Sha256: 98432c5a1cf21608a8af03a588aaec022e1e31933bc33d0cef26050b5596abe1
Contents?: true
Size: 1.65 KB
Versions: 10
Compression:
Stored size: 1.65 KB
Contents
# frozen_string_literal: true
module Mihari
module Analyzers
#
# urlscan.io analyzer
#
class Urlscan < Base
SUPPORTED_DATA_TYPES = %w[url domain ip].freeze
# @return [String, nil]
attr_reader :api_key
# @return [Array<String>]
attr_reader :allowed_data_types
#
# @param [String] query
# @param [Hash, nil] options
# @param [String, nil] api_key
# @param [Array<String>] allowed_data_types
#
def initialize(query, options: nil, api_key: nil, allowed_data_types: SUPPORTED_DATA_TYPES)
super(query, options: options)
@api_key = api_key || Mihari.config.urlscan_api_key
@allowed_data_types = allowed_data_types
return if valid_allowed_data_types?
raise ValueError, "allowed_data_types should be any of url, domain and ip."
end
def artifacts
# @type [Array<Mihari::Models::Artifact>]
artifacts = client.search_with_pagination(query, pagination_limit: pagination_limit).map(&:artifacts).flatten
artifacts.select { |artifact| allowed_data_types.include? artifact.data_type }
end
class << self
def configuration_keys
%w[urlscan_api_key]
end
end
private
def client
Clients::Urlscan.new(
api_key: api_key,
pagination_interval: pagination_interval,
timeout: timeout
)
end
#
# Check whether a data type is valid or not
#
# @return [Boolean]
#
def valid_allowed_data_types?
allowed_data_types.all? { |type| SUPPORTED_DATA_TYPES.include? type }
end
end
end
end
Version data entries
10 entries across 10 versions & 1 rubygems