soar

package
v0.9.16 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 3, 2026 License: Apache-2.0 Imports: 11 Imported by: 0

Documentation

Overview

authoring.go — MODERN (v1alpha) Python action/job authoring on the SOAR host: the IDE's create flow as an API loop. fetchTemplate returns a new definition skeleton; filling it and POSTing it to the integration's actions/jobs collection creates the definition; DELETE by numeric id removes it. The same numeric ids appear in the wildcard catalogs (integrations/-/actions), which is how callers find what they created.

Package soar is an unofficial Go SDK for the Google SecOps SOAR (Siemplify) API.

This package is the MODERN, durable v1alpha surface: integrations, connectors, jobs, alert-grouping rules, module settings, and cases. Transitional and legacy surfaces live in the danny.vn/secops/soar/legacy subpackage, quarantined so they can be deleted wholesale when their v1alpha equivalents ship — nothing here imports that subpackage.

SOAR authenticates with an AppKey (auth.SOARAppKey) on the tenant SOAR host, never ADC. See docs/design/soar.md for the full design and the three tiers.

Index

Constants

View Source 
const (
	SummaryStateSuccessful = "SUCCESSFUL"
	SummaryStateError      = "ERROR"
	SummaryStateInProgress = "IN_PROGRESS"
	SummaryStatePending    = "PENDING_START"
)

CaseSummary generation states.

Variables

View Source 
var CasePriorityTokens = []string{
	"PRIORITY_INFO", "PRIORITY_LOW", "PRIORITY_MEDIUM", "PRIORITY_HIGH", "PRIORITY_CRITICAL",
}

CasePriorityTokens are the modern v1alpha case priority filter tokens, lowest first — the values `priority = '<token>'` accepts.

Functions

func IsDeletableIntegration 

func IsDeletableIntegration(i Integration) bool

IsDeletableIntegration reports whether this tenant may delete the WHOLE integration pack: only a hand-built custom integration (Custom) is deletable. Commercial packs — including the per-tenant installed copies of marketplace integrations, whose Identifier carries a "__<uuid>" suffix but whose Custom is false — are NOT deletable here (the server rejects them), which protects the working installed integrations. To remove a duplicated connector *definition* inside such a pack, delete that definition with DeleteConnectorDef instead.

func IsNotFound 

func IsNotFound(err error) bool

IsNotFound reports whether err is (or wraps) a SOAR 404 — the SOAR-plane twin of chronicle.IsNotFound, so a not-found check reads the same on both clients.

Types

type ActionDef added in v0.3.0 

type ActionDef struct {
	Name        string          `json:"name"`
	ID          json.Number     `json:"id"`
	Integration string          `json:"integration"`
	DisplayName string          `json:"displayName"`
	Description string          `json:"description"`
	Enabled     bool            `json:"enabled"`
	Async       bool            `json:"async"`
	Custom      bool            `json:"custom"`
	Raw         json.RawMessage `json:"-"`
}

ActionDef is an action definition listed by the wildcard actions catalog — one entry per action across ALL integrations (the playbook designer's action palette). ID is the numeric definition id, also embedded in the resource Name ("…/integrations/<key>/actions/<id>"); it is the id the playbook-usage reverse index keys on.

func (*ActionDef) PathID added in v0.3.0 

func (a *ActionDef) PathID() string

PathID returns the segment that addresses this action in a resource path.

func (*ActionDef) UnmarshalJSON added in v0.3.0 

func (a *ActionDef) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes the typed fields and keeps the full object in Raw.

type AdvancedConfig added in v0.8.0 

type AdvancedConfig struct {
	TimeZone        string           `json:"timeZone,omitempty"`
	ScheduleType    ScheduleType     `json:"scheduleType,omitempty"`
	OneTimeSchedule *OneTimeSchedule `json:"oneTimeSchedule,omitempty"`
	DailySchedule   *DailySchedule   `json:"dailySchedule,omitempty"`
	WeeklySchedule  *WeeklySchedule  `json:"weeklySchedule,omitempty"`
	MonthlySchedule *MonthlySchedule `json:"monthlySchedule,omitempty"`
}

AdvancedConfig holds the schedule configuration for a job instance that uses advanced (calendar-based) scheduling instead of a simple interval.

type AlertGroupingRule 

type AlertGroupingRule struct {
	Name         string          `json:"name,omitempty"`         // full resource name
	ID           string          `json:"-"`                      // server id (numeric or string in the payload)
	Category     string          `json:"category,omitempty"`     // rule category
	GroupingType string          `json:"groupingType,omitempty"` // how alerts are coalesced
	EntityType   []string        `json:"entityType,omitempty"`   // entity types the rule keys on
	Raw          json.RawMessage `json:"-"`                      // full server payload
}

AlertGroupingRule describes how inbound alerts are grouped into cases. Raw retains the full server object for fields not modeled here.

func (*AlertGroupingRule) UnmarshalJSON 

func (r *AlertGroupingRule) UnmarshalJSON(data []byte) error

UnmarshalJSON keeps the typed fields and the complete payload in sync. The v1alpha payload returns id as a JSON number; an older shape used a string — accept either and normalize to a string.

type AlertRecommendation added in v0.3.0 

type AlertRecommendation struct {
	Recommendation string `json:"recommendation"`
	State          string `json:"state"`

	Raw json.RawMessage `json:"-"`
}

AlertRecommendation is one polled caseAlerts:fetchRecommendation result. State runs RUNNING → SUCCEEDED | FAILED.

func (*AlertRecommendation) Settled added in v0.3.0 

func (r *AlertRecommendation) Settled() bool

Settled reports whether recommendation generation has finished.

func (*AlertRecommendation) UnmarshalJSON added in v0.3.0 

func (r *AlertRecommendation) UnmarshalJSON(b []byte) error

UnmarshalJSON fills the typed fields and keeps the full payload.

type Case 

type Case struct {
	Name      string          `json:"name"`      // resource name (…/cases/<id>)
	DisplayID string          `json:"displayId"` // human-facing case number
	Priority  string          `json:"priority"`
	Stage     string          `json:"stage"`
	Status    string          `json:"status"`
	Title     string          `json:"-"` // tolerant: displayName/title
	Assignee  string          `json:"-"` // tolerant: assignee/assignedUser/owner
	Raw       json.RawMessage `json:"-"` // full case object as returned
}

Case is a minimal typed envelope over a v1alpha SOAR case. Only the few stable top-level fields are surfaced; the full, large, and still-evolving case schema is preserved verbatim in Raw.

DEVIATION: callers that want the complete object should read Raw; we deliberately do not model the entire v1alpha case schema here.

func (*Case) UnmarshalJSON added in v0.1.1 

func (c *Case) UnmarshalJSON(data []byte) error

UnmarshalJSON fills the stable typed fields, keeps the full object in Raw, and resolves Title/Assignee tolerantly — the v1alpha case schema has used different keys for those across revisions (and the existing "cases"/"items" envelope split shows the surface still moves), so we pick the first present key rather than pin one that a future revision renames.

type CaseAlert added in v0.3.0 

type CaseAlert struct {
	ID                   json.Number     `json:"id"`
	Identifier           string          `json:"identifier"`
	AlertGroupIdentifier string          `json:"alertGroupIdentifier"`
	DisplayName          string          `json:"displayName"`
	Raw                  json.RawMessage `json:"-"`
}

CaseAlert is one entry of a case's modern caseAlerts sub-collection. ID is the NUMERIC caseAlert id the AI-recommendation verbs key on; Identifier and AlertGroupIdentifier are the string forms the legacy lane uses.

func (*CaseAlert) UnmarshalJSON added in v0.3.0 

func (a *CaseAlert) UnmarshalJSON(b []byte) error

UnmarshalJSON fills the typed fields and keeps the full record.

type CaseListOptions 

type CaseListOptions struct {
	PageSize int    // per-request page cap (<=0 lets the server choose)
	Filter   string // server-side filter, e.g. "status = 'OPENED'"
	OrderBy  string // sort, e.g. "updateTime desc"
	Expand   string // comma-separated fields to inline, e.g. "products,tasks,tags,closureDetails,sla,alertsSla"
	MaxItems int    // stop once this many records are collected (<=0 = all pages)
}

CaseListOptions tunes ListCasesOpts; all fields are optional and map to the v1alpha cases list query parameters (the same the SecOps web UI sends).

type CaseSummary added in v0.3.0 

type CaseSummary struct {
	Reasons   []string `json:"reasons"`
	NextSteps []string `json:"nextSteps"`
	Summary   string   `json:"summary"`
	State     string   `json:"state"`

	// Raw is the complete response (markdownResults, updateTime, …).
	Raw json.RawMessage `json:"-"`
}

CaseSummary is the structured Gemini summary of a case from cases:getOrCreateCaseSummary — Google's own AI pre-digest of the case (reasons, next steps, narrative). Generation is asynchronous: State runs PENDING_START → IN_PROGRESS → SUCCESSFUL | ERROR; callers poll with isFirstRequest=false until it settles.

func (*CaseSummary) Settled added in v0.3.0 

func (s *CaseSummary) Settled() bool

Settled reports whether generation has finished (successfully or not).

func (*CaseSummary) UnmarshalJSON added in v0.3.0 

func (s *CaseSummary) UnmarshalJSON(b []byte) error

UnmarshalJSON fills the typed fields and keeps the full payload.

type Client 

type Client struct {
	// contains filtered or unexported fields
}

Client is a modern (v1alpha) SOAR API client. It is safe for concurrent use.

func NewClient 

func NewClient(s Settings, creds auth.Credentials, opts ...Option) (*Client, error)

NewClient builds a modern SOAR client. creds must be an AppKey credential (auth.SOARAppKey); auth resolves lazily on the first request, so constructing a client never touches the network.

