client

package
v0.1.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 24, 2026 License: MPL-2.0 Imports: 12 Imported by: 0

Documentation

Overview

Package client is a minimal HTTP client for the MISP REST API.

Package client provides types and helpers for interacting with the MISP REST API.

DomainList exists to absorb MISP's four-way inconsistency in how restricted_to_domain is serialised depending on which endpoint produced the response and whether the field has content:

  • POST /admin/organisations/add (empty) → JSON null
  • GET /organisations/view (empty) → JSON array []
  • GET /organisations/view (populated)→ JSON array ["example.com"]
  • POST /admin/organisations/edit (empty) → JSON string "[]"
  • POST /admin/organisations/edit (populated)→ JSON string "[\"example.com\"]"

The edit endpoint double-encodes: it JSON-stringifies the array and then wraps that string in a JSON string. This is a MISP bug that we absorb here so the rest of the provider always works with a plain []string.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func IsNotFound 

func IsNotFound(err error) bool

IsNotFound reports whether the error represents a 404 from MISP.

Types

type APIError 

type APIError struct {
	StatusCode int
	Method     string
	Path       string
	Body       string
}

APIError is returned when MISP responds with a non-2xx status.

func (*APIError) Error 

func (e *APIError) Error() string

type Client 

type Client struct {
	// contains filtered or unexported fields
}

Client talks to a MISP instance over its REST API.

func New 

func New(cfg Config) (*Client, error)

New returns a configured MISP client.

func (*Client) AddSharingGroupMember 

func (c *Client) AddSharingGroupMember(ctx context.Context, sgID, orgID string) error

AddSharingGroupMember adds the given organisation to the sharing group.

func (*Client) AddSharingGroupServer 

func (c *Client) AddSharingGroupServer(ctx context.Context, sgID, serverID string) error

AddSharingGroupServer adds a server to a sharing group.

func (*Client) CreateFeed 

func (c *Client) CreateFeed(ctx context.Context, f Feed) (*Feed, error)

CreateFeed creates a feed.

func (*Client) CreateGalaxyCluster 

func (c *Client) CreateGalaxyCluster(ctx context.Context, galaxyID string, gc GalaxyCluster) (*GalaxyCluster, error)

CreateGalaxyCluster creates a new custom galaxy cluster inside the given galaxy. The GalaxyCluster.Default field is always set to false by MISP for user-created clusters — callers must not set it.

func (*Client) CreateOrganisation 

func (c *Client) CreateOrganisation(ctx context.Context, o Organisation) (*Organisation, error)

CreateOrganisation creates an organisation. MISP's admin API returns the created object.

func (*Client) CreateRole 

func (c *Client) CreateRole(ctx context.Context, r Role) (*Role, error)

CreateRole creates a new MISP role.

func (*Client) CreateServer 

func (c *Client) CreateServer(ctx context.Context, s Server) (*Server, error)

CreateServer posts the server config. MISP 2.5.x returns 500 from /servers/add even when the server is created successfully, so we tolerate 5xx here and verify by looking the server up by name in the index. If a future MISP version fixes the 500, the happy path returns first and the workaround never fires.

func (*Client) CreateSharingGroup 

func (c *Client) CreateSharingGroup(ctx context.Context, sg SharingGroup) (*SharingGroup, error)

CreateSharingGroup creates a sharing group.

func (*Client) CreateTag 

func (c *Client) CreateTag(ctx context.Context, t Tag) (*Tag, error)

CreateTag creates a tag.

func (*Client) CreateUser 

func (c *Client) CreateUser(ctx context.Context, u User) (*User, error)

CreateUser creates a new user. MISP may auto-generate an authkey and send a welcome email, depending on instance configuration.

func (*Client) DeleteFeed 

func (c *Client) DeleteFeed(ctx context.Context, id string) error

DeleteFeed removes a feed. MISP's API uses DELETE here.

func (*Client) DeleteGalaxyCluster 

func (c *Client) DeleteGalaxyCluster(ctx context.Context, id string) error

DeleteGalaxyCluster soft-deletes a galaxy cluster. MISP marks the record as deleted=true rather than removing it; subsequent GET calls return HTTP 200 with deleted=true, which the provider treats as absent.

