legacy

package
v0.9.14 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 13, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Documentation

Overview

LEGACY tier: the Siemplify external API (/api/external/v1) Agents surface.

Agents are the remote execution nodes (and their publishers) that run integrations, connectors, and jobs in a customer's own network. These endpoints enumerate, configure, and deploy agents and the publishers that distribute to them. This is the reliable external-API path for SOAR agents.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) Approval Links surface.

Approval links are the one-click action URLs SOAR embeds in notifications (email, chat) so a recipient can approve or reject a pending playbook step without signing in to the platform. Applying a link records that decision and resumes the waiting playbook. The single external endpoint here takes the freeform legacy payload that the link encodes; the caller supplies it verbatim.

As elsewhere in this package the method is a thin wrapper over c.t.External: the write takes a freeform body and returns json.RawMessage (the caller decodes only what it needs).

LEGACY tier: the Siemplify external API (/api/external/v1) Case Management surface. This file covers the attacks-simulator endpoints, which create, export/import, and simulate custom ("simulated") cases and use cases that appear as Test cases in the case queue.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via the shared external* helpers.

LEGACY tier: the Siemplify external API (/api/external/v1) case surface.

This is the broad, reliable case path — the SOAR case verbs and bulk operations run on it, and it is the fallback when a modern v1alpha case call 500s. It stays importable; it is not slated for removal. Every method here speaks the offset-style external API via c.t.External and returns json.RawMessage for the deeply-nested, schema-unstable case payloads (the caller decodes only the fields it needs).

DUAL CASE-ID GOTCHA: SOAR exposes two unrelated case identifiers. The modern v1alpha surface uses the *alert/case resource name* (a string), while this legacy surface keys off the *SOAR integer case id* (the numeric id shown in the Siemplify case wall URL). Every id parameter and every field below (casesIds, caseID) is the LEGACY INTEGER id — do NOT pass a v1alpha resource name or alert group identifier here; they are not interchangeable.

LEGACY tier: Siemplify external API (/api/external/v1) single-case ACTION surface — the bread-and-butter SOAR case automation.

Every method here is a LIVE MUTATION against production cases. body is the freeform legacy payload and carries the SOAR INTEGER case id (see the dual case-id gotcha in cases.go). Bulk variants live in cases_bulk.go; comment/tag/ priority basics are in cases.go.

LEGACY tier: Siemplify external API (/api/external/v1) BULK case operations.

Each method mutates many cases in one call — LIVE and high-blast-radius; confirm the id set first. body carries the SOAR INTEGER case ids. The cases-queue bulk-close is in cases.go (BulkCloseCases).

LEGACY tier: the Siemplify external API (/api/external/v1) Case Management surface, casechat sub-tree.

Case chat is the per-case messaging thread: analysts post messages, pin and unpin them, and exchange attachments. These endpoints read the thread (with pagination and search), post new messages, toggle pins, and fetch attachment bytes/previews. This is the reliable external-API path for case chat.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) Case Management surface for case overviews and predefined widgets.

Case overviews render a case's alerts, entities, and configurable widgets into the templated layout shown in the SOAR case view; predefined widgets expose the built-in case widget catalog. These endpoints back that view and the templates that drive it. This is the reliable external-API path for case overviews.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: Siemplify external API (/api/external/v1) case READ surface.

Read-only case lookups. caseID parameters are the SOAR INTEGER case id (see the dual case-id gotcha in cases.go). Reads return RawJSON.

LEGACY tier: Siemplify external API (/api/external/v1) case TASK surface — the checklist tasks attached to cases. Reads return RawJSON; writes take a freeform body and are LIVE MUTATIONS.

LEGACY tier: the Siemplify external API (/api/external/v1) Case Management surface. This file covers the remaining /cases and /cases-queue operations not already mirrored elsewhere — case cards, comments, tasks, the case wall, reports, SLA controls, collaborator requests, and War Room incident creation.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External. Method names carry a "CaseX" prefix on otherwise-generic verbs to stay globally unique across the shared *Client.