func (*Client) AuditGetData added in v0.2.4 

func (c *Client) AuditGetData(ctx context.Context, body any) (json.RawMessage, error)

AuditGetData returns SOAR audit log entries via the v1alpha surface.

func (*Client) BatchUpdateModuleSettingProperties 

func (c *Client) BatchUpdateModuleSettingProperties(ctx context.Context, name string, props []ModuleSettingProperty) (json.RawMessage, error)

BatchUpdateModuleSettingProperties writes a batch of properties to a module's settings in one call. Set each property's Value as a string. The response shape is module-specific, so it is returned raw.

func (*Client) CaseChatList added in v0.2.4 

func (c *Client) CaseChatList(ctx context.Context, caseID int) (json.RawMessage, error)

CaseChatList returns chat messages for a case via the v1alpha cases resource.

func (*Client) CaseChatSend added in v0.2.4 

func (c *Client) CaseChatSend(ctx context.Context, caseID int, body any) (json.RawMessage, error)

CaseChatSend creates a new chat message on a case.

func (*Client) CaseChatUnreadCount added in v0.2.4 

func (c *Client) CaseChatUnreadCount(ctx context.Context, caseID int) (json.RawMessage, error)

CaseChatUnreadCount returns the unread message count for a case.

func (*Client) ContentPackDelete added in v0.2.4 

func (c *Client) ContentPackDelete(ctx context.Context, id string) error

ContentPackDelete deletes a custom content pack.

func (*Client) ContentPackDeployConnectors added in v0.2.4 

func (c *Client) ContentPackDeployConnectors(ctx context.Context, id string, body any) (json.RawMessage, error)

ContentPackDeployConnectors deploys connector instances from a content pack.

func (*Client) ContentPackDeployPlaybooks added in v0.2.4 

func (c *Client) ContentPackDeployPlaybooks(ctx context.Context, id string, body any) (json.RawMessage, error)

ContentPackDeployPlaybooks deploys playbooks from a content pack.

func (*Client) ContentPackDeployTestCases added in v0.2.4 

func (c *Client) ContentPackDeployTestCases(ctx context.Context, id string, body any) (json.RawMessage, error)

ContentPackDeployTestCases deploys test cases from a content pack.

func (*Client) CountCasePriorities added in v0.3.0 

func (c *Client) CountCasePriorities(ctx context.Context, filter string) (json.RawMessage, error)

CountCasePriorities calls the cases:countPriorities RPC. The RPC is not served on current deployments (404; the web UI builds its queue numbers from filtered lists instead) — use CountCasesByPriority, which derives the same counts from the list's totalSize. Kept for instances that may serve the RPC.

func (*Client) CountCases added in v0.3.0 

func (c *Client) CountCases(ctx context.Context, filter string) (int, error)

CountCases returns the exact number of cases matching the server-side filter without fetching them: every page of the modern cases list carries totalSize, so a single pageSize=1 request is a cheap exact count. A zero-match query answers HTTP 204 with an empty body, which counts as 0.

func (*Client) CountCasesByPriority added in v0.3.0 

func (c *Client) CountCasesByPriority(ctx context.Context, baseFilter string) (map[string]int, error)

CountCasesByPriority returns per-priority case counts for an optional base filter: one cheap CountCases per priority token, composed as "(<base>) and (priority = '<token>')". The queue's per-priority numbers in one call — the cases:countPriorities RPC is not served (the web UI builds its queue from filtered lists), so counts come from totalSize instead.

func (*Client) CreateActionDef added in v0.3.0 

func (c *Client) CreateActionDef(ctx context.Context, integration string, body json.RawMessage) (json.RawMessage, error)

CreateActionDef creates a custom action definition inside an integration: POST integrations/{key}/actions with a filled template body (name "" = create; displayName, script, custom:true, …). body is sent verbatim so numeric fields survive untouched; the response is the stored definition. LIVE MUTATION.

func (*Client) CreateAlertGroupingRule 

func (c *Client) CreateAlertGroupingRule(ctx context.Context, body any) (*AlertGroupingRule, error)

CreateAlertGroupingRule creates an alert-grouping rule from body (the new rule as a struct or map). Completes the rule lifecycle (list/get/patch/delete) so a new rule can be pushed from git rather than hand-created in the UI first. LIVE MUTATION. (Modern SOAR v1alpha — may 500 intermittently.)

func (*Client) CreateCalculatedFieldDefinition 

func (c *Client) CreateCalculatedFieldDefinition(ctx context.Context, body any) (json.RawMessage, error)

CreateCalculatedFieldDefinition creates a calculated-field definition (v1alpha calculatedFieldDefinitions).

func (*Client) CreateCaseAlertRecommendation added in v0.3.0 

func (c *Client) CreateCaseAlertRecommendation(ctx context.Context, caseID, alertID string) (string, error)

CreateCaseAlertRecommendation starts AI recommendation generation for one alert in a case (caseAlerts:createRecommendationLongRunning) and returns the recommendation id to poll with FetchCaseAlertRecommendation. alertID is the caseAlert's NUMERIC id within the case (see ListCaseAlerts).

func (*Client) CreateCaseCloseDefinition 

func (c *Client) CreateCaseCloseDefinition(ctx context.Context, body any) (json.RawMessage, error)

CreateCaseCloseDefinition creates a case-close (root-cause) definition (v1alpha caseCloseDefinitions).

func (*Client) CreateCaseStageDefinition 

func (c *Client) CreateCaseStageDefinition(ctx context.Context, body any) (json.RawMessage, error)

CreateCaseStageDefinition creates a case-stage definition (v1alpha caseStageDefinitions).

func (*Client) CreateCaseTagDefinition 

func (c *Client) CreateCaseTagDefinition(ctx context.Context, body any) (json.RawMessage, error)

CreateCaseTagDefinition creates a case-tag definition (v1alpha caseTagDefinitions).

func (*Client) CreateCustomField 

func (c *Client) CreateCustomField(ctx context.Context, body any) (json.RawMessage, error)

CreateCustomField creates a case custom-field definition (v1alpha customFields).

func (*Client) CreateCustomList 

func (c *Client) CreateCustomList(ctx context.Context, body any) (json.RawMessage, error)

CreateCustomList creates a custom list (v1alpha customLists).

func (*Client) CreateEntitiesBlocklist 

func (c *Client) CreateEntitiesBlocklist(ctx context.Context, body any) (json.RawMessage, error)

CreateEntitiesBlocklist creates an entity block-list entry (v1alpha entitiesBlocklists).

func (*Client) CreateEnvironment 

func (c *Client) CreateEnvironment(ctx context.Context, body any) (json.RawMessage, error)

CreateEnvironment creates a SOAR environment (v1alpha environments).

func (*Client) CreateIdpMappingGroup 

func (c *Client) CreateIdpMappingGroup(ctx context.Context, body any) (json.RawMessage, error)

CreateIdpMappingGroup creates a mapping group from the freeform body and returns the server echo. LIVE ACCESS MUTATION.

func (*Client) CreateIntegration added in v0.9.12 

func (c *Client) CreateIntegration(ctx context.Context, body json.RawMessage) (*Integration, error)

CreateIntegration creates a new custom integration pack. body carries the v1alpha POST shape: {displayName, parameters, categories, staging, type}. The integration starts empty (no actions/connectors/jobs); callers add definitions via CreateActionDef / CreateJobDef afterwards. LIVE MUTATION.

func (*Client) CreateJobDef added in v0.3.0 

func (c *Client) CreateJobDef(ctx context.Context, integration string, body json.RawMessage) (json.RawMessage, error)

CreateJobDef creates a custom job definition inside an integration (POST integrations/{key}/jobs, the filled jobs:fetchTemplate body). LIVE MUTATION.

func (*Client) CreateJobInstance added in v0.8.0 

func (c *Client) CreateJobInstance(ctx context.Context, integration, jobID string, body any) (*JobInstance, error)

CreateJobInstance creates a new job instance under the given integration/job. LIVE MUTATION.

func (*Client) CreateJobRevision added in v0.8.0 

func (c *Client) CreateJobRevision(ctx context.Context, integration, jobID string, body any) (*JobRevision, error)

CreateJobRevision creates a new revision snapshot for a job definition. body is typically {"job": <currentJobDef>, "comment": "..."}. LIVE MUTATION.

func (*Client) CreatePropertySchemaDefinition 

func (c *Client) CreatePropertySchemaDefinition(ctx context.Context, body any) (json.RawMessage, error)

CreatePropertySchemaDefinition creates a property-schema definition (v1alpha propertySchemaDefinitions).

func (*Client) CreateSimulatedCustomCase added in v0.2.3 

func (c *Client) CreateSimulatedCustomCase(ctx context.Context, body any) (json.RawMessage, error)

CreateSimulatedCustomCase creates a custom test case from alert/event field specs.

func (*Client) CreateSlaDefinition 

func (c *Client) CreateSlaDefinition(ctx context.Context, body any) (json.RawMessage, error)

CreateSlaDefinition creates an SLA definition (v1alpha slaDefinitions).

func (*Client) CreateSoarNetwork 

func (c *Client) CreateSoarNetwork(ctx context.Context, body any) (json.RawMessage, error)

CreateSoarNetwork creates a SOAR network (v1alpha soarNetworks).

func (*Client) CreateSocRole 

func (c *Client) CreateSocRole(ctx context.Context, body any) (json.RawMessage, error)

CreateSocRole creates a SOC role definition (v1alpha socRoles).

func (*Client) DeleteActionDef added in v0.3.0 

func (c *Client) DeleteActionDef(ctx context.Context, integration, actionID string) error

DeleteActionDef deletes one custom action definition by its numeric id (DELETE integrations/{key}/actions/{id}; the id comes from the wildcard catalog or the create response). LIVE MUTATION.

