Class: Mihari::Emitters::MISP

Inherits:
Base show all
Defined in:
lib/mihari/emitters/misp.rb

Overview

MISP emitter

Constant Summary

Constants included from Concerns::Retriable

Concerns::Retriable::DEFAULT_CONDITION, Concerns::Retriable::RETRIABLE_ERRORS

Instance Attribute Summary collapse

Attributes inherited from Actor

#options

Instance Method Summary collapse

Methods inherited from Base

#get_result, inherited, #parallel?

Methods inherited from Actor

configuration_keys, #get_result, key, key_aliases, keys, #retry_exponential_backoff, #retry_interval, #retry_times, #timeout, type, #validate_configuration!

Methods included from Concerns::Retriable

#retry_on_error

Methods included from Concerns::Configurable

#configuration_keys?

Constructor Details

#initialize(rule:, options: nil, **params) ⇒ MISP

Returns a new instance of MISP.

Parameters:

  • rule (Mihari::Rule)
  • options (Hash, nil) (defaults to: nil)
  • params (Hash, nil) 


29
30
31
32
33
34
35
36
37
 
# File 'lib/mihari/emitters/misp.rb', line 29

def initialize(rule:, options: nil, **params)
  super(rule:, options:)

  @url = params[:url] || Mihari.config.misp_url
  @api_key = params[:api_key] || Mihari.config.misp_api_key
  @attribute_tags = params[:attribute_tags] || []

  @artifacts = []
end

Instance Attribute Details

#api_key ⇒ String? (readonly)

Returns:

  • (String, nil) 


13
14
15
 
# File 'lib/mihari/emitters/misp.rb', line 13

def api_key
  @api_key
end

#artifacts ⇒ Array<Mihari::Models::Artifact>

Returns:



22
23
24
 
# File 'lib/mihari/emitters/misp.rb', line 22

def artifacts
  @artifacts
end

#attribute_tags ⇒ Array<String> (readonly)

Returns:

  • (Array<String>) 


16
17
18
 
# File 'lib/mihari/emitters/misp.rb', line 16

def attribute_tags
  @attribute_tags
end

#rule ⇒ Mihari::Rule (readonly)

Returns:



19
20
21
 
# File 'lib/mihari/emitters/misp.rb', line 19

def rule
  @rule
end

#url ⇒ String? (readonly)

Returns:

  • (String, nil) 


10
11
12
 
# File 'lib/mihari/emitters/misp.rb', line 10

def url
  @url
end

Instance Method Details

#call(artifacts) ⇒ Object

Create a MISP event

Parameters:



51
52
53
54
55
56
57
58
59
60
61
 
# File 'lib/mihari/emitters/misp.rb', line 51

def call(artifacts)
  return if artifacts.empty?

  client.create_event({
    Event: {
      info: rule.title,
      Attribute: artifacts.map { |artifact| build_attribute(artifact) },
      Tag: rule.tags.map { |tag| {name: tag.name} }
    }
  })
end

#configured? ⇒ Boolean

Returns:

  • (Boolean) 


42
43
44
 
# File 'lib/mihari/emitters/misp.rb', line 42

def configured?
  api_key? && url?
end

#target ⇒ String

Returns:

  • (String) 


66
67
68
 
# File 'lib/mihari/emitters/misp.rb', line 66

def target
  URI(url).host || "N/A"
end