Package legacy is the Google SecOps SOAR client for the Siemplify external API (/api/external/v1, AppKey). It is the broad, reliable SOAR lane: the reconcile engine and the case verbs run on it, and it is the fallback when a modern v1alpha surface 500s. It stays importable and is part of the long-term design — not a temporary shim. Two tiers live here:

  • EXTERNAL (cases.go, playbooks_external.go, and the family files): the Siemplify external API under /api/external/v1 — the reliable AppKey surface.
  • BRIDGE (playbooks.go): legacyPlaybooks:legacy* — SOAR-host v1alpha endpoints with legacy operation names, used until native v1alpha playbook CRUD ships.

Both build on the shared danny.vn/secops/soar/internal/transport. SOAR authenticates with an AppKey (auth.SOARAppKey), never ADC.

LEGACY tier: the Siemplify external API (/api/external/v1) Cloud Logging surface. These endpoints expose execution logs: the structured logs of Python executions (integrations, connectors, actions, jobs) and the downloadable logs of remote agents.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) CommandCenter surface.

CommandCenter is the SOAR "War Room": the live-incident collaboration space where responders coordinate around an incident — chat channels, facts, decisions, assessments, tasks, severity scoring, and the generated incident report. These endpoints all live under /warroom/ — the reliable external-API path for War Room collaboration.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). Incident/user ids are int64 path parameters. All methods speak the AppKey-authenticated external API via c.t.External.

This file holds the read (GET) surface; the write surface lives in command_center_write.go.

LEGACY tier: the Siemplify external API (/api/external/v1) CommandCenter surface — write half (see command_center.go for the package overview and the read surface).

These are the War Room mutations: creating and closing incidents and recording the artifacts that document a live response (assessments, comments, decisions, facts, tasks, severity scores, chat messages). Each takes a freeform legacy body and returns json.RawMessage. All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) ConfigurationItemsManagement surface.

Configuration items are per-tenant key/value settings, optionally grouped by category. These endpoints read the items for a tenant and replace or batch patch them. Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) connector surface.

Connectors are the ingestion sources that feed alerts into SOAR. These endpoints manage connector *instances* (configured connectors) and expose the connector *definitions* (templates) available in the tenant. Connector instances are operated config-as-code on this reliable external-API path (the reconcile engine runs here); the modern v1alpha connector surface is used only for what it adds (e.g. per-definition delete).

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) Dashboards surface.

Dashboards are the SOC home-screen reports built from widgets; each widget renders a query (case counts, SLA, entity stats) against a definition. These endpoints manage dashboards and their widgets, expose the available widget definitions, and resolve widget values/case ids for rendering.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: Siemplify external API (/api/external/v1) DYNAMIC-CASES surface — the newer case API used by the modern case view. Many actions mirror the /cases surface (see cases_actions.go); only the dynamic-unique reads and actions are exposed here, prefixed Dynamic* where they would otherwise collide. caseID parameters are the SOAR INTEGER case id. Reads return RawJSON; writes take a freeform body and are LIVE MUTATIONS.

LEGACY tier: the Siemplify external API (/api/external/v1) Case Management surface, /dynamic-cases operations. These mirror much of the /cases surface against the dynamic-cases data path (case mutations, tags, comments, evidence, tasks, reports, and the War Room transfer), excluding the ones already implemented elsewhere in this package.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body. All methods speak the AppKey-authenticated external API via c.t.External. Method names carry a "DynamicCaseX" prefix to stay globally unique across the shared *Client.

LEGACY tier: the Siemplify external API (/api/external/v1) EntitySearch surface.

These endpoints query the entity index built from ingested cases/alerts, returning a paged set of entities (and a total count) that match a freeform search-request payload. Like the rest of the legacy surface, the request and response shapes are deeply nested and schema-unstable, so reads return json.RawMessage and writes take a freeform body — the caller decodes only the fields it needs. All methods speak the AppKey-authenticated external API via c.t.External.

Shared helpers for the LEGACY Siemplify external API (/api/external/v1).

The external surface is broad (hundreds of operations) but uniform: AppKey auth, JSON in/out, and deeply-nested, schema-unstable payloads. Rather than model every shape, the typed methods in this package are thin wrappers that return RawJSON (an undecoded body) for reads and take a freeform body for writes — the caller decodes only the fields it needs. These helpers centralize the c.t.External plumbing so each endpoint method stays one line.

