Class: Mihari::Emitters::MISP

Inherits:
Base show all
Defined in:
lib/mihari/emitters/misp.rb

Overview

MISP emitter

Constant Summary

Constants included from Concerns::Retriable

Concerns::Retriable::DEFAULT_CONDITION, Concerns::Retriable::RETRIABLE_ERRORS

Instance Attribute Summary collapse

Attributes inherited from Actor

#options

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from Base

inherited, #result

Methods inherited from Actor

key, key_aliases, keys, #result, #retry_exponential_backoff, #retry_interval, #retry_times, #timeout, type, #validate_configuration!

Methods included from Concerns::Retriable

#retry_on_error

Methods included from Concerns::Configurable

#configuration_keys?

Constructor Details

#initialize(rule:, options: nil, **params) ⇒ MISP

Returns a new instance of MISP.

Parameters:

  • rule (Mihari::Rule)
  • options (Hash, nil) (defaults to: nil)
  • params (Hash, nil) 


26
27
28
29
30
31
32
33
 
# File 'lib/mihari/emitters/misp.rb', line 26

def initialize(rule:, options: nil, **params)
  super(rule: rule, options: options)

  @url = params[:url] || Mihari.config.misp_url
  @api_key = params[:api_key] || Mihari.config.misp_api_key

  @artifacts = []
end

Instance Attribute Details

#api_key ⇒ String? (readonly)

Returns:

  • (String, nil) 


13
14
15
 
# File 'lib/mihari/emitters/misp.rb', line 13

def api_key
  @api_key
end

#artifacts ⇒ Array<Mihari::Models::Artifact>

Returns:



19
20
21
 
# File 'lib/mihari/emitters/misp.rb', line 19

def artifacts
  @artifacts
end

#rule ⇒ Mihari::Rule (readonly)

Returns:



16
17
18
 
# File 'lib/mihari/emitters/misp.rb', line 16

def rule
  @rule
end

#url ⇒ String? (readonly)

Returns:

  • (String, nil) 


10
11
12
 
# File 'lib/mihari/emitters/misp.rb', line 10

def url
  @url
end

Class Method Details

.configuration_keys ⇒ Object 



67
68
69
 
# File 'lib/mihari/emitters/misp.rb', line 67

def configuration_keys
  %w[misp_url misp_api_key]
end

Instance Method Details

#call(artifacts) ⇒ Object

Create a MISP event

Parameters:



47
48
49
50
51
52
53
54
55
56
57
 
# File 'lib/mihari/emitters/misp.rb', line 47

def call(artifacts)
  return if artifacts.empty?

  client.create_event({
    Event: {
      info: rule.title,
      Attribute: artifacts.map { |artifact| build_attribute(artifact) },
      Tag: rule.tags.map { |tag| { name: tag } }
    }
  })
end

#configured? ⇒ Boolean

Returns:

  • (Boolean) 


38
39
40
 
# File 'lib/mihari/emitters/misp.rb', line 38

def configured?
  api_key? && url?
end

#target ⇒ String

Returns:

  • (String) 


62
63
64
 
# File 'lib/mihari/emitters/misp.rb', line 62

def target
  URI(url).host || "N/A"
end