com/#/domain/#{host}"
+    end
+
+    def _urlscan_link
+      "https://urlscan.io/domain/#{host}"
+    end
+
+    def _urlhaus_link
+      "https://urlhaus.abuse.ch/host/#{host}/"
+    end
+
+    def parse_without_tags(parts)
+      @date_added = parts.shift
+      @url = parts.shift
+      @url_status = parts.shift
+      @threat = parts.shift
+      @host = parts.shift
+      @ip_address = parts.shift
+      @asnumber = parts.shift
+      @country = parts.shift
+    end
+
+    def parse_with_tags(parts)
+      @date_added = parts.shift
+      @url = parts.shift
+      @url_status = parts.shift
+      @threat = parts.shift
+      @tags = parts.shift
+      @host = parts.shift
+      @ip_address = parts.shift
+      @asnumber = parts.shift
+      @country = parts.shift
+    end
   end
 end

data/lib/urlhaus_monitor/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module URLhausMonitor
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: urlhaus_monitor
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Manabu Niseki
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-03-24 00:00:00.000000000 Z
+date: 2019-05-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler