manage

package
v1.0.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 13, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Documentation

Overview

Package manage implements the manage-entities MCP tool, exposing CRUD and workflow operations (create, update, delete, comment, promote, merge, apply-template) over TheHive entities.

Index

Constants

View Source 
const (
	OperationCreate        = "create"
	OperationUpdate        = "update"
	OperationDelete        = "delete"
	OperationComment       = "comment"
	OperationPromote       = "promote"
	OperationMerge         = "merge"
	OperationApplyTemplate = "apply-template"
)

Operation values accepted by the manage-entities tool.

View Source 
const ManageToolDescription = `` /* 7543-byte string literal not displayed */

ManageToolDescription is the human-readable description advertised for the manage-entities tool.

Variables

This section is empty.

Functions

This section is empty.

Types

type ApplyTemplateResult added in v0.3.3 

type ApplyTemplateResult struct {
	Operation  string   `json:"operation"`
	EntityType string   `json:"entityType"`
	TemplateID string   `json:"templateId"`
	CaseIDs    []string `json:"caseIds"`
	Message    string   `json:"message,omitempty"`
}

ApplyTemplateResult is the tool result returned after applying a case template to cases.

func NewApplyTemplateResult added in v0.3.3 

func NewApplyTemplateResult(templateID string, caseIDs []string) *ApplyTemplateResult

NewApplyTemplateResult builds an ApplyTemplateResult from the template ID and target case IDs.

type CommentEntityResult added in v0.3.1 

type CommentEntityResult struct {
	Operation  string                      `json:"operation"`
	EntityType string                      `json:"entityType"`
	Results    []SingleEntityCommentResult `json:"results,omitempty"`
}

CommentEntityResult aggregates the per-entity outcomes of a comment operation.

func NewCommentEntityResult added in v0.3.1 

func NewCommentEntityResult(entityType string, results []SingleEntityCommentResult) *CommentEntityResult

NewCommentEntityResult builds a CommentEntityResult for the given entity type and per-entity results.

type CreateAlertResult added in v0.3.1 

type CreateAlertResult struct {
	Operation  string               `json:"operation"`
	EntityType string               `json:"entityType"`
	Result     *FilteredOutputAlert `json:"result,omitempty"`
	Message    string               `json:"message,omitempty"`
}

CreateAlertResult is the tool result returned after creating an alert.

func NewCreateAlertResult added in v0.3.1 

func NewCreateAlertResult(alert *thehive.OutputAlert) *CreateAlertResult

NewCreateAlertResult builds a CreateAlertResult from a created OutputAlert.

type CreateCaseResult added in v0.3.1 

type CreateCaseResult struct {
	Operation  string              `json:"operation"`
	EntityType string              `json:"entityType"`
	Result     *FilteredOutputCase `json:"result,omitempty"`
	Message    string              `json:"message,omitempty"`
}

CreateCaseResult is the tool result returned after creating a case.

func NewCreateCaseResult added in v0.3.1 

func NewCreateCaseResult(caseEntity *thehive.OutputCase) *CreateCaseResult

NewCreateCaseResult builds a CreateCaseResult from a created OutputCase.

type CreateCaseTemplateResult added in v0.3.3 

type CreateCaseTemplateResult struct {
	Operation  string                      `json:"operation"`
	EntityType string                      `json:"entityType"`
	Result     *FilteredOutputCaseTemplate `json:"result,omitempty"`
	Message    string                      `json:"message,omitempty"`
}

CreateCaseTemplateResult is the tool result returned after creating a case template.

func NewCreateCaseTemplateResult added in v0.3.3 

func NewCreateCaseTemplateResult(ct *thehive.OutputCaseTemplate) *CreateCaseTemplateResult

NewCreateCaseTemplateResult builds a CreateCaseTemplateResult from a created OutputCaseTemplate.

type CreateObservableResult added in v0.3.1 

type CreateObservableResult struct {
	Operation  string                     `json:"operation"`
	EntityType string                     `json:"entityType"`
	Result     []FilteredOutputObservable `json:"result,omitempty"`
	Message    string                     `json:"message,omitempty"`
}

CreateObservableResult is the tool result returned after creating observables.

func NewCreateObservableResult added in v0.3.1 

func NewCreateObservableResult(observable []thehive.OutputObservable) *CreateObservableResult

NewCreateObservableResult builds a CreateObservableResult from created OutputObservables.

type CreatePageResult added in v0.3.3 

type CreatePageResult struct {
	Operation  string              `json:"operation"`
	EntityType string              `json:"entityType"`
	Result     *FilteredOutputPage `json:"result,omitempty"`
	Message    string              `json:"message,omitempty"`
}

CreatePageResult is the tool result returned after creating a page.

func NewCreatePageResult added in v0.3.3 

func NewCreatePageResult(page *thehive.OutputPage) *CreatePageResult

NewCreatePageResult builds a CreatePageResult from a created OutputPage.

