Merge pull request #1013 from ninoseki/add-vulnerabilities

feat: add vulnerabilities table
ninoseki · Jan 13, 2024 · f90dc9d · f90dc9d
2 parents 1598ca8 + 54863f7
commit f90dc9d
Show file tree

Hide file tree

Showing 45 changed files with 380 additions and 118 deletions.
diff --git a/docs/diagrams.md b/docs/diagrams.md
@@ -37,6 +37,7 @@ classDiagram
   }
   Artifact --* Alert
   Artifact *-- CPE
+  Artifact *-- Vulnerability
   Artifact *-- DnsRecord
   Artifact *-- Port
   Artifact *-- ReverseDnsName
@@ -48,28 +49,36 @@ classDiagram
 
   class AutonomousSystem {
     integer id
-    integer asn
+    integer number
     datetime created_at
     integer artifact_id
   }
   AutonomousSystem --* Artifact
 
   class Port {
     integer id
-    integer port
+    integer number
     datetime created_at
     integer artifact_id
   }
   Port --* Artifact
 
   class CPE {
     integer id
-    string cpe
+    string name
     datetime created_at
     integer artifact_id
   }
   CPE --* Artifact
 
+  class Vulnerability {
+    integer id
+    string name
+    datetime created_at
+    integer artifact_id
+  }
+  Vulnerability --* Artifact
+
   class DnsRecord {
     integer id
     string resource
@@ -131,96 +140,103 @@ classDiagram
 ```mermaid
 erDiagram
     alerts {
-        datetime6 created_at
-        INTEGER id PK
+        datetime created_at
+        integer id PK
         varchar rule_id FK
     }
 
     artifacts {
-        INTEGER alert_id FK
-        datetime6 created_at
+        integer alert_id FK
+        datetime created_at
         varchar data
         varchar data_type
-        INTEGER id PK
+        integer id PK
         json metadata
         varchar query
         varchar source
     }
 
     autonomous_systems {
-        INTEGER artifact_id FK
-        INTEGER asn
-        datetime6 created_at
-        INTEGER id PK
+        integer artifact_id FK
+        integer number
+        datetime created_at
+        integer id PK
     }
 
     cpes {
-        INTEGER artifact_id FK
-        varchar cpe
-        datetime6 created_at
-        INTEGER id PK
+        integer artifact_id FK
+        varchar name
+        datetime created_at
+        integer id PK
+    }
+
+    vulnerabilities {
+        integer artifact_id FK
+        varchar name
+        datetime created_at
+        integer id PK
     }
 
     dns_records {
-        INTEGER artifact_id FK
-        datetime6 created_at
-        INTEGER id PK
+        integer artifact_id FK
+        datetime created_at
+        integer id PK
         varchar resource
         varchar value
     }
 
     geolocations {
-        INTEGER artifact_id FK
+        integer artifact_id FK
         varchar country
         varchar country_code
-        datetime6 created_at
-        INTEGER id PK
+        datetime created_at
+        integer id PK
     }
 
     ports {
-        INTEGER artifact_id FK
-        datetime6 created_at
-        INTEGER id PK
-        INTEGER port
+        integer artifact_id FK
+        datetime created_at
+        integer id PK
+        integer number
     }
 
     reverse_dns_names {
-        INTEGER artifact_id FK
-        datetime6 created_at
-        INTEGER id PK
+        integer artifact_id FK
+        datetime created_at
+        integer id PK
         varchar name
     }
 
     rules {
-        datetime6 created_at
+        datetime created_at
         json data
         varchar description
         varchar id PK
         varchar title
-        datetime6 updated_at
+        datetime updated_at
     }
 
     taggings {
-        datetime6 created_at
-        INTEGER id PK
+        datetime created_at
+        integer id PK
         varchar rule_id
-        INTEGER tag_id
+        integer tag_id
     }
 
     tags {
-        datetime6 created_at
-        INTEGER id PK
+        datetime created_at
+        integer id PK
         varchar name
     }
 
     whois_records {
-        INTEGER artifact_id FK
+        integer artifact_id FK
         json contacts
-        datetime6 created_at
+        datetime created_at
         date created_on
         varchar domain
         date expires_on
-        INTEGER id PK
+        integer id PK
         json registrar
         date updated_on
     }
@@ -229,6 +245,7 @@ erDiagram
     artifacts }o--|| alerts : "alert_id"
     autonomous_systems }o--|| artifacts : "artifact_id"
     cpes }o--|| artifacts : "artifact_id"
+    vulnerabilities }o--|| artifacts : "artifact_id"
     dns_records }o--|| artifacts : "artifact_id"
     geolocations }o--|| artifacts : "artifact_id"
     ports }o--|| artifacts : "artifact_id"

diff --git a/docs/enrichers/google_public_dns.md b/docs/enrichers/google_public_dns.md
@@ -13,6 +13,10 @@ This enricher uses Google Public DNS to enrich an URL and domain artifact.
 enricher: google_public_dns
 ```
 