func (*Client) DeleteAlertGroupingRule 

func (c *Client) DeleteAlertGroupingRule(ctx context.Context, id string) error

DeleteAlertGroupingRule deletes an alert-grouping rule by id — needed for the --prune side of a reconcile loop. LIVE MUTATION.

func (*Client) DeleteCalculatedFieldDefinition 

func (c *Client) DeleteCalculatedFieldDefinition(ctx context.Context, id string) error

DeleteCalculatedFieldDefinition deletes a calculated-field definition by id (v1alpha calculatedFieldDefinitions).

func (*Client) DeleteCaseCloseDefinition 

func (c *Client) DeleteCaseCloseDefinition(ctx context.Context, id string) error

DeleteCaseCloseDefinition deletes a case-close definition by id (v1alpha caseCloseDefinitions).

func (*Client) DeleteCaseStageDefinition 

func (c *Client) DeleteCaseStageDefinition(ctx context.Context, id string) error

DeleteCaseStageDefinition deletes a case-stage definition by id (v1alpha caseStageDefinitions).

func (*Client) DeleteCaseTagDefinition 

func (c *Client) DeleteCaseTagDefinition(ctx context.Context, id string) error

DeleteCaseTagDefinition deletes a case-tag definition by id (v1alpha caseTagDefinitions).

func (*Client) DeleteConnectorDef 

func (c *Client) DeleteConnectorDef(ctx context.Context, integration, connectorID string) error

DeleteConnectorDef deletes one CUSTOM connector definition (e.g. a duplicated "Copy of …" template) from an integration. integration is the addressable key and connectorID is the numeric id from ListConnectors. Commercial (custom=false) connector definitions cannot be deleted — the server rejects them, which also protects the working stock connector. LIVE MUTATION.

func (*Client) DeleteCustomField 

func (c *Client) DeleteCustomField(ctx context.Context, id string) error

DeleteCustomField deletes a custom-field definition by id (v1alpha customFields).

func (*Client) DeleteCustomList 

func (c *Client) DeleteCustomList(ctx context.Context, id string) error

DeleteCustomList deletes a custom list by id (v1alpha customLists).

func (*Client) DeleteEntitiesBlocklist 

func (c *Client) DeleteEntitiesBlocklist(ctx context.Context, id string) error

DeleteEntitiesBlocklist deletes an entity block-list entry by id (v1alpha entitiesBlocklists).

func (*Client) DeleteEnvironment 

func (c *Client) DeleteEnvironment(ctx context.Context, id string) error

DeleteEnvironment deletes a SOAR environment by id (v1alpha environments).

func (*Client) DeleteIdpMappingGroup 

func (c *Client) DeleteIdpMappingGroup(ctx context.Context, id string) error

DeleteIdpMappingGroup deletes a mapping group by id. LIVE ACCESS MUTATION.

func (*Client) DeleteIntegration 

func (c *Client) DeleteIntegration(ctx context.Context, name string) error

DeleteIntegration deletes a whole custom integration pack by its addressable key (Identifier or a full resource path). Only genuinely CUSTOM packs (custom=true) are deletable; commercial/marketplace packs — including their per-tenant installed copies — are rejected by the server. To remove a single duplicated connector definition inside a pack, use DeleteConnectorDef instead. LIVE MUTATION.

func (*Client) DeleteJobDef added in v0.3.0 

func (c *Client) DeleteJobDef(ctx context.Context, integration, jobID string) error

DeleteJobDef deletes one custom job definition by its numeric id. LIVE MUTATION.

func (*Client) DeleteJobInstance added in v0.8.0 

func (c *Client) DeleteJobInstance(ctx context.Context, integration, jobID, instanceID string) error

DeleteJobInstance deletes a job instance. LIVE MUTATION.

func (*Client) DeleteJobRevision added in v0.8.0 

func (c *Client) DeleteJobRevision(ctx context.Context, integration, jobID, revisionID string) error

DeleteJobRevision deletes a job revision. LIVE MUTATION.

func (*Client) DeletePropertySchemaDefinition 

func (c *Client) DeletePropertySchemaDefinition(ctx context.Context, id string) error

DeletePropertySchemaDefinition deletes a property-schema definition by id (v1alpha propertySchemaDefinitions).

func (*Client) DeleteSlaDefinition 

func (c *Client) DeleteSlaDefinition(ctx context.Context, id string) error

DeleteSlaDefinition deletes an SLA definition by id (v1alpha slaDefinitions).

func (*Client) DeleteSoarNetwork 

func (c *Client) DeleteSoarNetwork(ctx context.Context, id string) error

DeleteSoarNetwork deletes a SOAR network by id (v1alpha soarNetworks).

func (*Client) DeleteSocRole 

func (c *Client) DeleteSocRole(ctx context.Context, id string) error

DeleteSocRole deletes a SOC role by id (v1alpha socRoles).

func (*Client) DeleteUseCase added in v0.2.3 

func (c *Client) DeleteUseCase(ctx context.Context, body any) (json.RawMessage, error)

DeleteUseCase deletes a custom simulation.

func (*Client) DeleteWorkflows added in v0.2.1 

func (c *Client) DeleteWorkflows(ctx context.Context, identifiers []string) (json.RawMessage, error)

DeleteWorkflows deletes one or more playbook definitions by their identifiers via the v1alpha SOAR-host legacyPlaybooks:legacyDeleteWorkflows surface. identifiers is the list of workflow definition UUIDs to delete.

func (*Client) DuplicateWorkflows added in v0.7.1 

func (c *Client) DuplicateWorkflows(ctx context.Context, body any) (json.RawMessage, error)

DuplicateWorkflows duplicates one or more playbook definitions via the v1alpha SOAR-host path. body carries: 

{"identifiers":["uuid",...],"priority":0,"categoryId":0,"environments":["Default Environment"]}

priority and categoryId 0 = keep original value. The copy is auto-named "Copy of <original>". Returns {"payload":[...]} wrapping the full definitions of the created copies.

func (*Client) ExecuteAlertActions added in v0.3.0 

func (c *Client) ExecuteAlertActions(ctx context.Context, body any) (json.RawMessage, error)

ExecuteAlertActions runs a batch of enrichment-agent actions (enrichmentAgent:executeActions). body is the documented request ({siemAlertId, actions[]}). LIVE MUTATION — callers gate it.

func (*Client) ExecuteConnectorTest added in v0.7.0 

func (c *Client) ExecuteConnectorTest(ctx context.Context, integration, connectorID, instanceID string) (json.RawMessage, error)

ExecuteConnectorTest runs the test script for a connector instance. Returns the raw test result from the server.

func (*Client) ExecuteJobTest added in v0.7.0 

func (c *Client) ExecuteJobTest(ctx context.Context, integration, jobID, instanceID string) (json.RawMessage, error)

ExecuteJobTest runs the test script for a job instance. Returns the raw test result from the server.

func (*Client) ExecuteManualAction added in v0.2.3 

func (c *Client) ExecuteManualAction(ctx context.Context, body any) (json.RawMessage, error)

ExecuteManualAction runs a single integration action against a case via the v1alpha SOAR-host legacyCases:executeManualAction surface. body carries the action selectors (caseId, actionProvider, actionName, alertGroupIdentifiers, properties incl. ScriptName/IntegrationInstance/ScriptParametersEntityFields). Returns the full action result (resultCode, message, resultJsonObject, …).

func (*Client) FetchActionTemplate added in v0.3.0 

func (c *Client) FetchActionTemplate(ctx context.Context, integration string, async bool) (json.RawMessage, error)

FetchActionTemplate returns the new-action definition skeleton for one integration (actions:fetchTemplate). async selects the asynchronous action variant (polling timeouts and an async script skeleton). Read-only.

func (*Client) FetchAlertActions added in v0.3.0 

func (c *Client) FetchAlertActions(ctx context.Context, siemAlertID string) (json.RawMessage, error)

FetchAlertActions lists the integration actions executable against the alert's entities (enrichmentAgent:fetchActions). Read-only.

func (*Client) FetchAlertData added in v0.3.0 

func (c *Client) FetchAlertData(ctx context.Context, siemAlertID string) (json.RawMessage, error)

FetchAlertData returns a SIEM alert's enrichment context (enrichmentAgent:fetchAlertData). Read-only.

func (*Client) FetchCaseAlertRecommendation added in v0.3.0 

func (c *Client) FetchCaseAlertRecommendation(ctx context.Context, caseID, alertID, recommendationID string) (*AlertRecommendation, error)

FetchCaseAlertRecommendation polls one AI alert recommendation by id.

