Class: Mihari::Emitters::TheHive

Inherits:
Base
  • Object
show all
Defined in:
lib/mihari/emitters/the_hive.rb

Constant Summary

Constants included from Mixins::Retriable

Mixins::Retriable::DEFAULT_ON

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods inherited from Base

inherited, #run

Methods included from Mixins::Retriable

#retry_on_error

Methods included from Mixins::Configurable

#configuration_values, #configured?

Constructor Details

#initialize(*args, **kwargs) ⇒ TheHive

Returns a new instance of TheHive.



17
18
19
20
21
22
23
 
# File 'lib/mihari/emitters/the_hive.rb', line 17

def initialize(*args, **kwargs)
  super(*args, **kwargs)

  @url = kwargs[:url] || Mihari.config.thehive_url
  @api_key = kwargs[:api_key] || Mihari.config.thehive_api_key
  @api_version = kwargs[:api_version] || Mihari.config.thehive_api_version
end

Instance Attribute Details

#api_key ⇒ String? (readonly)

Returns:

  • (String, nil) 


12
13
14
 
# File 'lib/mihari/emitters/the_hive.rb', line 12

def api_key
  @api_key
end

#api_version ⇒ String? (readonly)

Returns:

  • (String, nil) 


15
16
17
 
# File 'lib/mihari/emitters/the_hive.rb', line 15

def api_version
  @api_version
end

#url ⇒ String? (readonly)

Returns:

  • (String, nil) 


9
10
11
 
# File 'lib/mihari/emitters/the_hive.rb', line 9

def url
  @url
end

Instance Method Details

#emit(rule:, artifacts:, **_options) ⇒ ::MISP::Event

Create a Hive alert

Parameters:

Returns:

  • (::MISP::Event) 


49
50
51
52
53
54
 
# File 'lib/mihari/emitters/the_hive.rb', line 49

def emit(rule:, artifacts:, **_options)
  return if artifacts.empty?

  payload = payload(rule: rule, artifacts: artifacts)
  api.alert.create(**payload)
end

#normalized_api_version ⇒ String?

Normalize API version for API client

Parameters:

  • version (String)

Returns:

  • (String, nil) 


63
64
65
66
67
68
69
70
71
72
73
74
 
# File 'lib/mihari/emitters/the_hive.rb', line 63

def normalized_api_version
  @normalized_api_version ||= [].tap do |out|
    # v4 does not have version prefix in path (/api/)
    # v5 has version prefix in path (/api/v1/)
    table = {
      "" => nil,
      "v4" => nil,
      "v5" => "v1"
    }
    out << table[api_version.to_s.downcase]
  end.first
end

#valid? ⇒ Boolean

Returns:

  • (Boolean) 


26
27
28
29
30
31
32
33
34
35
36
37
38
39
 
# File 'lib/mihari/emitters/the_hive.rb', line 26

def valid?
  unless url? && api_key?
    Mihari.logger.info("TheHive URL is not set") unless url?
    Mihari.logger.info("TheHive API key is not set") unless api_key?
    return false
  end

  unless ping?
    Mihari.logger.info("TheHive URL (#{url}) is not reachable")
    return false
  end

  true
end