Class: ActiveStix::EmailMessage

Inherits:
ApplicationRecord show all
Defined in:
app/models/active_stix/email_message.rb

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.body_multipart(mail) ⇒ Object 



91
92
93
94
95
96
97
 
# File 'app/models/active_stix/email_message.rb', line 91

def self.body_multipart(mail)
  if mail.multipart?
    mail.parts.collect {|part| part.mime_type}
  else
    nil
  end
end

.create_from(mail, eml) ⇒ Object

TODO The two methods below can definitely be consolidated to one. Make sure to do so.



142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
 
# File 'app/models/active_stix/email_message.rb', line 142

def self.create_from(mail, eml)
  if mail.header["From"]
    mail.header["From"].address_list.addresses.each do |address|
       = UserAccount.where("lower(user_id) = ?", address.address.downcase).first
      fname, lname, medium = extract_info_from_address_header(address.display_name)
      #TODO Create an identity here so it can be linked to the user account and email address
      if .nil?
        identity = create_identity(address.address.downcase, address.name)
         = UserAccount.create(user_id: address.address.downcase, account_login: get_name_from_address(address.address), display_name: address.name, is_service_account: false, is_privileged: false, can_escalate_privs: false, is_disabled: false, identity_id: identity.id)
        identity.user_accounts << 
      else
        identity = .identity
      end
      email_address = EmailAddress.where("lower(value) = ?", address.address.downcase).first
      if email_address.nil?
        email_address = EmailAddress.create(value: address.address.downcase, display_name: address.name, belongs_to_ref: .id, identity_id: identity.id)
      end

      return email_address
    end
  end

end

.create_identity(address, display_name) ⇒ Object 



225
226
227
228
229
230
231
232
233
 
# File 'app/models/active_stix/email_message.rb', line 225

def self.create_identity(address, display_name)
  #TODO figure out where to get the details for whether for identity_class, description etc.
  identity = Identity.create(name: display_name || Mail::Address.new(address).local, contact_information: {email_addresses: [address]}, identity_class: 'individual')

  organization = from_domain_identity(address)
  ActiveStix::Identity.employ(identity, organization)

  return identity
end

.create_recipient_type_ref(recipient_type, email_message, email_address) ⇒ Object 



213
214
215
216
217
218
219
220
221
222
223
 
# File 'app/models/active_stix/email_message.rb', line 213

def self.create_recipient_type_ref(recipient_type, email_message, email_address)

  case recipient_type
  when "To"
    ToRef.create(email_message: email_message, email_address: email_address)
  when "CC"
    CcRef.create(email_message: email_message, email_address: email_address)
  when "BCC"
    BccRef.create(email_message: email_message, email_address: email_address)
  end
end

.create_recipients(mail, eml, email_message) ⇒ Object 



127
128
129
130
131
132
133
134
135
136
137
138
139
 
# File 'app/models/active_stix/email_message.rb', line 127

def self.create_recipients(mail, eml, email_message)
  if mail.header["To"]
    get_recipients_by_type("To", mail, eml, email_message)
  end

  if mail.header["CC"]
    get_recipients_by_type("CC", mail, eml, email_message)
  end

  if mail.header["BCC"]
    get_recipients_by_type("BCC", mail, eml, email_message)
  end
end

.create_sender(mail, eml) ⇒ Object 



166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
 
# File 'app/models/active_stix/email_message.rb', line 166

def self.create_sender(mail, eml)
  if mail.from.any?
    address = mail.from.first
     = UserAccount.where("lower(user_id) = ?", address.downcase).first
    #TODO Create an identity here so it can be linked to the user account and email address
    if .nil?
      identity = create_identity(address, address)
       = UserAccount.create(user_id: address, account_login: get_name_from_address(address), display_name: address, is_service_account: false, is_privileged: false, can_escalate_privs: false, is_disabled: false, identity_id: identity.id)
      identity.users_accounts << 
    else
      identity = .identity
    end
    email_address = EmailAddress.where("lower(value) = ?", address.downcase).first
    if email_address.nil?
      email_address = EmailAddress.create(value: address, display_name: address, belongs_to_ref: .id, identity_id: identity.id)
    end
    return email_address
  end
end