type CreateProcedureResult added in v0.3.3 

type CreateProcedureResult struct {
	Operation  string                  `json:"operation"`
	EntityType string                  `json:"entityType"`
	Result     FilteredOutputProcedure `json:"result"`
	Message    string                  `json:"message,omitempty"`
}

CreateProcedureResult is the tool result returned after creating a procedure.

func NewCreateProcedureResult added in v0.3.3 

func NewCreateProcedureResult(procedure *thehive.OutputProcedure) *CreateProcedureResult

NewCreateProcedureResult builds a CreateProcedureResult from a created OutputProcedure.

type CreateTaskResult added in v0.3.1 

type CreateTaskResult struct {
	Operation  string              `json:"operation"`
	EntityType string              `json:"entityType"`
	Result     *FilteredOutputTask `json:"result,omitempty"`
	Message    string              `json:"message,omitempty"`
}

CreateTaskResult is the tool result returned after creating a task.

func NewCreateTaskResult added in v0.3.1 

func NewCreateTaskResult(task *thehive.OutputTask) *CreateTaskResult

NewCreateTaskResult builds a CreateTaskResult from a created OutputTask.

type DeleteEntityResult added in v0.3.1 

type DeleteEntityResult struct {
	Operation  string                     `json:"operation"`
	EntityType string                     `json:"entityType"`
	Results    []SingleEntityDeleteResult `json:"results,omitempty"`
}

DeleteEntityResult aggregates the per-entity outcomes of a delete operation.

func NewDeleteEntityResult added in v0.3.1 

func NewDeleteEntityResult(entityType string, results []SingleEntityDeleteResult) *DeleteEntityResult

NewDeleteEntityResult builds a DeleteEntityResult for the given entity type and per-entity results.

type EntityParams added in v1.0.0 

type EntityParams struct {
	Operation  string         `` /* 464-byte string literal not displayed */
	EntityType string         `` /* 454-byte string literal not displayed */
	EntityIDs  []string       `` /* 399-byte string literal not displayed */
	EntityData map[string]any `` /* 323-byte string literal not displayed */
	Comment    string         `` /* 188-byte string literal not displayed */
	TargetID   string         `` /* 374-byte string literal not displayed */
}

EntityParams holds the input parameters for the manage-entities tool.

type EntityResult added in v1.0.0 

type EntityResult struct {
	CreateAlertResult        *CreateAlertResult         `json:"createAlertResult,omitempty"`
	CreateCaseResult         *CreateCaseResult          `json:"createCaseResult,omitempty"`
	CreateTaskResult         *CreateTaskResult          `json:"createTaskResult,omitempty"`
	CreateObservableResult   *CreateObservableResult    `json:"createObservableResult,omitempty"`
	CreateProcedureResult    *CreateProcedureResult     `json:"createProcedureResult,omitempty"`
	CreateCaseTemplateResult *CreateCaseTemplateResult  `json:"createCaseTemplateResult,omitempty"`
	CreatePageResult         *CreatePageResult          `json:"createPageResult,omitempty"`
	UpdateResults            *UpdateEntityResult        `json:"updateResults,omitempty"`
	DeleteResults            *DeleteEntityResult        `json:"deleteResults,omitempty"`
	CommentResults           *CommentEntityResult       `json:"commentResults,omitempty"`
	PromoteAlertResult       *PromoteAlertResult        `json:"promoteAlertResult,omitempty"`
	MergeCasesResult         *MergeCasesResult          `json:"mergeCasesResult,omitempty"`
	MergeAlertsResult        *MergeAlertsIntoCaseResult `json:"mergeAlertsResult,omitempty"`
	MergeObservablesResult   *MergeObservablesResult    `json:"mergeObservablesResult,omitempty"`
	ApplyTemplateResult      *ApplyTemplateResult       `json:"applyTemplateResult,omitempty"`
}

EntityResult is the union result type for all manage-entities operations.

func (EntityResult) Unwrap added in v1.0.0 

func (r EntityResult) Unwrap() any

Unwrap implements utils.Unwrapper to flatten the union for serialization.

type FilteredOutputAlert added in v0.3.1 

type FilteredOutputAlert struct {
	UnderscoreID string `json:"_id"`
	Title        string `json:"title"`
	CreatedAt    int64  `json:"_createdAt"`
	Severity     int32  `json:"severity"`
	Status       string `json:"status"`
}

FilteredOutputAlert is the reduced alert representation returned by create operations.

func NewFilteredOutputAlert added in v0.3.1 

func NewFilteredOutputAlert(alert *thehive.OutputAlert) *FilteredOutputAlert

NewFilteredOutputAlert builds a FilteredOutputAlert from a TheHive OutputAlert.