func (*Client) DeleteOrganisation 

func (c *Client) DeleteOrganisation(ctx context.Context, id string) error

DeleteOrganisation removes an organisation.

func (*Client) DeleteRole 

func (c *Client) DeleteRole(ctx context.Context, id string) error

DeleteRole removes a MISP role.

func (*Client) DeleteServer 

func (c *Client) DeleteServer(ctx context.Context, id string) error

DeleteServer removes a server. Unlike add/edit, /servers/delete returns a normal 200 response and does not suffer from the 500 quirk.

func (*Client) DeleteSharingGroup 

func (c *Client) DeleteSharingGroup(ctx context.Context, id string) error

DeleteSharingGroup removes a sharing group. MISP's API documents DELETE here (unlike organisations/tags which accept POST).

func (*Client) DeleteTag 

func (c *Client) DeleteTag(ctx context.Context, id string) error

DeleteTag removes a tag.

func (*Client) DeleteUser 

func (c *Client) DeleteUser(ctx context.Context, id string) error

DeleteUser removes a user. MISP's API documents DELETE for this endpoint.

func (*Client) DisableNoticelist 

func (c *Client) DisableNoticelist(ctx context.Context, id string) error

DisableNoticelist sets enabled=false (idempotent: reads current state first).

func (*Client) DisableTaxonomy 

func (c *Client) DisableTaxonomy(ctx context.Context, id string) error

DisableTaxonomy marks a taxonomy disabled (idempotent on MISP's side).

func (*Client) DisableWarninglist 

func (c *Client) DisableWarninglist(ctx context.Context, id string) error

DisableWarninglist marks a warninglist disabled (idempotent on MISP's side).

func (*Client) EnableNoticelist 

func (c *Client) EnableNoticelist(ctx context.Context, id string) error

EnableNoticelist sets enabled=true (idempotent: reads current state first).

func (*Client) EnableTaxonomy 

func (c *Client) EnableTaxonomy(ctx context.Context, id string) error

EnableTaxonomy marks a taxonomy enabled (idempotent on MISP's side).

func (*Client) EnableWarninglist 

func (c *Client) EnableWarninglist(ctx context.Context, id string) error

EnableWarninglist marks a warninglist enabled (idempotent on MISP's side).

func (*Client) FindNoticelistByName 

func (c *Client) FindNoticelistByName(ctx context.Context, name string) (*Noticelist, error)

FindNoticelistByName returns the noticelist with the given name, or a NotFound APIError if none matches.

func (*Client) FindTaxonomyByNamespace 

func (c *Client) FindTaxonomyByNamespace(ctx context.Context, namespace string) (*Taxonomy, error)

FindTaxonomyByNamespace returns the taxonomy with the given namespace, or a NotFound APIError if none matches.

func (*Client) FindWarninglistByName 

func (c *Client) FindWarninglistByName(ctx context.Context, name string) (*Warninglist, error)

FindWarninglistByName returns the warninglist with the given name, or a NotFound APIError if none matches.

func (*Client) GetFeed 

func (c *Client) GetFeed(ctx context.Context, id string) (*Feed, error)

GetFeed fetches a feed by id.

func (*Client) GetGalaxyCluster 

func (c *Client) GetGalaxyCluster(ctx context.Context, id string) (*GalaxyCluster, error)

GetGalaxyCluster fetches a galaxy cluster by numeric id.

func (*Client) GetNoticelist 

func (c *Client) GetNoticelist(ctx context.Context, id string) (*Noticelist, error)

GetNoticelist fetches a noticelist by id.

func (*Client) GetOrganisation 

func (c *Client) GetOrganisation(ctx context.Context, id string) (*Organisation, error)

GetOrganisation fetches a single organisation by id or uuid.

func (*Client) GetRole 

func (c *Client) GetRole(ctx context.Context, id string) (*Role, error)

GetRole fetches a role by id. MISP has no single-role endpoint; we list all roles and filter. A synthetic 404 APIError is returned when the id is not found.