(The external API is almost entirely POST-with-body; query parameters are rare, so the helpers omit them — add a query-aware variant if an endpoint needs one.)

LEGACY tier: the Siemplify external API (/api/external/v1) Federation surface.

Federation links a SOAR instance into a multi-platform topology: it enumerates the federated platforms and surfaces their cases through the local instance. This is the reliable external-API path for SOAR federation.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) Homepage surface.

The Homepage is the analyst landing dashboard. These endpoints back its widgets: the homepage case list/count plus the user-curated panels — attachments, contacts, links, notes, and RSS feeds. Each panel is a small CRUD surface (list-by-request, get/delete by integer id, create via POST, update via PUT). This is the reliable external-API path for the homepage widgets.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). The list endpoints page via RequestedPage/PageSize and an optional SearchTerm. All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) Homepage surface — the notes and RSS-feed panels of the analyst homepage. See homepage.go for the package overview and conventions.

LEGACY tier: the Siemplify external API (/api/external/v1) IdpMappingManagement surface. These endpoints manage the mapping between an external identity provider's groups and SOAR. Reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) integrations surface.

Integrations are the installed marketplace packs; an integration *instance* is a configured copy (credentials, params) scoped to an environment. These endpoints list installed integrations and manage instances. Reads return RawJSON; writes take a freeform body. AppKey auth.

LEGACY tier: the Siemplify external API (/api/external/v1) jobs surface.

Jobs are the scheduled background tasks SOAR runs (sync, hygiene, etc.). These endpoints list job definitions/templates and manage job *instances* (CRUD + run). Reads return RawJSON; writes take a freeform body. AppKey auth.

LEGACY tier: Siemplify external API (/api/external/v1) MARKETPLACE (store) surface — the integration/power-up/use-case store and integration install/test. Reads return RawJSON; writes take a freeform body.

LEGACY tier: the Siemplify external API (/api/external/v1) Notifications surface.

These endpoints expose the in-product notification center: the user's notification list and unread count, per-user notification settings, and the dismiss/close operations for individual or all notifications. Several of the close operations are modeled upstream as GETs even though they mutate state (they dismiss notifications), so their doc comments are flagged accordingly.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) ontology *mapping rules* surface — how raw event fields map to SOAR entities. Config-as-code. Reads return RawJSON; writes take a freeform body.

LEGACY tier: the Siemplify external API (/api/external/v1) ontology *visual family* surface — the entity-grouping/visualization families and their rules. Reads return RawJSON; writes take a freeform body.

LEGACY tier: the Siemplify external API (/api/external/v1) Permissions surface.

Permission groups model role-based access in SOAR: each group bundles a set of capabilities and, optionally, per-environment status. These endpoints list the group cards/types, fetch and duplicate individual groups, and create, update, or delete them. This is the reliable external-API path for SOAR access-control groups.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

BRIDGE tier: SOAR playbooks on the SOAR-host v1alpha API (New-generation), via legacy-named operations.

These endpoints live under the v1alpha tenant path (the siemplify domain, AppKey — NOT the Siemplify external /api/external/v1 API) but carry the legacyPlaybooks:legacy* operation names: a thin bridge over the not-yet-native playbook surface, used until native v1alpha playbook CRUD ships. It lives in this package only for proximity to the other playbook code.

Playbook payloads are large, deeply nested, and freeform, so a Playbook is just json.RawMessage. The only place we reach into the body is to coerce the field types SOAR insists on (see coercePlaybookTypes) and to validate the display name on save (see validatePlaybookName).

BRIDGE tier: legacyPlaybooks AI-generation RPCs (v1alpha host, legacy op names) — Gemini playbook drafting. Every generate/update call CREATES OR EDITS playbook content on the live tenant, so callers gate them.

LEGACY tier: the Siemplify external API (/api/external/v1) playbook *category* surface — the folders that organize workflow definitions. Reads return RawJSON; writes take a freeform body.

LEGACY tier: the Siemplify external API (/api/external/v1) Playbooks surface — run/rerun/debug and workflow-introspection operations: test cases, trigger tags, step instances, rerun/debug-run, and log-versioning.

Reads return json.RawMessage and writes take a freeform body; all methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) Playbooks surface.