type FilteredOutputCase added in v0.3.1 

type FilteredOutputCase struct {
	UnderscoreID string `json:"_id"`
	Title        string `json:"title"`
	CreatedAt    int64  `json:"_createdAt"`
	Status       string `json:"status"`
	Severity     int32  `json:"severity"`
}

FilteredOutputCase is the reduced case representation returned by create/merge/promote operations.

func NewFilteredOutputCase added in v0.3.1 

func NewFilteredOutputCase(caseEntity *thehive.OutputCase) *FilteredOutputCase

NewFilteredOutputCase builds a FilteredOutputCase from a TheHive OutputCase.

type FilteredOutputCaseTemplate added in v0.3.3 

type FilteredOutputCaseTemplate struct {
	UnderscoreID string  `json:"_id"`
	Name         string  `json:"name"`
	DisplayName  string  `json:"displayName"`
	Description  *string `json:"description,omitempty"`
	Severity     *int32  `json:"severity,omitempty"`
}

FilteredOutputCaseTemplate is the reduced case-template representation returned by create operations.

func NewFilteredOutputCaseTemplate added in v0.3.3 

func NewFilteredOutputCaseTemplate(ct *thehive.OutputCaseTemplate) *FilteredOutputCaseTemplate

NewFilteredOutputCaseTemplate builds a FilteredOutputCaseTemplate from a TheHive OutputCaseTemplate.

type FilteredOutputObservable added in v0.3.1 

type FilteredOutputObservable struct {
	UnderscoreID string `json:"_id"`
	DataType     string `json:"dataType"`
	CreatedAt    int64  `json:"_createdAt"`
}

FilteredOutputObservable is the reduced observable representation returned by create operations.

func NewFilteredOutputObservable added in v0.3.1 

func NewFilteredOutputObservable(observable *thehive.OutputObservable) *FilteredOutputObservable

NewFilteredOutputObservable builds a FilteredOutputObservable from a TheHive OutputObservable.

type FilteredOutputPage added in v0.3.3 

type FilteredOutputPage struct {
	UnderscoreID string `json:"_id"`
	Title        string `json:"title"`
	Category     string `json:"category"`
	Order        int32  `json:"order"`
	CreatedAt    int64  `json:"_createdAt"`
}

FilteredOutputPage is the reduced page representation returned by create operations.

func NewFilteredOutputPage added in v0.3.3 

func NewFilteredOutputPage(page *thehive.OutputPage) *FilteredOutputPage

NewFilteredOutputPage builds a FilteredOutputPage from a TheHive OutputPage.

type FilteredOutputProcedure added in v0.3.3 

type FilteredOutputProcedure struct {
	UnderscoreID string `json:"_id"`
	CreatedAt    int64  `json:"_createdAt"`
	PatternID    string `json:"patternId"`
	Tactic       string `json:"tactic,omitempty"`
}

FilteredOutputProcedure is the reduced procedure representation returned by create operations.

func NewFilteredOutputProcedure added in v0.3.3 

func NewFilteredOutputProcedure(procedure *thehive.OutputProcedure) *FilteredOutputProcedure

NewFilteredOutputProcedure builds a FilteredOutputProcedure from a TheHive OutputProcedure.

type FilteredOutputTask added in v0.3.1 

type FilteredOutputTask struct {
	UnderscoreID string  `json:"_id"`
	Title        string  `json:"title"`
	Status       string  `json:"status"`
	CreatedAt    int64   `json:"_createdAt"`
	Assignee     *string `json:"assignee,omitempty"`
}

FilteredOutputTask is the reduced task representation returned by create operations.

func NewFilteredOutputTask added in v0.3.1 

func NewFilteredOutputTask(task *thehive.OutputTask) *FilteredOutputTask

NewFilteredOutputTask builds a FilteredOutputTask from a TheHive OutputTask.

type MergeAlertsIntoCaseResult added in v0.3.1 

type MergeAlertsIntoCaseResult struct {
	Operation  string              `json:"operation"`
	EntityType string              `json:"entityType"`
	EntityIDs  []string            `json:"entityIds,omitempty"`
	TargetID   string              `json:"targetId,omitempty"`
	Result     *FilteredOutputCase `json:"result,omitempty"`
	Message    string              `json:"message,omitempty"`
}

MergeAlertsIntoCaseResult is the tool result returned after merging alerts into a case.

func NewMergeAlertsResult added in v0.3.1 

func NewMergeAlertsResult(caseEntity *thehive.OutputCase, alertIDs []string, targetCaseID string) *MergeAlertsIntoCaseResult

NewMergeAlertsResult builds a MergeAlertsIntoCaseResult from the target case, merged alert IDs, and target case ID.

