execute_automation

package
v1.0.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 13, 2026 License: Apache-2.0 Imports: 10 Imported by: 0

Documentation

Overview

Package execute_automation implements the execute-automation MCP tool for running Cortex analyzers and responders and reading their execution status.

Index

Constants

View Source 
const (
	OperationRunAnalyzer     = "run-analyzer"
	OperationRunResponder    = "run-responder"
	OperationGetJobStatus    = "get-job-status"
	OperationGetActionStatus = "get-action-status"
)

Operation names accepted by the execute-automation tool.

View Source 
const ExecuteAutomationToolDescription = `` /* 2279-byte string literal not displayed */

ExecuteAutomationToolDescription is the MCP tool description shown to clients.

Variables

This section is empty.

Functions

This section is empty.

Types

type AnalyzerJobResult added in v0.3.1 

type AnalyzerJobResult struct {
	Operation string             `json:"operation"`
	Job       *FilteredOutputJob `json:"job"`
	Message   string             `json:"message"`
}

AnalyzerJobResult is the result of a run-analyzer operation.

func NewAnalyzerJobResult added in v0.3.1 

func NewAnalyzerJobResult(job *thehive.OutputJob) *AnalyzerJobResult

NewAnalyzerJobResult builds an AnalyzerJobResult from a created analyzer job.

type AnalyzerJobStatusResult added in v0.3.1 

type AnalyzerJobStatusResult struct {
	Operation    string         `json:"operation"`
	JobID        string         `json:"jobId"`
	AnalyzerID   string         `json:"analyzerId"`
	AnalyzerName string         `json:"analyzerName"`
	Status       string         `json:"status"`
	Result       map[string]any `json:"result,omitempty"`
	Message      string         `json:"message"`
}

AnalyzerJobStatusResult is the result of a get-job-status operation.

func NewAnalyzerJobStatusResult added in v0.3.1 

func NewAnalyzerJobStatusResult(job *thehive.OutputJob) *AnalyzerJobStatusResult

NewAnalyzerJobStatusResult builds an AnalyzerJobStatusResult from a job, including its report when available.

type ExecuteAutomationParams added in v0.3.1 

type ExecuteAutomationParams struct {
	Operation    string         `` /* 308-byte string literal not displayed */
	AnalyzerID   string         `` /* 162-byte string literal not displayed */
	ResponderID  string         `` /* 166-byte string literal not displayed */
	CortexID     string         `` /* 257-byte string literal not displayed */
	ObservableID string         `` /* 144-byte string literal not displayed */
	EntityType   string         `` /* 324-byte string literal not displayed */
	EntityID     string         `` /* 152-byte string literal not displayed */
	JobID        string         `json:"job-id,omitempty"        jsonschema_description:"Job ID for get-job-status operations."`
	ActionID     string         `json:"action-id,omitempty"     jsonschema_description:"Action ID for get-action-status operations."`
	Parameters   map[string]any `` /* 161-byte string literal not displayed */
}

ExecuteAutomationParams holds the input parameters for the execute-automation tool.

type ExecuteAutomationResult added in v0.3.1 

type ExecuteAutomationResult struct {
	AnalyzerResult     *AnalyzerJobResult           `json:"analyzerResult,omitempty"`
	ResponderResult    *ResponderActionResult       `json:"responderResult,omitempty"`
	JobStatusResult    *AnalyzerJobStatusResult     `json:"jobStatusResult,omitempty"`
	ActionStatusResult *ResponderActionStatusResult `json:"actionStatusResult,omitempty"`
}

ExecuteAutomationResult is a union of the possible operation results; exactly one field is set.

func (ExecuteAutomationResult) Unwrap added in v0.3.1 

func (r ExecuteAutomationResult) Unwrap() any

Unwrap implements utils.Unwrapper to flatten the union for serialization.

type ExecuteAutomationTool 

type ExecuteAutomationTool struct{}

ExecuteAutomationTool exposes Cortex analyzer/responder execution and status retrieval as an MCP tool.

func NewExecuteAutomationTool 

func NewExecuteAutomationTool() *ExecuteAutomationTool

NewExecuteAutomationTool returns a new ExecuteAutomationTool.

func (*ExecuteAutomationTool) Definition 

func (t *ExecuteAutomationTool) Definition() mcp.Tool

Definition returns the MCP tool definition (schema and description).