Playbooks (workflows) are the automation graphs SOAR runs against cases and alerts. These methods cover the workflow-definition, debug/simulation, and pending-step operations not already implemented elsewhere in the package.

As with the rest of the legacy tier, shapes are the deeply-nested, schema-unstable legacy payloads: reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) Playbooks surface — playbook permission operations (read options, set, delete).

Reads return json.RawMessage and writes take a freeform body; all methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) playbook *workflow definition* surface. (The external API calls playbooks "workflows".)

This file is the definition-management slice: list/get/save/delete/duplicate/ restore workflow definitions and export/import them — the config-as-code core. Category management lives in playbooks_categories.go; the v1alpha bridge for playbooks is in playbooks.go. Reads return RawJSON; writes take a freeform body.

LEGACY tier: the Siemplify external API (/api/external/v1) PubSubBackfill surface. PubSub backfill re-publishes historical data into the ingestion pipeline for a tenant, used to replay or recover events.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) Reports surface.

These endpoints manage advanced report templates, the widgets they contain, and the schedules that generate and share them. This is the reliable external-API path for SOAR reporting.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) Resources surface.

These endpoints fetch shared "resource" artifacts by id — action results, full case details, and entity insights — plus an audit-actions CSV export. They are read-only GETs — the reliable external-API path for these shared resources.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage (the caller decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: the Siemplify external API (/api/external/v1) Retention surface.

Data-retention operations purge aged data from the platform. They map to the manual ("run now") retention jobs the platform otherwise runs on a schedule: system-data retention, user-data retention, and bulk case deletion. Every operation here permanently destroys data, so each is a guarded live mutation.

Shapes are the deeply-nested, schema-unstable legacy payloads, so writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: Siemplify external API (/api/external/v1) SEARCH surface — platform-wide case and entity search plus the filter-value helpers that drive the search UI. All are POST-with-body queries; results return RawJSON.

LEGACY tier: the Siemplify external API (/api/external/v1) Settings surface — alert-grouping configuration.

Method names are prefixed "SettingX" to stay globally unique across the shared *Client; reads return json.RawMessage and writes take a freeform body.

LEGACY tier: the Siemplify external API (/api/external/v1) Settings surface — API-key administration.

API keys are the SOAR external-API credentials (the AppKey family), scoped by permission group / SOC role / environment. The list endpoint (GET /settings/GetApiKeys) is **metadata only**: the server returns the secret `key` field already masked (****), so there is no secret to leak on read — and this SDK drops it from the typed view entirely (read paths never surface a key, masked or not; House Rule 4). The endpoint is GET (a POST returns 405) and is absent from the swagger snapshot, so it was confirmed against the live surface.

Create and revoke ride the same surface: POST /settings/addOrUpdateApiKeyRecord (no id = create; an id present = update; the KEY VALUE IS CLIENT-GENERATED and the server only ever returns it masked) and POST /settings/RemoveApiKeyRecord (the full record as listed). Both are absent from the swagger snapshot.

LEGACY tier: Siemplify external API (/api/external/v1) DEFINITION settings — SLA definitions, case stages, tag definitions, and root-cause options. These are the reference data playbooks and analysts pick from. Config-as-code. Reads return RawJSON; writes take a freeform body.

LEGACY tier: Siemplify external API (/api/external/v1) ENVIRONMENT settings — the tenant's environments (segregation units), their priorities, and load balancing. Config-as-code. Reads return RawJSON; writes take a freeform body.

LEGACY tier: the Siemplify external API (/api/external/v1) Settings surface — the form-dynamic-parameters CRUD set.

Method names are prefixed "SettingX" to stay globally unique across the shared *Client; reads return json.RawMessage and writes take a freeform body.

LEGACY tier: Siemplify external API (/api/external/v1) IDENTITY settings — IdP group-to-role mappings and external authentication providers. These are REST-style resources (list/get/create/update/delete). Config-as-code (no secrets in the read responses beyond what the server returns). Reads return RawJSON; writes take a freeform body.

LEGACY tier: Siemplify external API (/api/external/v1) LIST settings — block lists (model blocks), tracking lists, and custom lists used by playbooks and enrichment. Config-as-code. Reads return RawJSON; writes take a freeform body.

