Sha256: 08125cae4ae4f3124af7da7ba2dfb20114e75f1610e44ad49262867464b1e454
Contents?: true
Size: 1.42 KB
Versions: 9
Compression:
Stored size: 1.42 KB
Contents
# frozen_string_literal: true
require "binaryedge"
module Mihari
module Analyzers
class BinaryEdge < Base
attr_reader :title, :description, :query, :tags
def initialize(query, title: nil, description: nil, tags: [])
super()
@query = query
@title = title || "BinaryEdge lookup"
@description = description || "query = #{query}"
@tags = tags
end
def artifacts
results = search
return [] unless results || results.empty?
results.map do |result|
events = result["events"] || []
events.map do |event|
event.dig "target", "ip"
end.compact
end.flatten.compact.uniq
end
private
PAGE_SIZE = 20
def search_with_page(query, page: 1)
api.host.search(query, page: page)
rescue ::BinaryEdge::Error => e
raise RetryableError, e if e.message.include?("Request time limit exceeded")
raise e
end
def search
responses = []
(1..Float::INFINITY).each do |page|
res = search_with_page(query, page: page)
total = res["total"].to_i
responses << res
break if total <= page * PAGE_SIZE
end
responses
end
def config_keys
%w[binaryedge_api_key]
end
def api
@api ||= ::BinaryEdge::API.new(Mihari.config.binaryedge_api_key)
end
end
end
end
Version data entries
9 entries across 9 versions & 1 rubygems