func (*Client) GetServer 

func (c *Client) GetServer(ctx context.Context, id string) (*Server, error)

GetServer fetches a server by id. Because MISP offers no /servers/view/{id} endpoint, this filters the full index returned by /servers/index. A synthesised 404 APIError is returned when the id is not present so that IsNotFound keeps working for the resource's Read method.

func (*Client) GetSetting 

func (c *Client) GetSetting(ctx context.Context, name string) (*Setting, error)

GetSetting fetches a single MISP server setting by its dotted name (e.g. "MISP.baseurl"). Returns a NotFound APIError for unknown names.

func (*Client) GetSharingGroup 

func (c *Client) GetSharingGroup(ctx context.Context, id string) (*SharingGroup, error)

GetSharingGroup fetches a sharing group by id.

func (*Client) GetTag 

func (c *Client) GetTag(ctx context.Context, id string) (*Tag, error)

GetTag fetches a tag by numeric id.

Note: MISP's /tags/view endpoint returns a bare Tag object rather than the {"Tag": {...}} envelope used by /tags/add and /tags/edit. We therefore decode directly into Tag here.

func (*Client) GetTaxonomy 

func (c *Client) GetTaxonomy(ctx context.Context, id string) (*Taxonomy, error)

GetTaxonomy fetches a taxonomy by id.

func (*Client) GetUser 

func (c *Client) GetUser(ctx context.Context, id string) (*User, error)

GetUser fetches a user by id.

func (*Client) GetWarninglist 

func (c *Client) GetWarninglist(ctx context.Context, id string) (*Warninglist, error)

GetWarninglist fetches a warninglist by id.

func (*Client) IsSharingGroupMember 

func (c *Client) IsSharingGroupMember(ctx context.Context, sgID, orgID string) (bool, error)

IsSharingGroupMember checks whether orgID is a member of sgID. It returns (true, nil) if the org is present, (false, nil) if the sharing group exists but the org is not a member, or (false, err) on any API error.

func (*Client) IsSharingGroupServer 

func (c *Client) IsSharingGroupServer(ctx context.Context, sgID, serverID string) (bool, error)

IsSharingGroupServer returns whether serverID is a member of the sharing group sgID. It scans the SharingGroupServer array in GET /sharing_groups/view/{sgId}. Returns (true, nil) if present, (false, nil) if the SG exists but the server is not listed, or (false, err) on any API error.

func (*Client) ListNoticelists 

func (c *Client) ListNoticelists(ctx context.Context) ([]Noticelist, error)

ListNoticelists returns all noticelists known to the instance. Used to resolve a name to a numeric id, since MISP has no view-by-name endpoint. The index response is a flat array: [{"Noticelist": {...}}, ...]. This is different from warninglists, which are double-wrapped.

func (*Client) ListServers 

func (c *Client) ListServers(ctx context.Context) ([]Server, error)

ListServers returns all servers visible to the authenticated user. The index response is an array of rich objects; we return just the Server sub-objects so callers don't have to know about the envelope.

func (*Client) ListTaxonomies 

func (c *Client) ListTaxonomies(ctx context.Context) ([]Taxonomy, error)

ListTaxonomies returns all taxonomies known to the instance. Used to resolve a namespace to a numeric id, since MISP has no view-by-namespace endpoint.

func (*Client) ListWarninglists 

func (c *Client) ListWarninglists(ctx context.Context) ([]Warninglist, error)

ListWarninglists returns all warninglists known to the instance. Used to resolve a name to a numeric id, since MISP has no view-by-name endpoint. The index response is double-wrapped: {"Warninglists": [{"Warninglist": {...}}, ...]}.

func (*Client) RemoveSharingGroupMember 

func (c *Client) RemoveSharingGroupMember(ctx context.Context, sgID, orgID string) error

RemoveSharingGroupMember removes the given organisation from the sharing group.

func (*Client) RemoveSharingGroupServer 

func (c *Client) RemoveSharingGroupServer(ctx context.Context, sgID, serverID string) error