LEGACY tier: Siemplify external API (/api/external/v1) NETWORK settings — the named networks/CIDRs used for entity enrichment and internal/external scoping. Config-as-code. Reads return RawJSON; writes take a freeform body.

LEGACY tier: the Siemplify external API (/api/external/v1) Settings surface — advanced-reports configuration.

Method names are prefixed "SettingX" to stay globally unique across the shared *Client; reads return json.RawMessage and writes take a freeform body.

LEGACY tier: Siemplify external API (/api/external/v1) SYSTEM settings — version, proxy, certificate, event entity types, and case-routing policies. Reads return RawJSON; writes take a freeform body.

LEGACY tier: the Siemplify external API (/api/external/v1) Settings surface.

These methods cover the user/account-administration Settings operations: collaborator requests, license agreement, user profiles/images, audit CSV exports, and analyst lookup.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External. Method names are prefixed "SettingX" to stay globally unique across the single *Client shared by every file in this package.

LEGACY tier: the Siemplify external API (/api/external/v1) SOC Roles surface.

SOC roles group SOAR users by responsibility (e.g. Tier 1, Tier 2) and drive case routing, queue ownership, and permission scoping. These endpoints list, fetch, upsert, and delete role records and check whether a role still has users assigned before removal.

Shapes are the deeply-nested, schema-unstable legacy payloads, so reads return json.RawMessage and writes take a freeform body (the caller supplies/decodes only the fields it needs). All methods speak the AppKey-authenticated external API via c.t.External.

LEGACY tier: Siemplify external API (/api/external/v1) WEBHOOKS surface — inbound webhook endpoints that feed connectors. Reads return RawJSON; writes take a freeform body.

Index

Constants

View Source 
const (
	CaseStatusOpen   = 1 // OPEN
	CaseStatusClosed = 2 // CLOSED
)

CaseStatus values for CaseQueueRequest.Statuses.

Variables

This section is empty.

Functions

func ExtractActionStepMold added in v0.2.0 

func ExtractActionStepMold(playbook Playbook, match string) (json.RawMessage, error)

ExtractActionStepMold returns one exported action step from a playbook. The result is suitable for BuildPlaybookFromMolds; that later merge preserves the destination playbook's graph identity fields.

func IsNotFound 

func IsNotFound(err error) bool

IsNotFound reports whether err is (or wraps) a legacy SOAR 404.

func ValidatePlaybookForSave added in v0.1.6 

func ValidatePlaybookForSave(body json.RawMessage) error

ValidatePlaybookForSave performs the same local body checks as SavePlaybook without making an API call. Use it for dry-runs and local reconcile planning.

Types

type APIKey 

type APIKey struct {
	ID                 int      `json:"id"`
	Name               string   `json:"name"`
	IsSystem           bool     `json:"isSystem"`
	PermissionGroupID  int      `json:"permissionGroupId"`
	PermissionGroupIDs []int    `json:"permissionGroupIds"`
	SocRoleID          int      `json:"socRoleId"`
	SocRoleIDs         []int    `json:"socRoleIds"`
	Environments       []string `json:"environments"`
	CreationTimeMs     int64    `json:"creationTimeUnixTimeInMs"`
	ModificationTimeMs int64    `json:"modificationTimeUnixTimeInMs"`

	// Raw is the verbatim list entry (key field masked by the server) — the
	// exact body RemoveApiKeyRecord expects. Never carries a usable secret.
	Raw json.RawMessage `json:"-"`
}

APIKey is the metadata for one SOAR external-API key. The secret value is deliberately omitted — the list endpoint only ever returns it masked, and this SDK never surfaces a key (masked or not) on a read path.

func (*APIKey) UnmarshalJSON added in v0.3.0 

func (k *APIKey) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes the typed metadata and retains the verbatim list entry in Raw — RemoveApiKeyRecord expects the FULL record as listed (with the key field masked by the server), so the raw form is what revoke posts.