func (*ExecuteAutomationTool) Handle 

func (t *ExecuteAutomationTool) Handle(ctx context.Context, _ mcp.CallToolRequest, params ExecuteAutomationParams) (ExecuteAutomationResult, error)

Handle dispatches the request to the operation-specific handler based on params.Operation.

func (*ExecuteAutomationTool) Handler added in v0.3.1 

func (t *ExecuteAutomationTool) Handler() server.ToolHandlerFunc

Handler returns the tool handler wrapped with the shared validation middleware.

func (*ExecuteAutomationTool) HasUntrustedData added in v0.3.4 

func (t *ExecuteAutomationTool) HasUntrustedData() bool

HasUntrustedData reports that this tool's output may contain untrusted data.

func (*ExecuteAutomationTool) Name added in v0.3.1 

func (t *ExecuteAutomationTool) Name() string

Name returns the tool's registered MCP name.

func (*ExecuteAutomationTool) ValidateParams added in v0.3.1 

func (t *ExecuteAutomationTool) ValidateParams(params *ExecuteAutomationParams) error

ValidateParams verifies that the parameters required by the requested operation are present.

func (*ExecuteAutomationTool) ValidatePermissions added in v0.3.1 

func (t *ExecuteAutomationTool) ValidatePermissions(ctx context.Context, params ExecuteAutomationParams) error

ValidatePermissions checks that the caller is permitted to run the requested operation and that the target entity is within the configured filter scope.

type FilteredOutputAction added in v0.3.1 

type FilteredOutputAction struct {
	UnderscoreID  string `json:"_id"`
	ResponderID   string `json:"responderId"`
	ResponderName string `json:"responderName,omitempty"`
	CortexID      string `json:"cortexId,omitempty"`
	CortexJobID   string `json:"cortexJobId,omitempty"`
	ObjectType    string `json:"objectType"`
	ObjectID      string `json:"objectId"`
	Status        string `json:"status"`
	StartDate     int64  `json:"startDate"`
	EndDate       int64  `json:"endDate,omitempty"`
}

FilteredOutputAction is a reduced view of a Cortex responder action returned to clients.

func NewFilteredOutputAction added in v0.3.1 

func NewFilteredOutputAction(action *thehive.OutputAction) *FilteredOutputAction

NewFilteredOutputAction builds a FilteredOutputAction from a thehive OutputAction.

type FilteredOutputJob added in v0.3.1 

type FilteredOutputJob struct {
	UnderscoreID string         `json:"_id"`
	AnalyzerID   string         `json:"analyzerId"`
	AnalyzerName string         `json:"analyzerName"`
	Status       string         `json:"status"`
	StartDate    int64          `json:"startDate"`
	EndDate      int64          `json:"endDate,omitempty"`
	Report       map[string]any `json:"report,omitempty"`
	CortexID     string         `json:"cortexId"`
	CortexJobID  string         `json:"cortexJobId"`
}

FilteredOutputJob is a reduced view of a Cortex analyzer job returned to clients.

func NewFilteredOutputJob added in v0.3.1 

func NewFilteredOutputJob(job *thehive.OutputJob) *FilteredOutputJob

NewFilteredOutputJob builds a FilteredOutputJob from a thehive OutputJob.

type ResponderActionResult added in v0.3.1 

type ResponderActionResult struct {
	Operation string                `json:"operation"`
	Action    *FilteredOutputAction `json:"action"`
	Message   string                `json:"message"`
}

ResponderActionResult is the result of a run-responder operation.

func NewResponderActionResult added in v0.3.1 

func NewResponderActionResult(action *thehive.OutputAction) *ResponderActionResult

NewResponderActionResult builds a ResponderActionResult from a created responder action.

type ResponderActionStatusResult added in v0.3.1 

type ResponderActionStatusResult struct {
	Operation     string `json:"operation"`
	ActionID      string `json:"actionId"`
	ResponderID   string `json:"responderId"`
	ResponderName string `json:"responderName"`
	EntityType    string `json:"entityType"`
	EntityID      string `json:"entityId"`
	Status        string `json:"status"`
	Result        string `json:"result,omitempty"`
	Message       string `json:"message"`
}

ResponderActionStatusResult is the result of a get-action-status operation.

func NewResponderActionStatusResult added in v0.3.1 

func NewResponderActionStatusResult(action *thehive.OutputAction) *ResponderActionStatusResult

NewResponderActionStatusResult builds a ResponderActionStatusResult from a responder action.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.