The documented URL template nests a literal `caseAlerts:` segment under the caseAlert resource; some instances serve the verb directly on the resource instead, so a NotFound on the documented form falls back to the direct form.

func (*Client) FetchCommercialDiff added in v0.2.4 

func (c *Client) FetchCommercialDiff(ctx context.Context, integrationID string) (json.RawMessage, error)

FetchCommercialDiff returns the diff between installed and marketplace version.

func (*Client) FetchJobTemplate added in v0.3.0 

func (c *Client) FetchJobTemplate(ctx context.Context, integration string) (json.RawMessage, error)

FetchJobTemplate returns the new-job definition skeleton for one integration (jobs:fetchTemplate) — a SiemplifyJob Python scaffold. Read-only.

func (*Client) FetchLatestConnectorDefinition 

func (c *Client) FetchLatestConnectorDefinition(ctx context.Context, integration, connectorID, instanceID string) (json.RawMessage, error)

FetchLatestConnectorDefinition returns the connector's current schema definition (parameter descriptors, defaults) as raw JSON, for reconciling a stored instance against the latest connector version.

func (*Client) GenerateUseCases added in v0.2.3 

func (c *Client) GenerateUseCases(ctx context.Context, body any) (json.RawMessage, error)

GenerateUseCases generates test cases from templates or custom names.

func (*Client) GetActionDef added in v0.5.3 

func (c *Client) GetActionDef(ctx context.Context, integration, actionID string) (json.RawMessage, error)

GetActionDef returns ONE action definition's full object — including its `parameters` schema (type/mandatory/defaultValue/displayName/description/ optionalValues), which the LIST collection never returns regardless of field mask (a server quirk: a parameters subtree mask yields empty objects, an explicit-leaf mask omits parameters, and the list omits them even unmasked). integration is the addressable key; actionID is the numeric definition id. The Python script body rides along but is not parsed. Read-only.

func (*Client) GetAlertGroupingRule 

func (c *Client) GetAlertGroupingRule(ctx context.Context, id string) (*AlertGroupingRule, error)

GetAlertGroupingRule fetches a single alert-grouping rule by id.

func (*Client) GetCalculatedFieldDefinition 

func (c *Client) GetCalculatedFieldDefinition(ctx context.Context, id string) (json.RawMessage, error)

GetCalculatedFieldDefinition returns a single calculated-field definition by id (v1alpha calculatedFieldDefinitions).

func (*Client) GetCaseTagDefinition 

func (c *Client) GetCaseTagDefinition(ctx context.Context, id string) (json.RawMessage, error)

GetCaseTagDefinition returns a single case-tag definition by id (v1alpha caseTagDefinitions).

func (*Client) GetConnectorDef 

func (c *Client) GetConnectorDef(ctx context.Context, integration, connectorID string) (*ConnectorDef, error)

GetConnectorDef fetches one connector definition by its parent integration key and numeric connector id (the id from ListConnectors).

func (*Client) GetConnectorInstance 

func (c *Client) GetConnectorInstance(ctx context.Context, integration, connectorID, instanceID string) (*ConnectorInstance, error)

GetConnectorInstance reads a connector instance's configuration.

func (*Client) GetContentPack added in v0.1.1 

func (c *Client) GetContentPack(ctx context.Context, identifier string) (*ContentPack, error)

GetContentPack fetches one Content-Hub content pack by its identifier (GET contentHub/contentPacks/{id} on the SOAR host, v1alpha) — the inspect-before- install read the list-only surface lacked. Read-only.

func (*Client) GetCustomCaseDetails added in v0.2.3 

func (c *Client) GetCustomCaseDetails(ctx context.Context, body any) (json.RawMessage, error)

GetCustomCaseDetails returns the config of one custom simulation.

func (*Client) GetCustomCases added in v0.2.3 

func (c *Client) GetCustomCases(ctx context.Context) (json.RawMessage, error)

GetCustomCases returns all custom (simulated) case names on the instance.

func (*Client) GetCustomField 

func (c *Client) GetCustomField(ctx context.Context, id string) (json.RawMessage, error)

GetCustomField returns a single custom-field definition by id (v1alpha customFields).

func (*Client) GetCustomList 

func (c *Client) GetCustomList(ctx context.Context, id string) (json.RawMessage, error)

GetCustomList returns a single custom list by id (v1alpha customLists).

func (*Client) GetEntitiesBlocklist 

func (c *Client) GetEntitiesBlocklist(ctx context.Context, id string) (json.RawMessage, error)

GetEntitiesBlocklist returns a single entity block-list entry by id (v1alpha entitiesBlocklists).

func (*Client) GetEnvironment 

func (c *Client) GetEnvironment(ctx context.Context, id string) (json.RawMessage, error)

GetEnvironment returns a single SOAR environment by id (v1alpha environments).

func (*Client) GetEnvironmentActionDefinitions added in v0.7.0 

func (c *Client) GetEnvironmentActionDefinitions(ctx context.Context, body any) (json.RawMessage, error)

GetEnvironmentActionDefinitions returns ALL action definitions for an environment in a single call — the all-in-one action palette (368 actions / 34 integrations on a typical tenant). body carries: environmentName.

func (*Client) GetIdpExternalProviders 

func (c *Client) GetIdpExternalProviders(ctx context.Context) (json.RawMessage, error)

GetIdpExternalProviders returns the external identity providers configured for the system (read), as raw JSON.

func (*Client) GetIdpMappingGroup 

func (c *Client) GetIdpMappingGroup(ctx context.Context, id string) (json.RawMessage, error)

GetIdpMappingGroup fetches one IdP mapping group by id, as raw JSON.

func (*Client) GetIntegration 

func (c *Client) GetIntegration(ctx context.Context, identifier string) (*Integration, error)

GetIntegration fetches a single integration by its Identifier (the installed copy's "<base>__<uuid>" or the bare base — see the Integration gotcha).

func (*Client) GetJobDef added in v0.8.0 

func (c *Client) GetJobDef(ctx context.Context, integration, jobID string) (*JobDef, error)

GetJobDef fetches one job definition by its parent integration key and numeric job id (the id from ListJobs).

func (*Client) GetJobInstance 

func (c *Client) GetJobInstance(ctx context.Context, integration, jobID, instanceID string) (*JobInstance, error)

GetJobInstance fetches a single job instance's configuration.

func (*Client) GetJobInstanceLog added in v0.8.0 

func (c *Client) GetJobInstanceLog(ctx context.Context, integration, jobID, instanceID, logID string) (*JobInstanceLog, error)

GetJobInstanceLog fetches a single execution log entry.

func (*Client) GetMarketplaceIntegration 

func (c *Client) GetMarketplaceIntegration(ctx context.Context, identifier string) (*MarketplaceIntegration, error)

GetMarketplaceIntegration fetches one catalog entry by its identifier.

func (*Client) GetModuleSettings 

func (c *Client) GetModuleSettings(ctx context.Context, name string) (json.RawMessage, error)

GetModuleSettings returns the raw settings object for a named module. The shape is module-specific, so it is returned undecoded.

func (*Client) GetNestedPlaybooks added in v0.7.0 

func (c *Client) GetNestedPlaybooks(ctx context.Context, body any) (json.RawMessage, error)

GetNestedPlaybooks returns the nested (block) playbooks available in the given environments, formatted as step definitions. body carries: environmentNames (string array).

func (*Client) GetOrCreateCaseSummary added in v0.3.0 

func (c *Client) GetOrCreateCaseSummary(ctx context.Context, caseID string, isFirstRequest bool) (*CaseSummary, error)

GetOrCreateCaseSummary fetches (generating on first request) the AI summary of one case. caseID is the case's modern resource id (the SOAR integer id as a string). Set isFirstRequest on the first call; poll with false until Settled.

func (*Client) GetPlaybookCategories added in v0.7.0 

func (c *Client) GetPlaybookCategories(ctx context.Context) (json.RawMessage, error)

GetPlaybookCategories returns the playbook category list.

func (*Client) GetPlaybookFullInfoWithEnvFilter added in v0.7.0 

func (c *Client) GetPlaybookFullInfoWithEnvFilter(ctx context.Context, body any) (json.RawMessage, error)

GetPlaybookFullInfoWithEnvFilter returns a playbook's full definition with environment filtering — the same shape as GetWorkflowFullInfo but scoped to the environments the caller has access to. body carries: identifier (string), environmentNames (string array).

func (*Client) GetPlaybookMenuCards added in v0.7.0 

func (c *Client) GetPlaybookMenuCards(ctx context.Context, body any) (json.RawMessage, error)

GetPlaybookMenuCards returns the playbook list with environment filtering, as shown in the playbook manager sidebar. body carries: environmentNames (string array) and optional folderName.

func (*Client) GetPlaybookPermissionsOptions added in v0.7.0 

func (c *Client) GetPlaybookPermissionsOptions(ctx context.Context, body any) (json.RawMessage, error)

GetPlaybookPermissionsOptions returns the permission model options for playbook access control. body carries the request parameters (e.g. workflowIdentifier).

func (*Client) GetPropertySchemaDefinition 

func (c *Client) GetPropertySchemaDefinition(ctx context.Context, id string) (json.RawMessage, error)

GetPropertySchemaDefinition returns a single property-schema definition by id (v1alpha propertySchemaDefinitions).

func (*Client) GetSlaDefinition 

func (c *Client) GetSlaDefinition(ctx context.Context, id string) (json.RawMessage, error)

GetSlaDefinition returns a single SLA definition by id (v1alpha slaDefinitions).

func (*Client) GetSoarNetwork 

func (c *Client) GetSoarNetwork(ctx context.Context, id string) (json.RawMessage, error)

GetSoarNetwork returns a single SOAR network by id (v1alpha soarNetworks).

func (*Client) GetSocRole 

func (c *Client) GetSocRole(ctx context.Context, id string) (json.RawMessage, error)

GetSocRole returns a single SOC role by id (v1alpha socRoles).

func (*Client) GetUser added in v0.7.0 

func (c *Client) GetUser(ctx context.Context, userID string) (*User, error)

GetUser returns a single SOAR user by their UUID.

func (*Client) GetUserLocalization added in v0.7.0 

func (c *Client) GetUserLocalization(ctx context.Context, userID string) (json.RawMessage, error)

GetUserLocalization returns the localization settings for a SOAR user.

func (*Client) GetUserNotificationCount added in v0.7.0 

func (c *Client) GetUserNotificationCount(ctx context.Context, userID string) (json.RawMessage, error)

GetUserNotificationCount returns the unread notification count for a user.

func (*Client) GetWorkflowFullInfo added in v0.2.2 

func (c *Client) GetWorkflowFullInfo(ctx context.Context, identifier string) (json.RawMessage, error)

GetWorkflowFullInfo returns the full definition of a playbook by its identifier via the v1alpha SOAR-host path. The returned object is the same shape that SaveWorkflowDefinitions accepts as its body.

func (*Client) GetWorkflowInstance added in v0.7.0 

func (c *Client) GetWorkflowInstance(ctx context.Context, body any) (json.RawMessage, error)

GetWorkflowInstance returns the full step-by-step execution detail for one playbook run instance — each step's status, input/output, timing, and error detail. body carries: workflowInstanceId (the execution id from the cards).

func (*Client) GetWorkflowInstanceCards added in v0.7.0 

func (c *Client) GetWorkflowInstanceCards(ctx context.Context, body any) (json.RawMessage, error)

GetWorkflowInstanceCards returns the execution history cards for a playbook run (or all runs for a case/alert). The body carries selectors: caseId, alertIdentifier — the server returns a card per playbook execution. This is the v1alpha twin of the legacy external API's GetWorkflowInstancesCards.

func (*Client) GetWorkflowInstanceSummary added in v0.2.1 

func (c *Client) GetWorkflowInstanceSummary(ctx context.Context, body any) (json.RawMessage, error)

GetWorkflowInstanceSummary returns a playbook run's workflow-instance summary — its steps and, when the body sets shouldFetchSteps, each step's execution result (including the failure/traceback of a failed step) — via the v1alpha SOAR-host legacyPlaybooks surface.

body carries the run selectors: caseId (string), alertIdentifier, and definitionIdentifier (the playbook id); parentWorkflowInstanceId is only needed to address a nested-loop iteration. All three core selectors are required — the server returns a generic 500 (errorCode 2000) when one is missing, not a 4xx.