RemoveSharingGroupServer removes a server from a sharing group. NOTE: The OpenAPI spec documents this endpoint as taking (sharingGroupServerId, serverId), but the real endpoint expects (sharingGroupId, serverId) — symmetric with addServer. Verified empirically on MISP 2.5.36: calling removeServer with the junction row id returns "Invalid sharing group or no editing rights."

func (*Client) UpdateFeed 

func (c *Client) UpdateFeed(ctx context.Context, id string, f Feed) (*Feed, error)

UpdateFeed edits a feed.

func (*Client) UpdateGalaxyCluster 

func (c *Client) UpdateGalaxyCluster(ctx context.Context, id string, gc GalaxyCluster) (*GalaxyCluster, error)

UpdateGalaxyCluster edits an existing galaxy cluster. When GalaxyElement is included, MISP replaces the entire element list for the cluster.

func (*Client) UpdateOrganisation 

func (c *Client) UpdateOrganisation(ctx context.Context, id string, o Organisation) (*Organisation, error)

UpdateOrganisation edits an existing organisation.

func (*Client) UpdateRole 

func (c *Client) UpdateRole(ctx context.Context, id string, r Role) (*Role, error)

UpdateRole edits an existing MISP role.

func (*Client) UpdateServer 

func (c *Client) UpdateServer(ctx context.Context, id string, s Server) (*Server, error)

UpdateServer edits a server. MISP 2.5.x suffers the same 500-on-success bug as /servers/add, so we apply the same fallback: if a 5xx is received, re-fetch the server by id and treat the current state as the result.

func (*Client) UpdateSetting 

func (c *Client) UpdateSetting(ctx context.Context, name, value string) error

UpdateSetting edits a MISP server setting. The value is always sent as a JSON string — MISP coerces it to the appropriate type internally. No setting data is returned; callers should call GetSetting afterwards to capture the authoritative state.

func (*Client) UpdateSharingGroup 

func (c *Client) UpdateSharingGroup(ctx context.Context, id string, sg SharingGroup) (*SharingGroup, error)

UpdateSharingGroup edits a sharing group.

func (*Client) UpdateTag 

func (c *Client) UpdateTag(ctx context.Context, id string, t Tag) (*Tag, error)

UpdateTag edits an existing tag.

func (*Client) UpdateUser 

func (c *Client) UpdateUser(ctx context.Context, id string, u User) (*User, error)

UpdateUser edits a user. MISP's API documents PUT for this endpoint.

type Config 

type Config struct {
	URL       string
	APIKey    string
	Insecure  bool
	UserAgent string
	Timeout   time.Duration
}

Config holds the parameters needed to construct a Client.

type DomainList 

type DomainList []string

DomainList is []string that tolerates MISP's four different JSON encodings of restricted_to_domain: null, JSON array, string-containing-"[]", and string-containing-a-JSON-array. Always marshals as a plain JSON array.

func (DomainList) MarshalJSON 

func (d DomainList) MarshalJSON() ([]byte, error)

MarshalJSON always emits a plain JSON array (MISP accepts this on input).

func (*DomainList) UnmarshalJSON 

func (d *DomainList) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes any of the four shapes MISP uses for this field.

type Feed 

type Feed struct {
	ID             string `json:"id,omitempty"`
	Name           string `json:"name"`
	Provider       string `json:"provider"`
	URL            string `json:"url"`
	SourceFormat   string `json:"source_format,omitempty"`
	Enabled        bool   `json:"enabled"`
	Distribution   string `json:"distribution,omitempty"`
	SharingGroupID string `json:"sharing_group_id,omitempty"`
	TagID          string `json:"tag_id,omitempty"`
	OrgcID         string `json:"orgc_id,omitempty"`
	FixedEvent     bool   `json:"fixed_event"`
	DeltaMerge     bool   `json:"delta_merge"`
	Publish        bool   `json:"publish"`
	OverrideIDs    bool   `json:"override_ids"`
	CachingEnabled bool   `json:"caching_enabled"`
	ForceToIDs     bool   `json:"force_to_ids"`
	LookupVisible  bool   `json:"lookup_visible"`
	InputSource    string `json:"input_source,omitempty"`
	Rules          string `json:"rules,omitempty"`
}

