go-sdk

module

v1.1.40-beta.1 Latest Latest Go to latest Published: Nov 11, 2026 License: MIT

Details

The official Go SDK for building applications and plugins within the ThreatWinds ecosystem.

For detailed guides, architecture overview, and plugin development references, please visit our Official Wiki.

This SDK is organized into several modules, each serving a specific purpose:

catcher: Robust error handling, structured logging, and advanced retry system.
entities: Data validation and standard ThreatWinds schema definitions.
os: Simplified OpenSearch client with fluent query builders and group-based access control.
plugins: Core infrastructure for developing Analysis, Notification, Parsing, and Correlation plugins.
utils: Common helper functions for type casting, I/O, HTTP requests, and more.

To use the SDK in your project:

go get github.com/threatwinds/go-sdk

Or install specific modules:

go get github.com/threatwinds/go-sdk/catcher
go get github.com/threatwinds/go-sdk/os
# etc.

Refer to the individual module directories for detailed documentation and examples.

Contributions are welcome! Please feel free to submit a Pull Request.

This project is licensed under the MIT License.

Path	Synopsis
catcher
client
auth
billing
compute
entities
os Package twos provides functionality for building index patterns and names.	Package twos provides functionality for building index patterns and names.
plugins
relay Package relay turns an upstream ThreatWinds service's failed HTTP response into the catcher.SdkError a relaying* service answers its own client with: the upstream's status becomes this service's status, its severity this service's severity, and its occurrence id this failure's id.	Package relay turns an upstream ThreatWinds service's failed HTTP response into the catcher.SdkError a relaying* service answers its own client with: the upstream's status becomes this service's status, its severity this service's severity, and its occurrence id this failure's id.
store
cache Package cache is a thin, nil-safe wrapper around a shared Redis/Valkey instance.	Package cache is a thin, nil-safe wrapper around a shared Redis/Valkey instance.
clickhouse Package clickhouse implements store.Store over ClickHouse.	Package clickhouse implements store.Store over ClickHouse.
composite Package composite serves one logical store from two: a primary that takes every write and holds everything from Cutover on, and a read-only legacy store that holds what came before.	Package composite serves one logical store from two: a primary that takes every write and holds everything from Cutover on, and a read-only legacy store that holds what came before.
opensearch
utils