.extract_info_from_address_header(descriptive_name) ⇒ Object 



103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
 
# File 'app/models/active_stix/email_message.rb', line 103

def self.extract_info_from_address_header(descriptive_name)
  descriptive_name = descriptive_name.to_s
  descriptive_name.gsub!('\"', '')
  temp = descriptive_name.split(' via ')
  fullname = temp[0].to_s
  if temp.size > 1
    medium = temp[1]
  end
  if not fullname.lstrip().start_with?('<')
    name_parts = fullname.split(',')
    if name_parts.size > 1
      last_name = name_parts[0]
      first_name = name_parts[1].lstrip()
    else
      name_parts = fullname.split(' ')
      if name_parts.size > 1
        first_name = name_parts[0]
        last_name = name_parts[1]
      end
    end
  end
  return first_name, last_name, medium
end

.find_or_create_user_account(email, aliasname) ⇒ Object 



267
268
269
270
271
272
273
274
275
276
277
278
 
# File 'app/models/active_stix/email_message.rb', line 267

def self.(email, aliasname)
  if email.agent.nil?
    agent = Agent.create
    agent.emails << email
  else
    agent = email.agent
    unless agent.emails.where(alias: aliasname).any?
      agent.emails << email
    end
  end
  return agent
end

.from_domain_identity(address) ⇒ Object

NOTE Instance method created for the class to use



236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
 
# File 'app/models/active_stix/email_message.rb', line 236

def self.from_domain_identity(address)
  org_name = Organization.company_from_email_address(address)
  public_suffix = Organization.public_suffix_from_email_address(address)

  organization = ActiveStix::Identity.find_or_create_by(name: org_name + public_suffix, identity_class: "organization")

  if organization.contact_information.nil?
    organization.update_attribute("contact_information", {domain: org_name, public_suffix: public_suffix})
  else
    contact_information = organization.contact_information
    contact_information["public_suffix"] = public_suffix
    organization.contact_information = contact_information
    organization.save
  end

  freemail = ActiveStix::AttackPattern.find_by(name: "Free email")
  if freemail and freemail.targets?(organization)
    personal_organization = ActiveStix::Identity.find_or_create_by(name: address, identity_class: "organization")
    ActiveStix::Identity.employ(identity, personal_organization)
  end
  organization
end

.from_eml(eml) ⇒ Object 



53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
 
# File 'app/models/active_stix/email_message.rb', line 53

def self.from_eml(eml)
  eml = eml.encode(Encoding.find('UTF-8'), {invalid: :replace, undef: :replace, replace: ''}).sub("\xEF\xBB\xBF".force_encoding('UTF-8'), "").gsub("\r", "").unicode_normalize(:nfkc)
  mail = Mail.new(eml)

  #TODO Add details for cc_refs, bcc_refs etc. from the email message object

  is_multipart = mail.multipart?
  date = mail.date
  content_type = mail.content_type
  from = create_from(mail, eml)
  sender_ref = create_sender(mail, eml)
  subject = mail.header["Subject"] ? mail.header["Subject"].value : ""
  received_lines = mail.header["Received"]

  #TODO add the appropriate details here later
  #TODO late make additional header fields more specific, check stix spec
  email_message = EmailMessage.create(
      "is_multipart": is_multipart,
      "date": date,
      "content_type": content_type,
      "from": from,
      "sender_ref": sender_ref,
      "subject": subject,
      "received_lines": received_lines,
      "additional_header_fields": mail.header,
      "body": mail.body,
      "body_multipart": body_multipart(mail),
      "raw_email_ref": raw_email_artifact(mail).stix_id
  )
  create_recipients(mail, eml, email_message)

  email_message
end

.get_name_from_address(address) ⇒ Object 



263
264
265
 
# File 'app/models/active_stix/email_message.rb', line 263

def self.get_name_from_address(address)
  return address.split('@')[0]
end

.get_recipients_by_type(recipient_type, mail, eml, email_message) ⇒ Object 



186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
 
# File 'app/models/active_stix/email_message.rb', line 186

def self.get_recipients_by_type(recipient_type, mail, eml, email_message)
  return if mail.header[recipient_type].errors.any? # todo we should throw and catch an exception here
  mail.header[recipient_type].each do |address|
    # TODO this will be the user account
     = UserAccount.where("lower(user_id) = ?", address.address.downcase).first

    fname, lname, medium = extract_info_from_address_header(address.display_name)