type MergeCasesResult added in v0.3.1 

type MergeCasesResult struct {
	Operation  string              `json:"operation"`
	EntityType string              `json:"entityType"`
	EntityIDs  []string            `json:"entityIds,omitempty"`
	Result     *FilteredOutputCase `json:"result,omitempty"`
	Message    string              `json:"message,omitempty"`
}

MergeCasesResult is the tool result returned after merging cases.

func NewMergeCasesResult added in v0.3.1 

func NewMergeCasesResult(caseEntity *thehive.OutputCase, mergedIDs []string) *MergeCasesResult

NewMergeCasesResult builds a MergeCasesResult from the merged case and the source case IDs.

type MergeObservablesResult added in v0.3.1 

type MergeObservablesResult struct {
	Operation  string `json:"operation"`
	EntityType string `json:"entityType"`
	TargetID   string `json:"targetId,omitempty"`
	Result     string `json:"result,omitempty"`
	Message    string `json:"message,omitempty"`
}

MergeObservablesResult is the tool result returned after merging/deduplicating observables.

func NewMergeObservablesResult added in v0.3.1 

func NewMergeObservablesResult(resultData, targetCaseID string) *MergeObservablesResult

NewMergeObservablesResult builds a MergeObservablesResult from the API summary and target case ID.

type PromoteAlertResult added in v0.3.1 

type PromoteAlertResult struct {
	Operation  string              `json:"operation"`
	EntityType string              `json:"entityType"`
	Result     *FilteredOutputCase `json:"result,omitempty"`
}

PromoteAlertResult is the tool result returned after promoting an alert to a case.

func NewPromoteAlertResult added in v0.3.1 

func NewPromoteAlertResult(caseEntity *thehive.OutputCase) *PromoteAlertResult

NewPromoteAlertResult builds a PromoteAlertResult from the created case.

type SingleEntityCommentResult added in v0.3.1 

type SingleEntityCommentResult struct {
	CommentID string         `json:"commentId,omitempty"`
	EntityID  string         `json:"entityId"`
	Result    string         `json:"result,omitempty"`
	Error     map[string]any `json:"error,omitempty"`
}

SingleEntityCommentResult is the per-entity outcome of a comment operation.

type SingleEntityDeleteResult added in v0.3.1 

type SingleEntityDeleteResult struct {
	EntityID string         `json:"_id"`
	Deleted  bool           `json:"deleted,omitempty"`
	Error    map[string]any `json:"error,omitempty"`
}

SingleEntityDeleteResult is the per-entity outcome of a delete operation.

type SingleEntityUpdateResult added in v0.3.1 

type SingleEntityUpdateResult struct {
	EntityID string         `json:"_id"`
	Result   string         `json:"result,omitempty"`
	Error    map[string]any `json:"error,omitempty"`
}

SingleEntityUpdateResult is the per-entity outcome of an update operation.

type Tool added in v1.0.0 

type Tool struct{}

Tool is the MCP tool that performs CRUD and workflow operations on TheHive entities.

func NewManageTool 

func NewManageTool() *Tool

NewManageTool returns a new Tool.

func (*Tool) Definition added in v1.0.0 

func (t *Tool) Definition() mcp.Tool

Definition returns the MCP tool definition including input and output schemas.

func (*Tool) Handle added in v1.0.0 

func (t *Tool) Handle(ctx context.Context, _ mcp.CallToolRequest, params EntityParams) (EntityResult, error)

Handle dispatches the manage-entities request to the handler for the requested operation.

func (*Tool) Handler added in v1.0.0 

func (t *Tool) Handler() server.ToolHandlerFunc

Handler returns the MCP tool handler, wrapped with parameter and permission validation.

func (*Tool) HasUntrustedData added in v1.0.0 

func (t *Tool) HasUntrustedData() bool

HasUntrustedData reports that this tool's results may contain untrusted, user-generated data.

func (*Tool) Name added in v1.0.0 

func (t *Tool) Name() string

Name returns the MCP tool name.

func (*Tool) ValidateParams added in v1.0.0 

func (t *Tool) ValidateParams(params *EntityParams) error

ValidateParams validates the tool parameters for the requested operation and entity type.

func (*Tool) ValidatePermissions added in v1.0.0 

func (t *Tool) ValidatePermissions(ctx context.Context, params EntityParams) error

ValidatePermissions checks that the caller is allowed to run the requested operation on the target entities.

type UpdateEntityResult added in v0.3.1 

type UpdateEntityResult struct {
	Operation  string                     `json:"operation"`
	EntityType string                     `json:"entityType"`
	Results    []SingleEntityUpdateResult `json:"results,omitempty"`
}

UpdateEntityResult aggregates the per-entity outcomes of an update operation.

func NewUpdateEntityResult added in v0.3.1 

func NewUpdateEntityResult(entityType string, results []SingleEntityUpdateResult) *UpdateEntityResult

NewUpdateEntityResult builds an UpdateEntityResult for the given entity type and per-entity results.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.