class Ukemi::Services::VirusTotal

Private Instance Methods

api() click to toggle source
# File lib/ukemi/services/virustotal.rb, line 15
def api
  @api ||= ::VirusTotal::API.new
end
config_keys() click to toggle source
# File lib/ukemi/services/virustotal.rb, line 11
def config_keys
  %w[VIRUSTOTAL_API_KEY]
end
convert_to_records(attributes, key = nil) click to toggle source
# File lib/ukemi/services/virustotal.rb, line 38
def convert_to_records(attributes, key = nil)
  memo = Hash.new { |h, k| h[k] = [] }

  attributes.each do |attribute|
    data = attribute[key]
    date = Time.at(attribute["date"]).to_date.to_s
    memo[data] << date
  end

  memo.keys.map do |data|
    Record.new(
      data: data,
      first_seen: memo[data].min,
      last_seen: memo[data].max,
      source: name
    )
  end
end
extract_attributes(response) click to toggle source
# File lib/ukemi/services/virustotal.rb, line 31
def extract_attributes(response)
  data = response["data"] || []
  data.map do |item|
    item["attributes"] || []
  end
end
lookup_by_domain(data) click to toggle source
# File lib/ukemi/services/virustotal.rb, line 25
def lookup_by_domain(data)
  res = api.domain.resolutions(data)
  attributes = extract_attributes(res)
  convert_to_records attributes, "ip_address"
end
lookup_by_ip(data) click to toggle source
# File lib/ukemi/services/virustotal.rb, line 19
def lookup_by_ip(data)
  res = api.ip_address.resolutions(data)
  attributes = extract_attributes(res)
  convert_to_records attributes, "host_name"
end