This is the modern twin of the legacy external-API method (POST /cases/GetWorkflowInstanceSummary, AppKey); both serve the same shape. Per project direction the CLI prefers this v1alpha path and falls back to the legacy one (see internal/cli preferModern).

func (*Client) InstallFeaturedPlaybook added in v0.2.4 

func (c *Client) InstallFeaturedPlaybook(ctx context.Context, uid string, body any) (json.RawMessage, error)

InstallFeaturedPlaybook installs a featured playbook by its uid. body carries the install options — the API requires {"environments": [...]}.

func (*Client) InstallMarketplaceIntegration 

func (c *Client) InstallMarketplaceIntegration(ctx context.Context, identifier string, body any) (json.RawMessage, error)

InstallMarketplaceIntegration installs an integration pack (POST marketplaceIntegrations/{id}:install). body carries any install options. The modern twin of the legacy /store install. LIVE MUTATION.

func (*Client) ListActions added in v0.3.0 

func (c *Client) ListActions(ctx context.Context, integration string) ([]ActionDef, error)

ListActions returns the action definitions of one integration. integration is the addressable key (Name/Identifier — see the Integration gotcha). It requests the summary columns only (no parameters or script bodies); use GetActionDef per action when the parameter schema is needed.

func (*Client) ListAlertGroupingRules 

func (c *Client) ListAlertGroupingRules(ctx context.Context) ([]AlertGroupingRule, error)

ListAlertGroupingRules returns every alert-grouping rule on the instance.

func (*Client) ListAllActions added in v0.3.0 

func (c *Client) ListAllActions(ctx context.Context) ([]ActionDef, error)

ListAllActions returns every action definition across ALL integrations via the `-` wildcard collection — the designer's action palette in one call.

func (*Client) ListAllIntegrationInstances added in v0.7.0 

func (c *Client) ListAllIntegrationInstances(ctx context.Context) ([]IntegrationInstance, error)

ListAllIntegrationInstances returns every integration instance across ALL integrations and environments via the "-" wildcard parent. This is the fleet-wide instance inventory (the console's Settings → Integrations grid).

func (*Client) ListAllJobInstances added in v0.8.0 

func (c *Client) ListAllJobInstances(ctx context.Context) ([]JobInstance, error)

ListAllJobInstances returns every job instance across all integrations using the wildcard resource path.

func (*Client) ListCalculatedFieldDefinitions 

func (c *Client) ListCalculatedFieldDefinitions(ctx context.Context) ([]json.RawMessage, error)

CalculatedFieldDefinition writes/reads (modern v1alpha). targetField must be an Active Free-Text custom field. LIVE MUTATIONS for the writes.

func (*Client) ListCaseAlerts added in v0.3.0 

func (c *Client) ListCaseAlerts(ctx context.Context, caseID string) ([]CaseAlert, error)

ListCaseAlerts lists a case's alerts on the modern collection (cases/{case}/caseAlerts) — the source of the numeric caseAlert id.

func (*Client) ListCaseCloseDefinitions 

func (c *Client) ListCaseCloseDefinitions(ctx context.Context) ([]json.RawMessage, error)

ListCaseCloseDefinitions returns the case-close (root-cause) definitions (modern v1alpha). Read-only.

func (*Client) ListCaseStageDefinitions 

func (c *Client) ListCaseStageDefinitions(ctx context.Context) ([]json.RawMessage, error)

ListCaseStageDefinitions returns the case-stage definitions (modern v1alpha). Read-only.

func (*Client) ListCaseTagDefinitions 

func (c *Client) ListCaseTagDefinitions(ctx context.Context) ([]json.RawMessage, error)

ListCaseTagDefinitions returns the case-tag definitions (modern v1alpha). Read-only.

func (*Client) ListCaseWallRecords added in v0.2.4 

func (c *Client) ListCaseWallRecords(ctx context.Context, caseID int) (json.RawMessage, error)

ListCaseWallRecords returns the case wall timeline entries.

func (*Client) ListCases 

func (c *Client) ListCases(ctx context.Context, pageSize int) ([]json.RawMessage, error)

ListCases returns every case as a raw JSON object (pageSize bounds each request; <=0 lets the server choose). It is a thin wrapper over ListCasesOpts.

func (*Client) ListCasesOpts 

func (c *Client) ListCasesOpts(ctx context.Context, opt CaseListOptions) ([]json.RawMessage, error)

ListCasesOpts returns cases as raw JSON, paging through the v1alpha {cases|items, nextPageToken} response, applying server-side filter/orderBy and optional field expansion. Pagination stops at opt.MaxItems (when set) and is otherwise capped by the runaway backstop (listMaxPages).

DEVIATION: raw case JSON is returned because the v1alpha case schema is large and still moving; typed accessors (see Case) can layer on later.

func (*Client) ListCasesTyped added in v0.1.1 

func (c *Client) ListCasesTyped(ctx context.Context, opt CaseListOptions) ([]Case, error)

ListCasesTyped is ListCasesOpts decoded into the typed Case view (id · displayName · status · priority · stage · assignee, plus Raw), so every consumer gets the same minimal struct instead of redefining its own over the raw JSON.

func (*Client) ListConnectorInstances 

func (c *Client) ListConnectorInstances(ctx context.Context, integration, connectorID string) ([]ConnectorInstance, error)

ListConnectorInstances returns every configured instance of a connector (Google-style {items,nextPageToken} pagination).

func (*Client) ListConnectors 

func (c *Client) ListConnectors(ctx context.Context, integration string) ([]ConnectorDef, error)

ListConnectors returns the connector definitions of one integration. integration is the addressable key (Name/Identifier — see the Integration gotcha).

func (*Client) ListContentPacks 

func (c *Client) ListContentPacks(ctx context.Context) ([]ContentPack, error)

ListContentPacks returns the Content-Hub content packs (GET contentHub/contentPacks on the SOAR host, v1alpha). Read-only.

func (*Client) ListContextProperties added in v0.2.4 

func (c *Client) ListContextProperties(ctx context.Context, caseID int) (json.RawMessage, error)

ListContextProperties returns the case-level key-value context properties.

func (*Client) ListCustomFieldValues added in v0.2.4 

func (c *Client) ListCustomFieldValues(ctx context.Context, caseID int) (json.RawMessage, error)

ListCustomFieldValues returns the custom field values for a case.

func (*Client) ListCustomFields 

func (c *Client) ListCustomFields(ctx context.Context) ([]json.RawMessage, error)

CustomField writes/reads (modern v1alpha). type/scopes/name are immutable after create; a FREE_TEXT field needs no type_options. LIVE MUTATIONS for the writes.

func (*Client) ListCustomLists 

func (c *Client) ListCustomLists(ctx context.Context) ([]json.RawMessage, error)

ListCustomLists returns the custom (tracking/standard/block) lists (modern v1alpha). Read-only.

func (*Client) ListEntitiesBlocklists 

func (c *Client) ListEntitiesBlocklists(ctx context.Context) ([]json.RawMessage, error)

EntitiesBlocklist writes/reads (modern v1alpha). The body is an EntitiesBlocklist: entityIdentifier + entityType + action + environmentsJson. NOTE: `action` is the server enum ActionScope and `entityType` is also enum- validated, but neither value set is documented — supply a server-valid token. Reads are confirmed; create reaches the endpoint (400 on a bad enum, not 500). LIVE MUTATIONS for the write methods.

func (*Client) ListEnvironments 

func (c *Client) ListEnvironments(ctx context.Context) ([]json.RawMessage, error)

ListEnvironments returns the SOAR environments (modern v1alpha). Read-only.

func (*Client) ListFeaturedPlaybooks added in v0.2.4 

func (c *Client) ListFeaturedPlaybooks(ctx context.Context) (json.RawMessage, error)

ListFeaturedPlaybooks lists Google-curated featured playbooks.

func (*Client) ListIdpMappingGroups 

func (c *Client) ListIdpMappingGroups(ctx context.Context) ([]json.RawMessage, error)

ListIdpMappingGroups returns every IdP mapping group as raw JSON.

func (*Client) ListIntegrationInstances added in v0.7.0 

func (c *Client) ListIntegrationInstances(ctx context.Context, integration, environment string) ([]IntegrationInstance, error)

ListIntegrationInstances returns the integration instances for one specific integration, optionally filtered to a single environment.

func (*Client) ListIntegrations 

func (c *Client) ListIntegrations(ctx context.Context) ([]Integration, error)

ListIntegrations returns every installed integration in the tenant.

func (*Client) ListIntegrationsFiltered added in v0.7.0 

func (c *Client) ListIntegrationsFiltered(ctx context.Context, filter string) ([]Integration, error)

