class URLhausMonitor::Entry

Attributes

asnumber[R]
country[R]
date_added[R]
host[R]
ip_address[R]
threat[R]
url[R]
url_status[R]

Public Class Methods

new(line) click to toggle source
# File lib/urlhaus_monitor/entry.rb, line 16
def initialize(line)
  parts = CSV.parse(line.chomp).flatten
  raise ArgumentError, "#{line} is not valid." unless parts.length == 8 || parts.length == 9

  if parts.length == 8
    parse_without_tags parts
  else
    parse_with_tags parts
  end
end

Public Instance Methods

actions() click to toggle source
# File lib/urlhaus_monitor/entry.rb, line 69
def actions
  [vt_link, urlscan_link, urlhaus_link].compact
end
defanged_host() click to toggle source
# File lib/urlhaus_monitor/entry.rb, line 31
def defanged_host
  @defanged_host ||= host.gsub(/\./, "[.]")
end
defanged_url() click to toggle source
# File lib/urlhaus_monitor/entry.rb, line 27
def defanged_url
  @defanged_url ||= url.gsub(/\./, "[.]")
end
title() click to toggle source
# File lib/urlhaus_monitor/entry.rb, line 35
def title
  "#{defanged_url} (#{defanged_host} / #{ip_address} / #{date_added}) : #{threat}"
end
to_attachements() click to toggle source
# File lib/urlhaus_monitor/entry.rb, line 73
def to_attachements
  [
    {
      text: defanged_host,
      fallback: "VT & urlscan.io links",
      actions: actions
    }
  ]
end

Private Instance Methods

parse_with_tags(parts) click to toggle source
# File lib/urlhaus_monitor/entry.rb, line 108
def parse_with_tags(parts)
  @date_added = parts.shift
  @url = parts.shift
  @url_status = parts.shift
  @threat = parts.shift
  @tags = parts.shift
  @host = parts.shift
  @ip_address = parts.shift
  @asnumber = parts.shift
  @country = parts.shift
end
parse_without_tags(parts) click to toggle source
# File lib/urlhaus_monitor/entry.rb, line 97
def parse_without_tags(parts)
  @date_added = parts.shift
  @url = parts.shift
  @url_status = parts.shift
  @threat = parts.shift
  @host = parts.shift
  @ip_address = parts.shift
  @asnumber = parts.shift
  @country = parts.shift
end