class Mihari::Analyzers::Base
Attributes
ignore_old_artifacts[RW]
ignore_threshold[RW]
Public Class Methods
inherited(child)
click to toggle source
# File lib/mihari/analyzers/base.rb, line 75 def self.inherited(child) Mihari.analyzers << child end
new(*args, **kwargs)
click to toggle source
Calls superclass method
# File lib/mihari/analyzers/base.rb, line 17 def initialize(*args, **kwargs) super @ignore_old_artifacts = false @ignore_threshold = 0 end
Public Instance Methods
artifacts()
click to toggle source
@return [Array<String>, Array<Mihari::Artifact>]
# File lib/mihari/analyzers/base.rb, line 25 def artifacts raise NotImplementedError, "You must implement #{self.class}##{__method__}" end
description()
click to toggle source
@return [String]
# File lib/mihari/analyzers/base.rb, line 35 def description raise NotImplementedError, "You must implement #{self.class}##{__method__}" end
normalized_artifacts()
click to toggle source
Normalize artifacts
-
Uniquefy artifacts by native uniq
-
Convert data (string) into an artifact
-
Reject an invalid artifact
@return [Array<Mihari::Artifact>]
# File lib/mihari/analyzers/base.rb, line 87 def normalized_artifacts @normalized_artifacts ||= artifacts.compact.uniq.sort.map do |artifact| # No need to set data_type manually # It is set automatically in #initialize artifact.is_a?(Artifact) ? artifact : Artifact.new(data: artifact, source: source) end.select(&:valid?).uniq(&:data) end
run()
click to toggle source
Set artifacts & run emitters in parallel
@return [nil]
# File lib/mihari/analyzers/base.rb, line 54 def run set_enriched_artifacts Parallel.each(valid_emitters) do |emitter| run_emitter emitter end end
run_emitter(emitter)
click to toggle source
Run emitter
@param [Mihari::Emitters::Base] emitter
@return [nil]
# File lib/mihari/analyzers/base.rb, line 69 def run_emitter(emitter) emitter.run(title: title, description: description, artifacts: enriched_artifacts, source: source, tags: tags) rescue StandardError => e puts "Emission by #{emitter.class} is failed: #{e}" end
source()
click to toggle source
@return [String]
# File lib/mihari/analyzers/base.rb, line 40 def source self.class.to_s.split("::").last.to_s end
title()
click to toggle source
@return [String]
# File lib/mihari/analyzers/base.rb, line 30 def title self.class.to_s.split("::").last.to_s end
Private Instance Methods
enriched_artifacts()
click to toggle source
Enriched artifacts
@return [Array<Mihari::Artifact>]
# File lib/mihari/analyzers/base.rb, line 113 def enriched_artifacts @enriched_artifacts ||= unique_artifacts.map do |artifact| artifact.enrich_all artifact end end
set_enriched_artifacts()
click to toggle source
Set enriched artifacts
@return [nil]
# File lib/mihari/analyzers/base.rb, line 125 def set_enriched_artifacts retry_on_error { enriched_artifacts } rescue ArgumentError => e klass = self.class.to_s.split("::").last.to_s raise Error, "Please configure #{klass} settings properly. (#{e})" end
unique_artifacts()
click to toggle source
Uniquefy artifacts
@return [Array<Mihari::Artifact>]
# File lib/mihari/analyzers/base.rb, line 102 def unique_artifacts @unique_artifacts ||= normalized_artifacts.select do |artifact| artifact.unique?(ignore_old_artifacts: ignore_old_artifacts, ignore_threshold: ignore_threshold) end end
valid_emitters()
click to toggle source
Select valid emitters
@return [Array<Mihari::Emitters::Base>]
# File lib/mihari/analyzers/base.rb, line 137 def valid_emitters @valid_emitters ||= Mihari.emitters.filter_map do |klass| emitter = klass.new emitter.valid? ? emitter : nil end.compact end