ListIntegrationsFiltered returns integrations matching a server-side filter expression (e.g. "(internal != true) and (type = 'RESPONSE')").

func (*Client) ListJobInstanceLogs added in v0.8.0 

func (c *Client) ListJobInstanceLogs(ctx context.Context, integration, jobID, instanceID string, pageSize int, pageToken string) ([]JobInstanceLog, string, int, error)

ListJobInstanceLogs returns execution logs for a job instance. Returns (logs, nextPageToken, totalSize, error).

func (*Client) ListJobInstances 

func (c *Client) ListJobInstances(ctx context.Context, integration, jobID string) ([]JobInstance, error)

ListJobInstances returns every configured instance of an integration job.

func (*Client) ListJobRevisions added in v0.8.0 

func (c *Client) ListJobRevisions(ctx context.Context, integration, jobID string) ([]JobRevision, error)

ListJobRevisions returns all revisions for a job definition.

func (*Client) ListJobs 

func (c *Client) ListJobs(ctx context.Context, integration string) ([]JobDef, error)

ListJobs returns the job definitions of one integration. integration is the addressable key (Name/Identifier — see the Integration gotcha).

func (*Client) ListLogicalOperators added in v0.3.0 

func (c *Client) ListLogicalOperators(ctx context.Context) ([]FlowFunction, error)

ListLogicalOperators returns every logical operator (Flow condition predicate) across all integrations via the `-` wildcard collection.

func (*Client) ListMarketplaceIntegrations 

func (c *Client) ListMarketplaceIntegrations(ctx context.Context) ([]MarketplaceIntegration, error)

ListMarketplaceIntegrations returns the Content-Hub integration catalog (GET marketplaceIntegrations on the SOAR host, v1alpha). Read-only.

func (*Client) ListModuleSettingProperties 

func (c *Client) ListModuleSettingProperties(ctx context.Context, name string) ([]ModuleSettingProperty, error)

ListModuleSettingProperties returns every key/value property of a module's settings. Every Value is a string regardless of its logical type.

func (*Client) ListOntologyRecords 

func (c *Client) ListOntologyRecords(ctx context.Context) ([]json.RawMessage, error)

ListOntologyRecords returns the ontology records (modern v1alpha, SOAR host). Read-only here; the write path is import/export (ZIP) + the visualFamilies and mappingRules sub-resources, not a plain create.

func (*Client) ListPropertySchemaDefinitions 

func (c *Client) ListPropertySchemaDefinitions(ctx context.Context) ([]json.RawMessage, error)

PropertySchemaDefinition writes/reads (modern v1alpha). All-scalar body (rawFieldName/displayName/groupName required). LIVE MUTATIONS for the writes.

func (*Client) ListRemoteAgents 

func (c *Client) ListRemoteAgents(ctx context.Context) ([]json.RawMessage, error)

ListRemoteAgents returns the SOAR remote agents (modern v1alpha). Read-only.

func (*Client) ListSlaDefinitions 

func (c *Client) ListSlaDefinitions(ctx context.Context) ([]json.RawMessage, error)

SlaDefinition writes/reads (modern v1alpha). The body is an SlaDefinition: it uses STRING enums (SlaType, SlaTimeUnit, AlertType) — not the legacy integer codings. slaType is immutable after create; environments[] must be sent as [] (never null). LIVE MUTATIONS for the write methods.

func (*Client) ListSoarNetworks 

func (c *Client) ListSoarNetworks(ctx context.Context) ([]json.RawMessage, error)

SoarNetwork writes/reads (modern v1alpha). The body is a SoarNetwork: displayName + address (CIDR) + environmentsJson (a JSON-encoded string, not a repeated field) + priority. LIVE MUTATIONS for the write methods.

func (*Client) ListSocRoles 

func (c *Client) ListSocRoles(ctx context.Context) ([]json.RawMessage, error)

ListSocRoles returns the SOC roles (modern v1alpha). Read-only.

func (*Client) ListTransformers added in v0.3.0 

func (c *Client) ListTransformers(ctx context.Context) ([]FlowFunction, error)

ListTransformers returns every transformer (Flow value function) across all integrations via the `-` wildcard collection.

func (*Client) ListUsers added in v0.7.0 

func (c *Client) ListUsers(ctx context.Context) ([]User, error)

ListUsers returns all SOAR users via the v1alpha legacySoarUsers collection.

func (*Client) ListUsersFiltered added in v0.7.0 

func (c *Client) ListUsersFiltered(ctx context.Context, filter string) ([]User, error)

ListUsersFiltered returns SOAR users matching a server-side filter (e.g. "accountState = 'Active'").

func (*Client) RollbackJobRevision added in v0.8.0 

func (c *Client) RollbackJobRevision(ctx context.Context, integration, jobID, revisionID string) (json.RawMessage, error)

RollbackJobRevision restores a job definition to a previous revision's snapshot. Returns the raw server response. LIVE MUTATION.

func (*Client) RunConnectorInstanceOnDemand 

func (c *Client) RunConnectorInstanceOnDemand(ctx context.Context, integration, connectorID, instanceID string) (json.RawMessage, error)

RunConnectorInstanceOnDemand triggers a configured connector to poll now, rather than waiting for its schedule — the operational complement to the list/get/patch instance ops (e.g. to validate a connector change after a push). LIVE MUTATION. (Modern SOAR v1alpha — may 500 intermittently.)

func (*Client) RunJobInstanceOnDemand 

func (c *Client) RunJobInstanceOnDemand(ctx context.Context, integration, jobID, instanceID string) (json.RawMessage, error)

RunJobInstanceOnDemand runs a scheduled job instance immediately rather than waiting for its schedule. LIVE MUTATION.

func (*Client) SaveWorkflowDefinitions added in v0.2.2 

func (c *Client) SaveWorkflowDefinitions(ctx context.Context, body any) (json.RawMessage, error)

SaveWorkflowDefinitions saves (creates or updates) a playbook definition via the v1alpha SOAR-host path. body is the full ApiWorkflowDefinitionDataModel. This mints a new version — there is no partial-update or toggle-only path.

func (*Client) SetContextProperty added in v0.2.4 

func (c *Client) SetContextProperty(ctx context.Context, caseID int, body any) (json.RawMessage, error)

SetContextProperty creates or updates a case context property.

func (*Client) SimulateAlert added in v0.2.3 

func (c *Client) SimulateAlert(ctx context.Context, body any) (json.RawMessage, error)

SimulateAlert simulates an alert inside a case for playbook testing.

func (*Client) SystemGetLicenseStatus added in v0.2.4 

func (c *Client) SystemGetLicenseStatus(ctx context.Context) (json.RawMessage, error)

SystemGetLicenseStatus returns the SOAR license status via the v1alpha surface.

func (*Client) SystemGetMaxDataRetention added in v0.2.4 

func (c *Client) SystemGetMaxDataRetention(ctx context.Context) (json.RawMessage, error)

SystemGetMaxDataRetention returns the max data retention period via the v1alpha surface.

func (*Client) SystemGetVersion added in v0.2.4 

func (c *Client) SystemGetVersion(ctx context.Context) (json.RawMessage, error)

SystemGetVersion returns the SOAR platform version via the v1alpha surface.

func (*Client) UninstallMarketplaceIntegration 

func (c *Client) UninstallMarketplaceIntegration(ctx context.Context, identifier string, body any) (json.RawMessage, error)

UninstallMarketplaceIntegration uninstalls an integration pack (POST marketplaceIntegrations/{id}:uninstall) — the uninstall the legacy /store surface lacks. body carries any options. LIVE MUTATION.

func (*Client) UpdateActionDef added in v0.3.0 

func (c *Client) UpdateActionDef(ctx context.Context, integration, actionID string, body json.RawMessage, fields ...string) (json.RawMessage, error)

UpdateActionDef patches fields of an existing custom action definition by its numeric id: PATCH integrations/{key}/actions/{id}?updateMask=<fields>. The body carries only the changed fields and updateMask names them (a v1alpha sparse update). Create is POST (CreateActionDef); update is PATCH by id — a POST always creates (it collides on displayName), so updates must go through here. LIVE MUTATION.

func (*Client) UpdateAlertGroupingRule 

func (c *Client) UpdateAlertGroupingRule(ctx context.Context, id string, body any, updateMask ...string) (*AlertGroupingRule, error)

UpdateAlertGroupingRule applies a sparse update to a rule. body is the partial rule (struct or map); updateMask names the fields to write — pass it to avoid clobbering unset fields.

func (*Client) UpdateCalculatedFieldDefinition 

func (c *Client) UpdateCalculatedFieldDefinition(ctx context.Context, id string, body any, updateMask ...string) (json.RawMessage, error)

UpdateCalculatedFieldDefinition patches a calculated-field definition (v1alpha calculatedFieldDefinitions).

func (*Client) UpdateConnectorInstance 

func (c *Client) UpdateConnectorInstance(ctx context.Context, integration, connectorID, instanceID string, body any, updateMask ...string) (*ConnectorInstance, error)

UpdateConnectorInstance patches a connector instance. Pass updateMask to scope the sparse update to specific fields (e.g. "enabled", "parameters").

