class Ukemi::Services::VirusTotal
Private Instance Methods
api()
click to toggle source
# File lib/ukemi/services/virustotal.rb, line 15 def api @api ||= ::VirusTotal::API.new end
config_keys()
click to toggle source
# File lib/ukemi/services/virustotal.rb, line 11 def config_keys %w[VIRUSTOTAL_API_KEY] end
convert_to_records(attributes, key = nil)
click to toggle source
# File lib/ukemi/services/virustotal.rb, line 38 def convert_to_records(attributes, key = nil) memo = Hash.new { |h, k| h[k] = [] } attributes.each do |attribute| data = attribute[key] date = Time.at(attribute["date"]).to_date.to_s memo[data] << date end memo.keys.map do |data| Record.new( data: data, first_seen: memo[data].min, last_seen: memo[data].max, source: name ) end end
extract_attributes(response)
click to toggle source
# File lib/ukemi/services/virustotal.rb, line 31 def extract_attributes(response) data = response["data"] || [] data.map do |item| item["attributes"] || [] end end
lookup_by_domain(data)
click to toggle source
# File lib/ukemi/services/virustotal.rb, line 25 def lookup_by_domain(data) res = api.domain.resolutions(data) attributes = extract_attributes(res) convert_to_records attributes, "ip_address" end
lookup_by_ip(data)
click to toggle source
# File lib/ukemi/services/virustotal.rb, line 19 def lookup_by_ip(data) res = api.ip_address.resolutions(data) attributes = extract_attributes(res) convert_to_records attributes, "host_name" end