types

package
v1.0.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 13, 2026 License: Apache-2.0 Imports: 8 Imported by: 0

Documentation

Overview

Package types defines the configuration options, context/env/flag keys, and shared entity constants used across the TheHiveMCP server.

Index

Constants

View Source 
const (
	EntityTypeAlert        = "alert"
	EntityTypeCase         = "case"
	EntityTypeTask         = "task"
	EntityTypeObservable   = "observable"
	EntityTypeComment      = "comment"
	EntityTypePage         = "page"
	EntityTypeAttachment   = "attachment"
	EntityTypeTaskLog      = "task-log"
	EntityTypeProcedure    = "procedure"
	EntityTypePattern      = "pattern"
	EntityTypeCaseTemplate = "case-template"
)

Entity type constants for TheHive entities

View Source 
const DateFormat = "2006-01-02T15:04:05"

DateFormat is the timestamp layout used for TheHive date fields.

View Source 
const DefaultCortexID = "local"

DefaultCortexID is the default Cortex instance ID used when none is specified.

Variables

View Source 
var DefaultFields = map[string][]string{
	EntityTypeAlert:        {fieldID, fieldTitle, fieldCreatedAt, fieldSeverity, fieldStatus},
	EntityTypeCase:         {fieldID, fieldTitle, fieldCreatedAt, fieldStatus, fieldSeverity},
	EntityTypeTask:         {fieldID, fieldTitle, fieldStatus, fieldCreatedAt, "assignee"},
	EntityTypeObservable:   {fieldID, "dataType", fieldCreatedAt},
	EntityTypeComment:      {fieldID, "message", fieldCreatedAt, "_createdBy"},
	EntityTypePage:         {fieldID, fieldTitle, fieldCreatedAt},
	EntityTypeAttachment:   {fieldID, "fileName", "size", fieldCreatedAt},
	EntityTypeTaskLog:      {fieldID, "message", fieldCreatedAt, "_createdBy"},
	EntityTypeProcedure:    {fieldID, "patternId", "patternName", "description", "occurDate"},
	EntityTypePattern:      {fieldID, "patternId", "name", "tactics", "platforms"},
	EntityTypeCaseTemplate: {fieldID, "name", "displayName", "description", fieldSeverity, "tags"},
}

DefaultFields maps each entity type to the default set of fields returned for it.

Functions

This section is empty.

Types

type CtxKey 

type CtxKey string

CtxKey is the type for keys stored in request contexts. 

const AuthErrorCtxKey CtxKey = "auth_error"

AuthErrorCtxKey is the context key holding an authentication error. 

const AuthValidatedCtxKey CtxKey = "auth_validated"

AuthValidatedCtxKey is the context key marking a validated authentication. 

const DefaultCortexIDCtxKey CtxKey = "default_cortex_id"

DefaultCortexIDCtxKey is the context key holding the default Cortex ID. 

const HiveAPIKeyCtxKey CtxKey = "hive_api_key" // #nosec G101 -- context key name, not a real credential

HiveAPIKeyCtxKey is the context key holding the TheHive API key. 

const HiveClientCtxKey CtxKey = "hive_client"

HiveClientCtxKey is the context key holding the TheHive client. 

const HiveOrgCtxKey CtxKey = "hive_org"

HiveOrgCtxKey is the context key holding the TheHive organisation. 

const HiveURLCtxKey CtxKey = "hive_url"

HiveURLCtxKey is the context key holding the TheHive URL. 

const PermissionsCtxKey CtxKey = "permissions"

PermissionsCtxKey is the context key holding the resolved permissions. 

const RequestIDCtxKey CtxKey = "request_id"

RequestIDCtxKey is the context key holding the request ID.

type EnvKey 

type EnvKey string

EnvKey is the type for supported environment variable names. 

const EnvKeyAllowEnvCredentialFallback EnvKey = "ALLOW_ENV_CREDENTIAL_FALLBACK" // #nosec G101 -- env var name, not a real credential