DEVIATION: secret parameters read back masked from GetConnectorInstance (a "***…" sentinel rather than the real value). The server treats that sentinel as "unchanged", so a round-trip get→patch is safe: pass the masked value back verbatim to leave the secret intact. Only send a real cleartext value when you genuinely intend to rotate it — and never log or commit that value.

func (*Client) UpdateCustomField 

func (c *Client) UpdateCustomField(ctx context.Context, id string, body any, updateMask ...string) (json.RawMessage, error)

UpdateCustomField patches a custom-field definition (v1alpha customFields).

func (*Client) UpdateCustomList 

func (c *Client) UpdateCustomList(ctx context.Context, id string, body any, updateMask ...string) (json.RawMessage, error)

UpdateCustomList patches a custom list (v1alpha customLists).

func (*Client) UpdateEnvironment 

func (c *Client) UpdateEnvironment(ctx context.Context, id string, body any, updateMask ...string) (json.RawMessage, error)

UpdateEnvironment patches a SOAR environment (v1alpha environments).

func (*Client) UpdateIdpMappingGroup 

func (c *Client) UpdateIdpMappingGroup(ctx context.Context, id string, body any, updateMask ...string) (json.RawMessage, error)

UpdateIdpMappingGroup PATCHes a mapping group; pass updateMask to scope the write. LIVE ACCESS MUTATION.

func (*Client) UpdateIntegrationInstance added in v0.7.1 

func (c *Client) UpdateIntegrationInstance(ctx context.Context, integration, instanceID string, body any, fields ...string) (json.RawMessage, error)

UpdateIntegrationInstance patches an integration instance (rename, change description, toggle parameters). fields lists the updateMask entries (e.g. "displayName", "description", "parameters"). body is the sparse instance payload.

func (*Client) UpdateJobDef added in v0.3.0 

func (c *Client) UpdateJobDef(ctx context.Context, integration, jobID string, body json.RawMessage, fields ...string) (json.RawMessage, error)

UpdateJobDef patches fields of an existing custom job definition by its numeric id — the jobs twin of UpdateActionDef (PATCH integrations/{key}/jobs/{id}?updateMask=<fields>). LIVE MUTATION.

func (*Client) UpdateJobInstance 

func (c *Client) UpdateJobInstance(ctx context.Context, integration, jobID, instanceID string, body any, updateMask ...string) (*JobInstance, error)

UpdateJobInstance applies a sparse PATCH to a job instance. updateMask names the fields to change (e.g. "enabled", "intervalSeconds"); body is any JSON-marshalable payload (typically a *JobInstance or a partial map).

DEVIATION: like connectors, secret parameters read back masked ("***...") from GetJobInstance. The server treats the masked sentinel as "unchanged", so a round-trip get-patch is safe: pass the masked value back verbatim to leave the secret intact. Only send a real cleartext value to genuinely rotate one.

func (*Client) UpdatePropertySchemaDefinition 

func (c *Client) UpdatePropertySchemaDefinition(ctx context.Context, id string, body any, updateMask ...string) (json.RawMessage, error)

UpdatePropertySchemaDefinition patches a property-schema definition (v1alpha propertySchemaDefinitions).

func (*Client) UpdateSlaDefinition 

func (c *Client) UpdateSlaDefinition(ctx context.Context, id string, body any, updateMask ...string) (json.RawMessage, error)

UpdateSlaDefinition patches an SLA definition (v1alpha slaDefinitions).

func (*Client) UpdateSoarNetwork 

func (c *Client) UpdateSoarNetwork(ctx context.Context, id string, body any, updateMask ...string) (json.RawMessage, error)

UpdateSoarNetwork patches a SOAR network (v1alpha soarNetworks).

func (*Client) UpdateSocRole 

func (c *Client) UpdateSocRole(ctx context.Context, id string, body any, updateMask ...string) (json.RawMessage, error)

UpdateSocRole patches a SOC role definition (v1alpha socRoles).

type ConnectorDef 

type ConnectorDef struct {
	Name        string          `json:"name"`
	ID          json.Number     `json:"id"`     // numeric in the v1alpha payload
	Custom      bool            `json:"custom"` // custom (deletable) vs commercial connector definition
	Identifier  string          `json:"identifier"`
	DisplayName string          `json:"displayName"`
	Raw         json.RawMessage `json:"-"`
}

ConnectorDef is a connector definition within an integration (an ingestion source template, not a configured instance). ID is the numeric definition id used in the connector's resource path (e.g. ".../connectors/48").

func (*ConnectorDef) PathID 

func (c *ConnectorDef) PathID() string

PathID returns the segment that addresses this connector in a resource path: the numeric ID when present, else the last segment of Name, else Identifier.

func (*ConnectorDef) UnmarshalJSON 

func (c *ConnectorDef) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes the typed fields and keeps the full object in Raw.

type ConnectorInstance 

type ConnectorInstance struct {
	Name        string `json:"name,omitempty"`
	DisplayName string `json:"displayName,omitempty"`
	// Enabled/IntervalSeconds carry no omitempty: a sparse PATCH that sets
	// enabled=false or intervalSeconds=0 must serialize the zero value, or the
	// server (which reads the body field-by-field per updateMask) silently
	// no-ops the change.
	Enabled          bool                 `json:"enabled"`
	IntervalSeconds  int                  `json:"intervalSeconds"`
	Parameters       []ConnectorParameter `json:"-"` // decoded tolerantly (array or older map)
	AllowList        []string             `json:"allowList,omitempty"`
	ProductFieldName string               `json:"productFieldName,omitempty"`
	EventFieldName   string               `json:"eventFieldName,omitempty"`
	Raw              json.RawMessage      `json:"-"`
}

ConnectorInstance is a configured connector poller. Parameters is the ordered list of parameter descriptors; Raw preserves the full server payload (schema metadata, statistics) the typed fields omit.

func (*ConnectorInstance) UnmarshalJSON 

func (ci *ConnectorInstance) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes the typed fields, parses parameters tolerant of both the live array-of-descriptors and an older flat {name:value} map, and retains the full payload in Raw.

type ConnectorParameter 

type ConnectorParameter struct {
	Name        string `json:"name,omitempty"`
	DisplayName string `json:"displayName,omitempty"`
	Value       string `json:"value"`
	Type        string `json:"type,omitempty"`
	Mode        string `json:"mode,omitempty"`
	Mandatory   bool   `json:"mandatory"`
	Advanced    bool   `json:"advanced"`
}

ConnectorParameter is one connector-instance parameter. The live v1alpha payload returns parameters as an array of these descriptors; Key() addresses a parameter by DisplayName (live) or Name (older shape). Value is always a string (secrets read back masked).

func (ConnectorParameter) Key 

func (p ConnectorParameter) Key() string

Key returns the parameter's addressing key: DisplayName when set, else Name.

type ContentPack 

type ContentPack struct {
	Name        string          `json:"name"`
	Identifier  string          `json:"identifier"`
	DisplayName string          `json:"title"`
	IsInstalled bool            `json:"deployed"`
	Raw         json.RawMessage `json:"-"`
}

ContentPack is a Content-Hub content pack (a bundle of playbooks/connectors/ dashboards/use-cases). The stable framing is typed; the full record is in Raw.

func (*ContentPack) UnmarshalJSON 

func (p *ContentPack) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes the typed fields and keeps the full object in Raw.

type DailySchedule added in v0.8.0 

type DailySchedule struct {
	Date     ScheduleDate `json:"date"`
	Time     TimeOfDay    `json:"time"`
	Interval int          `json:"interval,omitempty"`
}

DailySchedule runs the job every N days starting from the given date/time.

type Error 

type Error = transport.Error

Error is the typed error the SOAR client returns for a non-2xx response — it carries the method, URL, HTTP status, body, and server request id. Consumers can errors.As it to inspect the status, mirroring chronicle.APIError.

type FlowFunction added in v0.3.0 

type FlowFunction struct {
	Name           string          `json:"name"`
	ID             json.Number     `json:"id"`
	Integration    string          `json:"integration"`
	DisplayName    string          `json:"displayName"`
	Description    string          `json:"description"`
	Enabled        bool            `json:"enabled"`
	Custom         bool            `json:"custom"`
	Type           string          `json:"type"` // e.g. "BuiltIn"
	ExpectedInput  string          `json:"expectedInput"`
	ExpectedOutput string          `json:"expectedOutput"`
	UsageExample   string          `json:"usageExample"`
	Raw            json.RawMessage `json:"-"`
}

FlowFunction is a Flow utility definition from the wildcard catalogs: a transformer (a value-shaping function usable in playbook expressions) or a logical operator (a condition predicate). Both live under an integration (built-ins under "Core Functions") and carry the same numeric-id addressing as actions.

func (*FlowFunction) UnmarshalJSON added in v0.3.0 

func (f *FlowFunction) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes the typed fields and keeps the full object in Raw.

type Integration 

type Integration struct {
	Name            string          `json:"name"`
	Identifier      string          `json:"identifier"`
	DisplayName     string          `json:"displayName"`
	LatestVersion   string          `json:"latestVersion"`
	UpdateAvailable bool            `json:"updateAvailable"`
	Custom          bool            `json:"custom"`               // custom (deletable) vs commercial pack
	Certified       bool            `json:"certified"`            // Google-certified
	Internal        bool            `json:"internal"`             // platform-internal pack
	ProdIdentifier  string          `json:"productionIdentifier"` // base pack this install derives from
	Raw             json.RawMessage `json:"-"`                    // full server object, untrimmed
}

Integration is a SOAR integration (an IDE/marketplace pack).

