utils

func AddPermissionsToContext ¶

func AddPermissionsToContext(ctx context.Context, perms *permissions.Config) context.Context

AddPermissionsToContext adds permissions configuration to the context

func CreateFilterFromJSONString ¶

func CreateFilterFromJSONString(filterString string) (thehive.InputQueryNamedOperation, error)

func ExpandEntitiesWithQueries ¶

func ExpandEntitiesWithQueries(
	ctx context.Context,
	entityType string,
	entities []map[string]interface{},
	additionalQueries []string,
) ([]map[string]interface{}, error)

ExpandEntitiesWithQueries expands each entity with its related data inline

func GetAttachmentsFromAlertID ¶

func GetAttachmentsFromAlertID(ctx context.Context, client *thehive.APIClient, alertID string) ([]map[string]interface{}, error)

func GetAttachmentsFromCaseID ¶

func GetAttachmentsFromCaseID(ctx context.Context, client *thehive.APIClient, caseID string) ([]map[string]interface{}, error)

func GetCommentsFromAlertID ¶

func GetCommentsFromAlertID(ctx context.Context, client *thehive.APIClient, alertID string) ([]map[string]interface{}, error)

func GetCommentsFromCaseID ¶

func GetCommentsFromCaseID(ctx context.Context, client *thehive.APIClient, caseID string) ([]map[string]interface{}, error)

func GetHiveClientFromContext ¶

func GetHiveClientFromContext(ctx context.Context) (*thehive.APIClient, error)

func GetJSONFields ¶

func GetJSONFields(v interface{}) []string

func GetModelCompletion ¶

func GetModelCompletion(ctx context.Context, messages []mcp.PromptMessage, target interface{}) error

func GetObservablesFromAlertID ¶

func GetObservablesFromAlertID(ctx context.Context, client *thehive.APIClient, alertID string) ([]map[string]interface{}, error)

Alert-related functions

func GetObservablesFromCaseID ¶

func GetObservablesFromCaseID(ctx context.Context, client *thehive.APIClient, caseID string) ([]map[string]interface{}, error)

func GetOpenaiModelCompletion ¶

func GetOpenaiModelCompletion(
	ctx context.Context,
	messages []openai.ChatCompletionMessage,
	target interface{},
) error

GetOpenaiModelCompletion uses the globally initialized OpenAI wrapper (deprecated, use context-based approach)

func GetOpenaiModelCompletionWithWrapper ¶ added in v0.3.1

func GetOpenaiModelCompletionWithWrapper(
	ctx context.Context,
	messages []openai.ChatCompletionMessage,
	target interface{},
	wrapper *OpenAIWrapper,
) error

GetOpenaiModelCompletionWithWrapper uses the provided OpenAI wrapper

func GetPagesFromAlertID ¶

func GetPagesFromAlertID(ctx context.Context, client *thehive.APIClient, alertID string) ([]map[string]interface{}, error)

func GetPagesFromCaseID ¶

func GetPagesFromCaseID(ctx context.Context, client *thehive.APIClient, caseID string) ([]map[string]interface{}, error)

func GetPermissionsFromContext ¶

func GetPermissionsFromContext(ctx context.Context) (*permissions.Config, error)

GetPermissionsFromContext retrieves permissions configuration from the context

func GetProceduresFromAlertID ¶ added in v0.3.3

func GetProceduresFromAlertID(ctx context.Context, client *thehive.APIClient, alertID string) ([]map[string]interface{}, error)

func GetProceduresFromCaseID ¶ added in v0.3.3

func GetProceduresFromCaseID(ctx context.Context, client *thehive.APIClient, caseID string) ([]map[string]interface{}, error)

func GetSamplingModelCompletion ¶

func GetSamplingModelCompletion(ctx context.Context, messages []mcp.PromptMessage, target interface{}) error

func GetSupportedQueries ¶

func GetSupportedQueries(entityType string) []string

GetSupportedQueries returns the list of supported queries for an entity type

func GetTaskLogsFromTaskID ¶

func GetTaskLogsFromTaskID(ctx context.Context, client *thehive.APIClient, taskID string) ([]map[string]interface{}, error)

Task-related functions

func GetTasksFromCaseID ¶

func GetTasksFromCaseID(ctx context.Context, client *thehive.APIClient, caseID string) ([]map[string]interface{}, error)

Case-related functions

func InitOpenai ¶

func InitOpenai(options *types.TheHiveMcpDefaultOptions)

InitOpenai initializes the global OpenAI wrapper with configuration from options If OpenAI configuration is missing, it logs warnings but does not return errors

func NewToolResultJSONUnescaped ¶

func NewToolResultJSONUnescaped(data interface{}) *mcp.CallToolResult

NewToolResultJSONUnescaped creates a new MCP tool result with proper UTF-8 encoding without escaping non-ASCII characters. This fixes issues where Unicode characters like emojis and accented characters get escaped (e.g., ✅ becomes \u2705).

func ParseURIParameters ¶ added in v0.3.1

func ParseURIParameters(uri string) (string, map[string]any, error)

ParseURIParameters extracts query parameters from a parameters string

func ProcessDatesRecursive ¶ added in v0.3.1

func ProcessDatesRecursive(value interface{}) (interface{}, error)

ProcessDatesRecursive processes any Go value recursively to convert date fields. Handles structs, maps, slices, arrays, and nested combinations.

func TranslateDatesToTimestamps ¶

func TranslateDatesToTimestamps(filterMap map[string]interface{}) map[string]interface{}

Searches the filter map for date strings and converts them to timestamps in milliseconds since epoch.

func UnwrapUnion ¶ added in v0.3.1

func UnwrapUnion(v any) any

UnwrapUnion is a reflection-based helper for union structs whose fields are all optional pointer variants. It returns the first non-nil pointer field's value, or the original value if none is found. Union types opt in by implementing Unwrap() with a one-liner:

func (r T) Unwrap() any { return utils.UnwrapUnion(r) }

func ValidateQuery ¶

func ValidateQuery(entityType, queryName string) error

ValidateQuery checks if a query is supported for an entity type