    #TODO Create an identity here so it can be linked to the user account and email address
    if .nil?
      identity = create_identity(address.address.downcase, address.name)
       = identity.user_accounts.create(user_id: address.address, account_login: get_name_from_address(address.address), display_name: address.name, is_service_account: false, is_privileged: false, can_escalate_privs: false, is_disabled: false)
    else
      identity = .identity
    end

    # TODO this will be the email address
    email_address = EmailAddress.where("lower(value) = ?", address.address.downcase).first
    if email_address.nil?
      email_address = EmailAddress.create(value: address.address.downcase, display_name: address.name, belongs_to_ref: .id, identity_id: identity.id)
    end

    # Create header specific refs 
    create_recipient_type_ref(recipient_type, email_message, email_address)
  end
end

.raw_email_artifact(eml) ⇒ Object 



87
88
89
 
# File 'app/models/active_stix/email_message.rb', line 87

def self.raw_email_artifact(eml)
  artifact = Artifact.create_from_eml(eml)
end

Instance Method Details

#as_stix ⇒ Object 



308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
 
# File 'app/models/active_stix/email_message.rb', line 308

def as_stix

  as_json(only: []).tap do |hash|
    # hash["x_panacea_id"] = "<#{id}>".force_encoding("utf-8")
    hash["type"] = "email-message"

    mail = Mail.new(raw_email_artifact.payload_bin)
    hash["date"] = mail.date.utc.iso8601(3)

    #  todo fix this when jpl turns on stix
    hash["is_multipart"] = false

    # if mail.multipart?
    #   stix_parts = mail.parts.collect do |part|
    #     {
    #         "content_type" => part.content_type.to_s,
    #         "content_disposition" => part.content_transfer_encoding.to_s,
    #         "body" => Digest::SHA1.hexdigest(part.to_s)
    #     }
    #   end.to_a
    #   hash["body_multipart"] = stix_parts
    # else
    #   hash["body"] = eml.readable
    # end

    hash
  end
end

#from_domain_identity ⇒ Object 



259
260
261
 
# File 'app/models/active_stix/email_message.rb', line 259

def from_domain_identity
  ActiveStix::EmailMessage.from_domain_identity(from.value)
end

#from_identity ⇒ Object 



25
26
27
 
# File 'app/models/active_stix/email_message.rb', line 25

def from_identity
  from.identity
end

#identities ⇒ Object 



29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
 
# File 'app/models/active_stix/email_message.rb', line 29

def identities
  ids = [from.identity]
  to_refs.each do |tr|
    ids << tr.email_address.identity
  end

  cc_refs.each do |ccr|
    ids << ccr.email_address.identity
  end

  bcc_refs.each do |bccr|
    ids << bccr.email_address.identity
  end
  ids.uniq
end

#mail ⇒ Object 



304
305
306
 
# File 'app/models/active_stix/email_message.rb', line 304

def mail
  Mail.new(eml.raw_source)
end

#mail_server ⇒ Object 



45
46
47
 
# File 'app/models/active_stix/email_message.rb', line 45

def mail_server
  Mail.new(raw_email_artifact.payload_bin).message_id.split(/[@\.]/)[-3..-1]
end

#primary_observed_datum ⇒ Object 



21
22
23
 
# File 'app/models/active_stix/email_message.rb', line 21

def primary_observed_datum
  observed_data.first
end

#readable ⇒ Object 



49
50
51
 
# File 'app/models/active_stix/email_message.rb', line 49

def readable
  eml.readable
end

#stix_references ⇒ Object 



280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
 
# File 'app/models/active_stix/email_message.rb', line 280

def stix_references
  object_refs = {}
  object_index = 1
  [to_refs, cc_refs, bcc_refs].each do |field|
    field.each do |ref|
      object_refs[{

                      "type": "email-addr",
                      "value": ref.email_address.value.to_s,
                      "display_name": ref.email_address.display_name.to_s
                  }] = object_index.to_s
      object_index += 1
    end
  end
  object_refs[{

                  "type": "email-addr",
                  "value": from.value.to_s,
                  "display_name": from.display_name.to_s
              }] = object_index.to_s
  object_refs
end

#type ⇒ Object 



99
100
101
 
# File 'app/models/active_stix/email_message.rb', line 99

def type
  return "email-message"
end