execute_automation

package
v1.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 6, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Overview

Package execute_automation implements the execute-automation MCP tool for running Cortex analyzers and responders and reading their execution status.

Index

Constants

View Source 
const (
	OperationRunAnalyzer     = "run-analyzer"
	OperationRunResponder    = "run-responder"
	OperationGetJobStatus    = "get-job-status"
	OperationGetActionStatus = "get-action-status"
	OperationWaitForJobs     = "wait-for-jobs"
)

Operation names accepted by the execute-automation tool.

View Source 
const (
	DefaultWaitSeconds = 45 // under the 60 s tool-call timeout of the MCP TypeScript SDK
	MaxWaitSeconds     = 120
	MaxWaitJobs        = 20
)

Bounds of a wait-for-jobs call. The ceiling keeps one blocking call inside a client's tool-call timeout; a caller with slower jobs calls again.

View Source 
const ExecuteAutomationToolDescription = `` /* 3527-byte string literal not displayed */

ExecuteAutomationToolDescription is the MCP tool description shown to clients.

Variables

View Source 
var ExecuteAutomationParamConstraints = map[string]tools.SchemaConstraint{
	"operation": {Enum: []string{
		OperationRunAnalyzer, OperationRunResponder, OperationGetJobStatus, OperationGetActionStatus, OperationWaitForJobs,
	}},
	"entity-type": {Enum: automationEntityTypes},
}

ExecuteAutomationParamConstraints carries the enumerations that ExecuteAutomationParams can no longer express as struct tags.

Exported so the schema tests can check every key against the struct.

Functions

This section is empty.

Types

type AnalyzerJobResult added in v0.3.1 

type AnalyzerJobResult struct {
	Operation string              `json:"operation"`
	Job       *FilteredOutputJob  `json:"job"`
	Message   utils.TrustedString `json:"message"`
}

AnalyzerJobResult is the result of a run-analyzer operation.

func NewAnalyzerJobResult added in v0.3.1 

func NewAnalyzerJobResult(job *thehive.OutputJob) *AnalyzerJobResult

NewAnalyzerJobResult builds an AnalyzerJobResult from a created analyzer job.

type AnalyzerJobStatusResult added in v0.3.1 

type AnalyzerJobStatusResult struct {
	Operation    string                 `json:"operation"`
	JobID        string                 `json:"jobId"`
	AnalyzerID   string                 `json:"analyzerId"`
	AnalyzerName string                 `json:"analyzerName"`
	Status       string                 `json:"status"`
	Result       utils.UntrustedSubtree `json:"result,omitempty"`
	Message      utils.TrustedString    `json:"message"`
}

AnalyzerJobStatusResult is the result of a get-job-status operation.

func NewAnalyzerJobStatusResult added in v0.3.1 

func NewAnalyzerJobStatusResult(job *thehive.OutputJob) *AnalyzerJobStatusResult

NewAnalyzerJobStatusResult builds an AnalyzerJobStatusResult from a job, including its report when available.

type ExecuteAutomationParams added in v0.3.1 

type ExecuteAutomationParams struct {
	Operation    string         `json:"operation"                 jsonschema_description:"The operation to perform."`
	AnalyzerID   string         `` /* 164-byte string literal not displayed */
	ResponderID  string         `` /* 168-byte string literal not displayed */
	CortexID     string         `` /* 259-byte string literal not displayed */
	ObservableID string         `` /* 146-byte string literal not displayed */
	EntityType   string         `json:"entity-type,omitempty"     jsonschema_description:"Entity type for run-responder operations."`
	EntityID     string         `` /* 154-byte string literal not displayed */
	JobID        string         `json:"job-id,omitempty"          jsonschema_description:"Job ID for get-job-status operations."`
	JobIDs       []string       `` /* 141-byte string literal not displayed */
	TimeoutSecs  int            `` /* 212-byte string literal not displayed */
	ActionID     string         `json:"action-id,omitempty"       jsonschema_description:"Action ID for get-action-status operations."`
	Parameters   map[string]any `` /* 163-byte string literal not displayed */
	// contains filtered or unexported fields
}

ExecuteAutomationParams holds the input parameters for the execute-automation tool.

type ExecuteAutomationResult added in v0.3.1 

type ExecuteAutomationResult struct {
	AnalyzerResult     *AnalyzerJobResult           `json:"analyzerResult,omitempty"`
	ResponderResult    *ResponderActionResult       `json:"responderResult,omitempty"`
	JobStatusResult    *AnalyzerJobStatusResult     `json:"jobStatusResult,omitempty"`
	ActionStatusResult *ResponderActionStatusResult `json:"actionStatusResult,omitempty"`
	WaitForJobsResult  *WaitForJobsResult           `json:"waitForJobsResult,omitempty"`
}

ExecuteAutomationResult is a union of the possible operation results; exactly one field is set.

func (ExecuteAutomationResult) Unwrap added in v0.3.1 

func (r ExecuteAutomationResult) Unwrap() any

Unwrap implements utils.Unwrapper to flatten the union for serialization.

type ExecuteAutomationTool 

type ExecuteAutomationTool struct {
	// contains filtered or unexported fields
}

ExecuteAutomationTool exposes Cortex analyzer/responder execution and status retrieval as an MCP tool.

func NewExecuteAutomationTool 

func NewExecuteAutomationTool() *ExecuteAutomationTool

NewExecuteAutomationTool returns a new ExecuteAutomationTool.

func (*ExecuteAutomationTool) Definition 

func (t *ExecuteAutomationTool) Definition() mcp.Tool

Definition returns the MCP tool definition (schema and description).

func (*ExecuteAutomationTool) Handle 

func (t *ExecuteAutomationTool) Handle(ctx context.Context, _ mcp.CallToolRequest, params ExecuteAutomationParams) (ExecuteAutomationResult, error)