Feed mirrors MISP's Feed object. Core fields only — operational fields such as event_id, settings, and cache_timestamp are intentionally excluded.

type FlexBool 

type FlexBool bool

FlexBool is a bool that tolerates MISP's inconsistent JSON encoding. Different MISP endpoints (and often different MISP versions) return the same boolean field as `true/false`, `1/0`, or `"1"/"0"` — we've observed all three. FlexBool unmarshals any of them.

func (FlexBool) Bool 

func (b FlexBool) Bool() bool

Bool returns the underlying value.

func (FlexBool) MarshalJSON 

func (b FlexBool) MarshalJSON() ([]byte, error)

MarshalJSON always emits a plain JSON bool (MISP accepts this shape on input).

func (*FlexBool) UnmarshalJSON 

func (b *FlexBool) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes JSON bool, number 0/1, or quoted string "0"/"1"/"true"/"false".

type FlexString 

type FlexString string

FlexString is a string that tolerates JSON numbers. MISP frequently returns numeric-looking fields (rate_limit_count, nids_sid, ...) as either strings ("100") or bare numbers (100), depending on the endpoint. FlexString absorbs both.

func (FlexString) MarshalJSON 

func (s FlexString) MarshalJSON() ([]byte, error)

MarshalJSON emits the value as a JSON string.

func (FlexString) String 

func (s FlexString) String() string

String returns the underlying string.

func (*FlexString) UnmarshalJSON 

func (s *FlexString) UnmarshalJSON(data []byte) error

UnmarshalJSON accepts JSON strings, JSON numbers, and JSON booleans. Booleans are normalised to "true" or "false" strings, which matches what MISP expects when the value is round-tripped back via the API.

type GalaxyCluster 

type GalaxyCluster struct {
	ID             string          `json:"id,omitempty"`
	UUID           string          `json:"uuid,omitempty"`
	CollectionUUID string          `json:"collection_uuid,omitempty"`
	Type           string          `json:"type,omitempty"`
	Value          string          `json:"value,omitempty"`
	TagName        string          `json:"tag_name,omitempty"`
	Description    string          `json:"description,omitempty"`
	GalaxyID       string          `json:"galaxy_id,omitempty"`
	Source         string          `json:"source,omitempty"`
	Authors        []string        `json:"authors,omitempty"`
	Version        string          `json:"version,omitempty"`
	Distribution   string          `json:"distribution,omitempty"`
	SharingGroupID *string         `json:"sharing_group_id,omitempty"`
	OrgID          string          `json:"org_id,omitempty"`
	OrgcID         string          `json:"orgc_id,omitempty"`
	Default        bool            `json:"default,omitempty"`
	Locked         bool            `json:"locked,omitempty"`
	ExtendsUUID    *string         `json:"extends_uuid,omitempty"`
	ExtendsVersion *string         `json:"extends_version,omitempty"`
	Published      bool            `json:"published,omitempty"`
	Deleted        bool            `json:"deleted,omitempty"`
	Elements       []GalaxyElement `json:"GalaxyElement,omitempty"`
}

GalaxyCluster mirrors MISP's GalaxyCluster object.

Only fields needed for create/update are sent in request bodies. All fields are decoded on read. The Default field is always false for user-created clusters; bundled clusters (default=true) are not managed by Terraform.

type GalaxyElement 

type GalaxyElement struct {
	Key   string `json:"key"`
	Value string `json:"value"`
}

GalaxyElement is a single key/value metadata entry for a GalaxyCluster. MISP allows multiple entries with the same key (e.g. several "refs" or "synonyms"). The server-side id and galaxy_cluster_id are not modelled here as they are ephemeral artifacts managed by MISP.

type Noticelist 

type Noticelist struct {
	ID               string   `json:"id,omitempty"`
	Name             string   `json:"name"`
	ExpandedName     string   `json:"expanded_name,omitempty"`
	Ref              []string `json:"ref,omitempty"`
	GeographicalArea []string `json:"geographical_area,omitempty"`
	Version          string   `json:"version,omitempty"`
	Enabled          FlexBool `json:"enabled"`
}