EnvKeyAllowEnvCredentialFallback is the env var name for the env credential fallback toggle. 

const EnvKeyAuthValidationCacheTTL EnvKey = "AUTH_VALIDATION_CACHE_TTL"

EnvKeyAuthValidationCacheTTL is the env var name for the auth validation cache TTL. 

const EnvKeyBindHost EnvKey = "MCP_BIND_HOST"

EnvKeyBindHost is the env var name for the MCP server bind host. 

const EnvKeyCortexID EnvKey = "CORTEX_ID"

EnvKeyCortexID is the env var name for the default Cortex ID. 

const EnvKeyLogLevel EnvKey = "LOG_LEVEL"

EnvKeyLogLevel is the env var name for the log level. 

const EnvKeyMCPHeartbeatInterval EnvKey = "MCP_HEARTBEAT_INTERVAL"

EnvKeyMCPHeartbeatInterval is the env var name for the MCP heartbeat interval. 

const EnvKeyMCPPort EnvKey = "MCP_PORT"

EnvKeyMCPPort is the env var name for the MCP server port. 

const EnvKeyMCPServerEndpoint EnvKey = "MCP_SERVER_ENDPOINT"

EnvKeyMCPServerEndpoint is the env var name for the MCP server endpoint path. 

const EnvKeyPermissionsConfig EnvKey = "PERMISSIONS_CONFIG"

EnvKeyPermissionsConfig is the env var name for the permissions config path. 

const EnvKeyTheHiveAPIKey EnvKey = "THEHIVE_API_KEY" // #nosec G101 -- env var name, not a real credential

EnvKeyTheHiveAPIKey is the env var name for TheHive API key. 

const EnvKeyTheHiveOrganisation EnvKey = "THEHIVE_ORGANISATION"

EnvKeyTheHiveOrganisation is the env var name for TheHive organisation. 

const EnvKeyTheHivePassword EnvKey = "THEHIVE_PASSWORD" // #nosec G101 -- env var name, not a real credential

EnvKeyTheHivePassword is the env var name for TheHive password. 

const EnvKeyTheHiveURL EnvKey = "THEHIVE_URL"

EnvKeyTheHiveURL is the env var name for TheHive URL. 

const EnvKeyTheHiveURLAllowlist EnvKey = "THEHIVE_URL_ALLOWLIST"

EnvKeyTheHiveURLAllowlist is the env var name for TheHive URL allowlist. 

const EnvKeyTheHiveUsername EnvKey = "THEHIVE_USERNAME"

EnvKeyTheHiveUsername is the env var name for TheHive username.

type FlagVar 

type FlagVar string

FlagVar is the type for supported CLI flag names. 

const FlagVarAllowEnvCredentialFallback FlagVar = "allow-env-credential-fallback" // #nosec G101 -- flag name, not a real credential

FlagVarAllowEnvCredentialFallback is the CLI flag name for the env credential fallback toggle. 

const FlagVarAuthValidationCacheTTL FlagVar = "auth-validation-cache-ttl"

FlagVarAuthValidationCacheTTL is the CLI flag name for the auth validation cache TTL. 

const FlagVarBindAddr FlagVar = "addr"

FlagVarBindAddr is the CLI flag name for the bind address. 

const FlagVarCortexID FlagVar = "cortex-id"

FlagVarCortexID is the CLI flag name for the default Cortex ID. 

const FlagVarLogLevel FlagVar = "log-level"

FlagVarLogLevel is the CLI flag name for the log level. 

const FlagVarMCPHeartbeatInterval FlagVar = "mcp-heartbeat-interval"

FlagVarMCPHeartbeatInterval is the CLI flag name for the MCP heartbeat interval. 

const FlagVarMCPServerEndpointPath FlagVar = "mcp-endpoint-path"

FlagVarMCPServerEndpointPath is the CLI flag name for the MCP server endpoint path. 

const FlagVarPermissionsConfig FlagVar = "permissions-config"