+This enricher can add the following components:
+
+- DNS records
+
 ## Supported Artifacts
 
 - URL

diff --git a/docs/enrichers/mmdb.md b/docs/enrichers/mmdb.md
@@ -14,6 +14,11 @@ This enricher uses public MMDB API to enrich an IP artifact.
 enricher: mmdb
 ```
 
+This enricher can add the following components:
+
+- Geolocation
+- Autonomous System
+
 ## Supported Artifacts
 
 - IP address
diff --git a/docs/enrichers/shodan.md b/docs/enrichers/shodan.md
@@ -3,6 +3,7 @@ tags:
   - Enrichment:Port
   - Enrichment:CPE
   - Enrichment:Reverse_DNS_Name
+  - Enrichment:Vulnerability
 ---
 
 # Shodan (The InternetDB API)
@@ -17,6 +18,13 @@ This enricher uses Shodan InternetDB API to enrich an artifact.
 enricher: shodan
 ```
 
+This enricher can add the following components:
+
+- Ports
+- CPEs
+- Reverse DNS names
+- Vulnerabilities
+
 ## Supported Artifacts
 
 - IP address
diff --git a/docs/enrichers/whois.md b/docs/enrichers/whois.md
@@ -1,6 +1,6 @@
 ---
 tags:
-  - Enrichment:Whois
+  - Enrichment:Whois_Record
 ---
 