Noticelist mirrors MISP's Noticelist object. Noticelists are bundled with MISP; they can't be created from Terraform — only enabled/disabled.

type Organisation 

type Organisation struct {
	ID          string `json:"id,omitempty"`
	UUID        string `json:"uuid,omitempty"`
	Name        string `json:"name"`
	Description string `json:"description,omitempty"`
	Type        string `json:"type,omitempty"`
	Nationality string `json:"nationality,omitempty"`
	Sector      string `json:"sector,omitempty"`
	Contacts    string `json:"contacts,omitempty"`
	Local       bool   `json:"local"`
	// No omitempty: an empty DomainList must serialize as `[]` on edit to
	// actually clear MISP's stored value. With omitempty, Go would drop the
	// field entirely and MISP would treat it as "no change" — meaning users
	// couldn't empty the domain list once set.
	RestrictedToDomain DomainList `json:"restricted_to_domain"`
	LandingPage        string     `json:"landingpage,omitempty"`
}

Organisation mirrors MISP's Organisation object.

type Role 

type Role struct {
	ID                    string     `json:"id,omitempty"`
	Name                  string     `json:"name"`
	Permission            string     `json:"permission"`
	PermAdd               FlexBool   `json:"perm_add"`
	PermModify            FlexBool   `json:"perm_modify"`
	PermModifyOrg         FlexBool   `json:"perm_modify_org"`
	PermPublish           FlexBool   `json:"perm_publish"`
	PermDelegate          FlexBool   `json:"perm_delegate"`
	PermSighting          FlexBool   `json:"perm_sighting"`
	PermTagger            FlexBool   `json:"perm_tagger"`
	PermTemplate          FlexBool   `json:"perm_template"`
	PermSharingGroup      FlexBool   `json:"perm_sharing_group"`
	PermTagEditor         FlexBool   `json:"perm_tag_editor"`
	PermObjectTemplate    FlexBool   `json:"perm_object_template"`
	PermSync              FlexBool   `json:"perm_sync"`
	PermAdmin             FlexBool   `json:"perm_admin"`
	PermAuth              FlexBool   `json:"perm_auth"`
	PermSiteAdmin         FlexBool   `json:"perm_site_admin"`
	PermRegexpAccess      FlexBool   `json:"perm_regexp_access"`
	PermAudit             FlexBool   `json:"perm_audit"`
	PermPublishZmq        FlexBool   `json:"perm_publish_zmq"`
	PermPublishKafka      FlexBool   `json:"perm_publish_kafka"`
	PermDecaying          FlexBool   `json:"perm_decaying"`
	PermGalaxyEditor      FlexBool   `json:"perm_galaxy_editor"`
	DefaultRole           FlexBool   `json:"default_role"`
	RestrictedToSiteAdmin FlexBool   `json:"restricted_to_site_admin"`
	EnforceRateLimit      FlexBool   `json:"enforce_rate_limit"`
	MemoryLimit           FlexString `json:"memory_limit,omitempty"`
	MaxExecutionTime      FlexString `json:"max_execution_time,omitempty"`
	RateLimitCount        FlexString `json:"rate_limit_count,omitempty"`
}

Role mirrors MISP's Role object.

type Server 

type Server struct {
	ID                  string `json:"id,omitempty"`
	Name                string `json:"name"`
	URL                 string `json:"url"`
	Authkey             string `json:"authkey,omitempty"`
	RemoteOrgID         string `json:"remote_org_id"`
	Push                bool   `json:"push"`
	Pull                bool   `json:"pull"`
	PushSightings       bool   `json:"push_sightings"`
	PushGalaxyClusters  bool   `json:"push_galaxy_clusters"`
	PullGalaxyClusters  bool   `json:"pull_galaxy_clusters"`
	SelfSigned          bool   `json:"self_signed"`
	SkipProxy           bool   `json:"skip_proxy"`
	CachingEnabled      bool   `json:"caching_enabled"`
	UnpublishEvent      bool   `json:"unpublish_event"`
	PublishWithoutEmail bool   `json:"publish_without_email"`
	Internal            bool   `json:"internal"`

	// Organization is populated from the RemoteOrg.name field in the index
	// response and is not part of the MISP Server JSON object itself.
	Organization string `json:"-"`
}

Server mirrors MISP's Server object (core fields only; see file-level comment for fields deferred to a future version).