FlagVarPermissionsConfig is the CLI flag name for the permissions config path. 

const FlagVarTheHiveAPIKey FlagVar = "thehive-api-key" // #nosec G101 -- flag name, not a real credential

FlagVarTheHiveAPIKey is the CLI flag name for TheHive API key. 

const FlagVarTheHiveOrganisation FlagVar = "thehive-organisation"

FlagVarTheHiveOrganisation is the CLI flag name for TheHive organisation. 

const FlagVarTheHivePassword FlagVar = "thehive-password" // #nosec G101 -- flag name, not a real credential

FlagVarTheHivePassword is the CLI flag name for TheHive password. 

const FlagVarTheHiveURL FlagVar = "thehive-url"

FlagVarTheHiveURL is the CLI flag name for TheHive URL. 

const FlagVarTheHiveURLAllowlist FlagVar = "thehive-url-allowlist"

FlagVarTheHiveURLAllowlist is the CLI flag name for TheHive URL allowlist. 

const FlagVarTheHiveUsername FlagVar = "thehive-username"

FlagVarTheHiveUsername is the CLI flag name for TheHive username. 

const FlagVarTransportType FlagVar = "transport"

FlagVarTransportType is the CLI flag name for the transport type.

type HeaderKey 

type HeaderKey string

HeaderKey is the type for supported HTTP header names. 

const HeaderKeyTheHiveAPIKey HeaderKey = "X-TheHive-Api-Key" // #nosec G101 -- header name, not a real credential

HeaderKeyTheHiveAPIKey is the HTTP header carrying the TheHive API key. 

const HeaderKeyTheHiveOrganisation HeaderKey = "X-TheHive-Org"

HeaderKeyTheHiveOrganisation is the HTTP header carrying the TheHive organisation. 

const HeaderKeyTheHiveURL HeaderKey = "X-TheHive-Url"

HeaderKeyTheHiveURL is the HTTP header carrying the TheHive URL.

type OutputEntity added in v0.3.1 

type OutputEntity interface {
	thehive.OutputAlert |
		thehive.OutputCase |
		thehive.OutputTask |
		thehive.OutputObservable |
		map[string]any
}

OutputEntity is a union type representing possible output entities

type PermissionConfig 

type PermissionConfig string

PermissionConfig is the type for built-in permission configuration names. 

const PermissionConfigAdmin PermissionConfig = "admin"

PermissionConfigAdmin is the built-in admin permission configuration. 

const PermissionConfigReadOnly PermissionConfig = "read_only"

PermissionConfigReadOnly is the built-in read-only permission configuration.

type TheHiveMcpDefaultOptions 

type TheHiveMcpDefaultOptions struct {
	TheHiveURL          string
	TheHiveAPIKey       string
	TheHiveUsername     string
	TheHivePassword     string
	TheHiveOrganisation string
	// TheHiveURLAllowlist is the base URLs clients may target via the X-TheHive-Url
	// header; when empty, only TheHiveURL is permitted.
	TheHiveURLAllowlist []string
	// AllowEnvCredentialFallback allows HTTP requests without credentials to fall back to the
	// server's environment credentials (default: false, requests must supply their own credentials)
	AllowEnvCredentialFallback bool
	// AuthValidationCacheTTL is how long a successful TheHive credential validation is cached (HTTP transport).
	AuthValidationCacheTTL string
	// PermissionsConfigPath is the permissions config file path; empty uses the embedded read-only config.
	PermissionsConfigPath string
	MCPServerEndpointPath string
	MCPHeartbeatInterval  string
	TransportType         string
	BindAddr              string
	LogLevel              string
	DefaultCortexID       string
}

TheHiveMcpDefaultOptions holds the resolved server configuration built from CLI flags and environment variables.

func NewTheHiveMcpDefaultOptions 

func NewTheHiveMcpDefaultOptions() (*TheHiveMcpDefaultOptions, error)

NewTheHiveMcpDefaultOptions parses CLI flags (falling back to environment variables) and returns the resolved server options.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.