Handle dispatches the request to the operation-specific handler based on params.Operation.

func (*ExecuteAutomationTool) Handler added in v0.3.1 

func (t *ExecuteAutomationTool) Handler() server.ToolHandlerFunc

Handler returns the tool handler wrapped with the shared validation middleware.

func (*ExecuteAutomationTool) HasUntrustedData added in v0.3.4 

func (t *ExecuteAutomationTool) HasUntrustedData() bool

HasUntrustedData reports that this tool's output may contain untrusted data.

func (*ExecuteAutomationTool) Name added in v0.3.1 

func (t *ExecuteAutomationTool) Name() string

Name returns the tool's registered MCP name.

func (*ExecuteAutomationTool) ValidateParams added in v0.3.1 

func (t *ExecuteAutomationTool) ValidateParams(params *ExecuteAutomationParams) error

ValidateParams verifies that the parameters required by the requested operation are present.

func (*ExecuteAutomationTool) ValidatePermissions added in v0.3.1 

func (t *ExecuteAutomationTool) ValidatePermissions(ctx context.Context, params ExecuteAutomationParams) error

ValidatePermissions checks that the caller is permitted to run the requested operation and that the target entity is within the configured filter scope.

type FilteredOutputAction added in v0.3.1 

type FilteredOutputAction struct {
	UnderscoreID  string `json:"_id"`
	ResponderID   string `json:"responderId"`
	ResponderName string `json:"responderName,omitempty"`
	CortexID      string `json:"cortexId,omitempty"`
	CortexJobID   string `json:"cortexJobId,omitempty"`
	ObjectType    string `json:"objectType"`
	ObjectID      string `json:"objectId"`
	Status        string `json:"status"`
	StartDate     int64  `json:"startDate"`
	EndDate       int64  `json:"endDate,omitempty"`
}

FilteredOutputAction is a reduced view of a Cortex responder action returned to clients.

func NewFilteredOutputAction added in v0.3.1 

func NewFilteredOutputAction(action *thehive.OutputAction) *FilteredOutputAction

NewFilteredOutputAction builds a FilteredOutputAction from a thehive OutputAction.

type FilteredOutputJob added in v0.3.1 

type FilteredOutputJob struct {
	UnderscoreID string                 `json:"_id"`
	AnalyzerID   string                 `json:"analyzerId"`
	AnalyzerName string                 `json:"analyzerName"`
	Status       string                 `json:"status"`
	StartDate    int64                  `json:"startDate"`
	EndDate      int64                  `json:"endDate,omitempty"`
	Report       utils.UntrustedSubtree `json:"report,omitempty"`
	CortexID     string                 `json:"cortexId"`
	CortexJobID  string                 `json:"cortexJobId"`
}

FilteredOutputJob is a reduced view of a Cortex analyzer job returned to clients.

func NewFilteredOutputJob added in v0.3.1 

func NewFilteredOutputJob(job *thehive.OutputJob) *FilteredOutputJob

NewFilteredOutputJob builds a FilteredOutputJob from a thehive OutputJob.

type JobError added in v1.2.0 

type JobError struct {
	JobID     string `json:"jobId"`
	Error     string `json:"error"`
	Retryable bool   `json:"retryable"`
}

JobError is a job whose latest attempt failed. A retryable one may still succeed, and is also listed in pendingJobIds.

type ResponderActionResult added in v0.3.1 

type ResponderActionResult struct {
	Operation string                `json:"operation"`
	Action    *FilteredOutputAction `json:"action"`
	Message   utils.TrustedString   `json:"message"`
}

ResponderActionResult is the result of a run-responder operation.

func NewResponderActionResult added in v0.3.1 

func NewResponderActionResult(action *thehive.OutputAction) *ResponderActionResult

NewResponderActionResult builds a ResponderActionResult from a created responder action.

type ResponderActionStatusResult added in v0.3.1 

type ResponderActionStatusResult struct {
	Operation     string `json:"operation"`
	ActionID      string `json:"actionId"`
	ResponderID   string `json:"responderId"`
	ResponderName string `json:"responderName"`
	EntityType    string `json:"entityType"`
	EntityID      string `json:"entityId"`
	Status        string `json:"status"`
	// Result stays a plain string on purpose: it holds the responder report
	// (third-party content) and must remain [UNTRUSTED_DATA]-wrapped.
	Result  string              `json:"result,omitempty"`
	Message utils.TrustedString `json:"message"`
}

ResponderActionStatusResult is the result of a get-action-status operation.

func NewResponderActionStatusResult added in v0.3.1 

func NewResponderActionStatusResult(action *thehive.OutputAction) *ResponderActionStatusResult

NewResponderActionStatusResult builds a ResponderActionStatusResult from a responder action.

type WaitForJobsResult added in v1.2.0 

type WaitForJobsResult struct {
	Operation string               `json:"operation"`
	Jobs      []*FilteredOutputJob `json:"jobs"`
	Pending   []string             `json:"pendingJobIds,omitempty"`
	Failed    []JobError           `json:"jobErrors,omitempty"`
	Waited    int                  `json:"waitedSeconds"`
	Message   utils.TrustedString  `json:"message"`
}

WaitForJobsResult is the result of a wait-for-jobs operation.

func NewWaitForJobsResult added in v1.2.0 

func NewWaitForJobsResult(jobs []*thehive.OutputJob, pending []string, failed []JobError, total, waited int) *WaitForJobsResult

NewWaitForJobsResult builds a WaitForJobsResult from the jobs read at least once, out of total. pending lists the jobs worth asking about again, failed the ones whose latest attempt failed; a retryable failure is in both.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.