 # Whois
@@ -11,6 +11,10 @@ This enricher uses “whois” command to enrich an artifact.
 enricher: whois
 ```
 
+This enricher can add the following components:
+
+- Whois record
+
 ## Supported Artifacts
 
 - URL

diff --git a/docs/usage.md b/docs/usage.md
@@ -173,12 +173,12 @@ Search query supports `AND`, `OR`, `:`, `=`, `!=`, `<`, `<=`, `>`, `>=`, `NOT` a
 
 Searchable fields are:
 
-| Type       | Searchable fields                                                                                                                                                                                                            |
-| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `alert`    | `id`, `tag`, `created_at`, `rule.id`, `rule.title`, `rule.description`, `artifact.data`, `artifact.data_type`, `artifact.source` and `artifact.query`                                                                        |
-| `artifact` | `id`, `data`, `data_type`, `source`, `query`, `tag`, `rule.id`, `rule.title`, `rule.description`, `tag`,`created_at`, `asn`, `country_code`, `dns_record.value`, `dns_record.resource`, `reverse_dns_name`, `cpe` and `port` |
-| `rule`     | `id`, `title`, `description`, `tag`, `created_at` and `updated_at`                                                                                                                                                           |
-| `tag`      | `id` and `name`                                                                                                                                                                                                              |
+| Type       | Searchable fields                                                                                                                                                                                                                    |
+| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `alert`    | `id`, `tag`, `created_at`, `rule.id`, `rule.title`, `rule.description`, `artifact.data`, `artifact.data_type`, `artifact.source` and `artifact.query`                                                                                |
+| `artifact` | `id`, `data`, `data_type`, `source`, `query`, `tag`, `rule.id`, `rule.title`, `rule.description`, `tag`,`created_at`, `asn`, `country_code`, `dns_record.value`, `dns_record.resource`, `reverse_dns_name`, `cpe`, `vuln` and `port` |
+| `rule`     | `id`, `title`, `description`, `tag`, `created_at` and `updated_at`                                                                                                                                                                   |
+| `tag`      | `id` and `name`                                                                                                                                                                                                                      |
 
 **Examples**
 

diff --git a/frontend/src/components/artifact/AS.vue b/frontend/src/components/artifact/AS.vue
@@ -1,7 +1,7 @@
 <template>
   <div class="tags are-medium">
     <span class="tag">
-      {{ autonomousSystem.asn }}
+      {{ autonomousSystem.number }}
     </span>
   </div>
 </template>

diff --git a/frontend/src/components/artifact/ArtifactDetail.vue b/frontend/src/components/artifact/ArtifactDetail.vue
@@ -83,6 +83,10 @@
       <h4 class="is-size-4 mb-2">CPEs</h4>
       <CPEs :cpes="artifact.cpes"></CPEs>
     </div>
+    <div class="block" v-if="artifact.vulnerabilities">
+      <h4 class="is-size-4 mb-2">Vulnerabilities</h4>
+      <Vulnerabilities :vulnerabilities="artifact.vulnerabilities"></Vulnerabilities>
+    </div>
     <div class="block" v-if="artifact.ports">
       <h4 class="is-size-4 mb-2">Ports</h4>
       <Ports :ports="artifact.ports"></Ports>
@@ -111,6 +115,7 @@ import DnsRecords from "@/components/artifact/DnsRecords.vue"
 import Ports from "@/components/artifact/Ports.vue"
 import ReverseDnsNames from "@/components/artifact/ReverseDnsNames.vue"
 import Tags from "@/components/artifact/Tags.vue"
+import Vulnerabilities from "@/components/artifact/Vulnerabilities.vue"
 import WhoisRecord from "@/components/artifact/WhoisRecord.vue"
 import ErrorMessage from "@/components/ErrorMessage.vue"
 import Links from "@/components/link/Links.vue"
@@ -137,7 +142,8 @@ export default defineComponent({
     CPEs,
     Ports,
     ErrorMessage,
-    Message
+    Message,
+    Vulnerabilities
   },
   emits: ["refresh", "delete"],
   setup(props, context) {

diff --git a/frontend/src/components/artifact/ArtifactsWrapper.vue b/frontend/src/components/artifact/ArtifactsWrapper.vue
@@ -34,8 +34,8 @@
           <code>query</code>, <code>tag</code>, <code>rule.id</code>, <code>rule.title</code>,
           <code>rule.description</code>, <code>tag</code>,<code>created_at</code>, <code>asn</code>,
           <code>country_code</code>, <code>dns_record.value</code>,
-          <code>dns_record.resource</code>, <code>reverse_dns_name</code>, <code>cpe</code> and
-          <code>port</code>.
+          <code>dns_record.resource</code>, <code>reverse_dns_name</code>, <code>cpe</code>,
+          <code>vuln</code> and <code>port</code>.
         </li>
       </ul>
     </div>

diff --git a/frontend/src/components/artifact/CPEs.vue b/frontend/src/components/artifact/CPEs.vue
@@ -1,7 +1,7 @@
 <template>
   <div class="tags are-medium">
-    <span class="tag" v-for="cpe in cpes" :key="cpe.cpe">
-      {{ cpe.cpe }}
+    <span class="tag" v-for="cpe in cpes" :key="cpe.name">
+      {{ cpe.name }}
     </span>
   </div>
 </template>

diff --git a/frontend/src/components/artifact/Ports.vue b/frontend/src/components/artifact/Ports.vue
@@ -1,7 +1,7 @@
 <template>
   <div class="tags are-medium">
-    <span class="tag" v-for="port in ports" :key="port.port">
-      {{ port.port }}
+    <span class="tag" v-for="port in ports" :key="port.number">
+      {{ port.number }}
     </span>
   </div>
 </template>

diff --git a/frontend/src/components/artifact/Vulnerabilities.vue b/frontend/src/components/artifact/Vulnerabilities.vue
@@ -0,0 +1,23 @@
+<template>
+  <div class="tags are-medium">
+    <span class="tag" v-for="vuln in vulnerabilities" :key="vuln.name">
+      {{ vuln.name }}
+    </span>
+  </div>
+</template>
+
+<script lang="ts">
+import { defineComponent, type PropType } from "vue"
+
+import type { Vulnerability } from "@/types"
+
+export default defineComponent({
+  name: "VulnerabilitiesItem",
+  props: {
+    vulnerabilities: {
+      type: Array as PropType<Vulnerability[]>,
+      required: true
+    }
+  }
+})
+</script>