GOTCHA: each marketplace pack lists twice. The per-tenant INSTALLED copy has an Identifier of "<base>__<uuid>" (e.g. "VirusTotalV3__1a2b3c…") with ProdIdentifier set to the base ("VirusTotalV3"); the bare "<base>" entry is the catalog/base definition. Address either by Identifier for nested lists (ListConnectors etc.); Name is the full "projects/…/integrations/<identifier>" resource path.

func (*Integration) UnmarshalJSON 

func (i *Integration) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes the typed fields while preserving the complete server object in Raw (the v1alpha integration payload carries far more than we type).

type IntegrationInstance added in v0.7.0 

type IntegrationInstance struct {
	Name                  string          `json:"name"`
	Identifier            string          `json:"identifier"`
	DisplayName           string          `json:"displayName"`
	IntegrationIdentifier string          `json:"integrationIdentifier"`
	Environment           string          `json:"environment"`
	IsEnabled             bool            `json:"isEnabled"`
	SystemDefault         bool            `json:"systemDefault"`
	Raw                   json.RawMessage `json:"-"`
}

IntegrationInstance is a configured instance of an integration in a specific environment — the runtime card (credentials, parameters, enabled/disabled).

func (*IntegrationInstance) UnmarshalJSON added in v0.7.0 

func (i *IntegrationInstance) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes the typed fields while preserving the complete server object in Raw.

type JobDef 

type JobDef struct {
	Name        string          `json:"name"`
	ID          json.Number     `json:"id"` // numeric in the v1alpha payload
	Identifier  string          `json:"identifier"`
	DisplayName string          `json:"displayName"`
	Raw         json.RawMessage `json:"-"`
}

JobDef is a job definition within an integration (a scheduled-task template). ID is the numeric definition id used in the job's resource path.

func (*JobDef) PathID 

func (j *JobDef) PathID() string

PathID returns the segment that addresses this job in a resource path.

func (*JobDef) UnmarshalJSON 

func (j *JobDef) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes the typed fields and keeps the full object in Raw.

type JobInstance 

type JobInstance struct {
	Name              string      `json:"name,omitempty"`
	DisplayName       string      `json:"displayName,omitempty"`
	ID                json.Number `json:"id,omitempty"`
	Job               string      `json:"job,omitempty"`
	Integration       string      `json:"integration,omitempty"`
	Description       string      `json:"description,omitempty"`
	UniqueIdentifier  string      `json:"uniqueIdentifier,omitempty"`
	Script            string      `json:"script,omitempty"`
	Author            string      `json:"author,omitempty"`
	Agent             string      `json:"agent,omitempty"`
	DocumentationLink string      `json:"documentationLink,omitempty"`
	LastRunStatus     string      `json:"lastRunStatus,omitempty"`

	// No omitempty on the mutable scalars: a sparse PATCH that sets
	// enabled=false or intervalSeconds=0 must serialize the zero value or the
	// masked update silently no-ops.
	Enabled         bool `json:"enabled"`
	Advanced        bool `json:"advanced"`
	Custom          bool `json:"custom"`
	IntervalSeconds int  `json:"intervalSeconds"`

	AdvancedConfig *AdvancedConfig        `json:"advancedConfig,omitempty"`
	Parameters     []JobInstanceParameter `json:"parameters,omitempty"`

	// Timestamps (epoch millis as json.Number).
	CreateTime           json.Number `json:"createTime,omitempty"`
	UpdateTime           json.Number `json:"updateTime,omitempty"`
	LastRunTime          json.Number `json:"lastRunTime,omitempty"`
	NextScheduledRunTime json.Number `json:"nextScheduledRunTime,omitempty"`

	Raw json.RawMessage `json:"-"`
}

JobInstance is a configured instance of an integration job.

func (*JobInstance) UnmarshalJSON added in v0.8.0 

func (ji *JobInstance) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes the typed fields and preserves the full payload in Raw.

type JobInstanceLog added in v0.8.0 

type JobInstanceLog struct {
	Name          string          `json:"name,omitempty"`
	ID            json.Number     `json:"id,omitempty"`
	StartTime     json.Number     `json:"startTime,omitempty"`
	EndTime       json.Number     `json:"endTime,omitempty"`
	Message       string          `json:"message,omitempty"`
	Status        string          `json:"status,omitempty"` // SUCCESS or ERROR
	JobIdentifier json.Number     `json:"jobIdentifier,omitempty"`
	JobInstanceId json.Number     `json:"jobInstanceId,omitempty"`
	Integration   string          `json:"integration,omitempty"`
	Raw           json.RawMessage `json:"-"`
}

JobInstanceLog is a single execution log entry for a job instance.

func (*JobInstanceLog) UnmarshalJSON added in v0.8.0 

func (l *JobInstanceLog) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes the typed fields and preserves the full payload in Raw.

type JobInstanceParameter added in v0.8.0 

type JobInstanceParameter struct {
	ID          json.Number `json:"id,omitempty"`
	Mandatory   bool        `json:"mandatory"`
	Type        string      `json:"type,omitempty"`
	DisplayName string      `json:"displayName,omitempty"`
	Value       string      `json:"value"`
}

JobInstanceParameter is a single parameter on a job instance.

type JobRevision added in v0.8.0 

type JobRevision struct {
	Name       string          `json:"name,omitempty"`
	Snapshot   json.RawMessage `json:"snapshot,omitempty"`
	CreateTime json.Number     `json:"createTime,omitempty"`
	Comment    string          `json:"comment,omitempty"`
	Author     string          `json:"author,omitempty"`
	Raw        json.RawMessage `json:"-"`
}

JobRevision is a point-in-time snapshot of a job definition.

func (*JobRevision) UnmarshalJSON added in v0.8.0 

func (r *JobRevision) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes the typed fields and preserves the full payload in Raw.

type MarketplaceIntegration 

type MarketplaceIntegration struct {
	Name        string          `json:"name"`
	Identifier  string          `json:"identifier"`
	DisplayName string          `json:"title"`
	IsInstalled bool            `json:"installed"`
	Raw         json.RawMessage `json:"-"`
}

MarketplaceIntegration is an installable Content-Hub integration pack. The stable framing is typed; the full record is in Raw.

func (*MarketplaceIntegration) UnmarshalJSON 

func (m *MarketplaceIntegration) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes the typed fields and keeps the full object in Raw.

type ModuleSettingProperty 

type ModuleSettingProperty struct {
	Name string `json:"name,omitempty"`
	// DisplayName is the short, human property name (the resource name's last
	// segment, e.g. "TimeframeForGroupingInHours") that callers key on.
	DisplayName string `json:"displayName,omitempty"`
	// No omitempty: every property value is a string, so "" is a legitimate
	// value the batchUpdate write path must transmit, not drop.
	Value string          `json:"value"`
	Raw   json.RawMessage `json:"-"`
}

ModuleSettingProperty is a single module setting. Value is always a string, even for ints or bools — callers parse it themselves. Raw retains the full server object.

func (ModuleSettingProperty) ShortName added in v0.5.8 

func (p ModuleSettingProperty) ShortName() string

ShortName returns the friendly property name: DisplayName when present, else the resource name's last path segment.

func (*ModuleSettingProperty) UnmarshalJSON 

func (p *ModuleSettingProperty) UnmarshalJSON(data []byte) error

UnmarshalJSON keeps the typed fields and the complete payload in sync.

type MonthlySchedule added in v0.8.0 

type MonthlySchedule struct {
	Date     ScheduleDate `json:"date"`
	Time     TimeOfDay    `json:"time"`
	Day      int          `json:"day,omitempty"`
	Interval int          `json:"interval,omitempty"`
}

MonthlySchedule runs the job on a given day every N months.

type OneTimeSchedule added in v0.8.0 

type OneTimeSchedule struct {
	Date ScheduleDate `json:"date"`
	Time TimeOfDay    `json:"time"`
}

OneTimeSchedule runs the job once at the specified date and time.

type Option 

type Option func(*clientConfig)

Option customizes a Client.

func WithHTTPClient 

func WithHTTPClient(h *http.Client) Option

WithHTTPClient overrides the underlying *http.Client (e.g. for tests).

func WithoutRetries added in v0.9.16 

func WithoutRetries() Option

WithoutRetries disables automatic retries for this client. It is intended for small health probes whose caller supplies its own bounded fallback strategy. Normal API clients should retain the default retry policy.

type ScheduleDate added in v0.8.0 

type ScheduleDate struct {
	Year  int `json:"year"`
	Month int `json:"month"`
	Day   int `json:"day"`
}

ScheduleDate is a calendar date (year/month/day).

type ScheduleType added in v0.8.0 

type ScheduleType string

ScheduleType enumerates the job scheduling modes. 

const (
	ScheduleTypeUnspecified ScheduleType = "SCHEDULE_TYPE_UNSPECIFIED"
	ScheduleTypeOnce        ScheduleType = "ONCE"
	ScheduleTypeDaily       ScheduleType = "DAILY"
	ScheduleTypeWeekly      ScheduleType = "WEEKLY"
	ScheduleTypeMonthly     ScheduleType = "MONTHLY"
)

type Settings 

type Settings = transport.Settings

Settings identifies a tenant SOAR instance (host + v1alpha path components).

type TimeOfDay added in v0.8.0 

type TimeOfDay struct {
	Hours   int `json:"hours"`
	Minutes int `json:"minutes"`
	Seconds int `json:"seconds,omitempty"`
	Nanos   int `json:"nanos,omitempty"`
}

TimeOfDay is a wall-clock time within a day.

type User added in v0.7.0 

type User struct {
	Name        string          `json:"name"`
	DisplayName string          `json:"displayName"`
	Email       string          `json:"email"`
	UserName    string          `json:"userName"`
	Raw         json.RawMessage `json:"-"`
}

User is a SOAR user from the legacySoarUsers v1alpha collection.

func (*User) UnmarshalJSON added in v0.7.0 

func (u *User) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes the typed fields and keeps the full object in Raw.

type WeeklySchedule added in v0.8.0 

type WeeklySchedule struct {
	Date     ScheduleDate `json:"date"`
	Time     TimeOfDay    `json:"time"`
	Days     []string     `json:"days,omitempty"`
	Interval int          `json:"interval,omitempty"`
}

WeeklySchedule runs the job on selected days every N weeks.

Source Files

View all Source files

Directories

Path Synopsis
internal
transport
Package transport is the shared, durable HTTP plumbing for the Google SecOps SOAR API.
 Package transport is the shared, durable HTTP plumbing for the Google SecOps SOAR API.
LEGACY tier: the Siemplify external API (/api/external/v1) Agents surface.
 LEGACY tier: the Siemplify external API (/api/external/v1) Agents surface.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.