Organization is a derived field populated by ListServers from the RemoteOrg sub-object in the index response; it is not sent in write requests (omitempty ensures it stays out of JSON bodies).

type Setting 

type Setting struct {
	Name        string     `json:"name"`
	Value       FlexString `json:"value"`
	Type        string     `json:"type"`
	Description string     `json:"description"`
	Level       int        `json:"level"`
}

Setting mirrors a MISP server-setting object as returned by GET /servers/getSetting/{name}. The response is flat (no envelope).

The value field is polymorphic in MISP (string, boolean, or numeric), so FlexString absorbs all three JSON representations into a Go string.

type SharingGroup 

type SharingGroup struct {
	ID            string `json:"id,omitempty"`
	UUID          string `json:"uuid,omitempty"`
	Name          string `json:"name"`
	Description   string `json:"description,omitempty"`
	Releasability string `json:"releasability,omitempty"`
	OrgID         string `json:"org_id,omitempty"`
	Active        bool   `json:"active"`
	Local         bool   `json:"local"`
	Roaming       bool   `json:"roaming"`
}

SharingGroup mirrors MISP's SharingGroup object (core fields only; org/server membership is managed via separate endpoints not yet modelled).

type Tag 

type Tag struct {
	ID             string `json:"id,omitempty"`
	Name           string `json:"name"`
	Colour         string `json:"colour,omitempty"`
	Exportable     bool   `json:"exportable"`
	HideTag        bool   `json:"hide_tag"`
	NumericalValue *int64 `json:"numerical_value,omitempty"`
	OrgID          string `json:"org_id,omitempty"`
	UserID         string `json:"user_id,omitempty"`
	LocalOnly      bool   `json:"local_only"`
}

Tag mirrors MISP's Tag object.

type Taxonomy 

type Taxonomy struct {
	ID          string `json:"id,omitempty"`
	Namespace   string `json:"namespace"`
	Description string `json:"description,omitempty"`
	Version     string `json:"version,omitempty"`
	Enabled     bool   `json:"enabled"`
	Exclusive   bool   `json:"exclusive"`
	Required    bool   `json:"required"`
	Highlighted bool   `json:"highlighted,omitempty"`
}

Taxonomy mirrors MISP's Taxonomy object. Taxonomies are bundled with MISP; they can't be created from Terraform — only enabled/disabled.

type User 

type User struct {
	ID            string `json:"id,omitempty"`
	Email         string `json:"email"`
	OrgID         string `json:"org_id,omitempty"`
	RoleID        string `json:"role_id,omitempty"`
	Autoalert     bool   `json:"autoalert"`
	Contactalert  bool   `json:"contactalert"`
	Disabled      bool   `json:"disabled"`
	Termsaccepted bool   `json:"termsaccepted"`
	ChangePw      bool   `json:"change_pw"`
	GPGKey        string `json:"gpgkey,omitempty"`
	CertifPublic  string `json:"certif_public,omitempty"`
	Expiration    string `json:"expiration,omitempty"`
}

User mirrors MISP's User object.

NOTE: authkey is returned only on Create (when advanced_authkeys is disabled) and kept out of this v0.1 surface to avoid leaking it into tf state. Manage API keys via the MISP UI or a future dedicated resource.

type Warninglist 

type Warninglist struct {
	ID                    string `json:"id,omitempty"`
	Name                  string `json:"name"`
	Type                  string `json:"type,omitempty"`
	Description           string `json:"description,omitempty"`
	Version               string `json:"version,omitempty"`
	Enabled               bool   `json:"enabled"`
	Category              string `json:"category,omitempty"`
	WarninglistEntryCount string `json:"warninglist_entry_count,omitempty"`
	ValidAttributes       string `json:"valid_attributes,omitempty"`
}

Warninglist mirrors MISP's Warninglist object. Warninglists are bundled with MISP; they can't be created from Terraform — only enabled/disabled.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.