type AiGenerateDraftDTO added in v0.3.0 

type AiGenerateDraftDTO struct {
	ID                         string   `json:"id"`
	Identifier                 string   `json:"identifier"`
	Version                    string   `json:"version"`
	IsEnabled                  bool     `json:"isEnabled"`
	IsDebugMode                bool     `json:"isDebugMode"`
	Name                       string   `json:"name"`
	Description                string   `json:"description"`
	CategoryID                 int      `json:"categoryId"`
	Creator                    string   `json:"creator"`
	Priority                   string   `json:"priority"`
	Steps                      []any    `json:"steps"`
	StepsRelations             []any    `json:"stepsRelations"`
	Environments               []string `json:"environments"`
	OriginalPlaybookIdentifier string   `json:"originalPlaybookIdentifier"`
	CreationTimeMs             string   `json:"creationTimeUnixTimeInMs"`
	ModificationTimeMs         string   `json:"modificationTimeUnixTimeInMs"`
	ModifiedBy                 string   `json:"modifiedBy"`
	TemplateName               string   `json:"templateName"`
	PlaybookType               string   `json:"playbookType"`
	CategoryName               string   `json:"categoryName"`
	DefaultAccessLevel         string   `json:"defaultAccessLevel"`
	EntityAccessLevel          string   `json:"entityAccessLevel"`
	Permissions                []any    `json:"permissions"`
	HasRestrictedEnvironments  bool     `json:"hasRestrictedEnvironments"`
	OverviewTemplates          []any    `json:"overviewTemplates"`
}

AiGenerateDraftDTO is the minimal playbook definition the assistant envelope carries (the designer's pre-save draft shape).

type AiGenerateRequest added in v0.3.0 

type AiGenerateRequest struct {
	Prompt       string             `json:"prompt"`
	Playbook     AiGenerateDraftDTO `json:"playbook"`
	HashedUserID string             `json:"hashedUserId"`
}

AiGenerateRequest is the legacyAiGenerate envelope: the free-text prompt plus the playbook the assistant works on — for create-from-description an EMPTY definition. The call is synchronous and returns the proposed draft WITHOUT persisting anything (persisting is the normal playbook save). The endpoint rejects a creationSource field, so the DTO omits it; servers can also reject API-key auth for the whole Playbook Assistant family ("restricted for API keys") — surface that error as-is.

func NewAiGenerateRequest added in v0.3.0 

func NewAiGenerateRequest(prompt, name string) (*AiGenerateRequest, error)

NewAiGenerateRequest builds a create-from-description envelope: an empty REGULAR draft named name (id "0" = unsaved) carrying the prompt. Adjust the returned struct's fields (environments, category, …) before sending if the defaults don't fit.

type BlockListItemType 

type BlockListItemType int

BlockListItemType is a model block-list entry's element type (ApiBlockListItemType). 

const (
	BlockHostName       BlockListItemType = 0
	BlockUserUniqName   BlockListItemType = 1
	BlockIP             BlockListItemType = 2
	BlockEventProduct   BlockListItemType = 3
	BlockEventVendor    BlockListItemType = 4
	BlockEventSignature BlockListItemType = 5
	BlockMacAddress     BlockListItemType = 6
	BlockEntity         BlockListItemType = 7
	BlockEvent          BlockListItemType = 8
)

type BlockListScope 

type BlockListScope int

BlockListScope is a model block-list entry's scope (ApiBlockListItemScope). 

const (
	BlockScopeAll                BlockListScope = 0
	BlockScopeForAggregationOnly BlockListScope = 1
	BlockScopeForGroupOnly       BlockListScope = 2
	BlockScopeForModel           BlockListScope = 3
	BlockScopeForCreationAlert   BlockListScope = 4
)

type BulkCloseRequest 

type BulkCloseRequest struct {
	CasesIDs          []int       `json:"casesIds"`
	CloseReason       CloseReason `json:"closeReason"`
	RootCause         string      `json:"rootCause"`
	CloseComment      string      `json:"closeComment"`
	DynamicParameters []any       `json:"dynamicParameters"`
}

BulkCloseRequest closes one or more cases in a single legacy operation. CasesIDs are SOAR INTEGER case ids (see the dual case-id gotcha above). DynamicParameters is a freeform legacy bag, usually empty ([]any{}).

type CasePriority 

type CasePriority int

CasePriority is the case priority scale (the server's CasePriority enum). The integer values are non-contiguous (sourced from the swagger schema description). 

const (
	PriorityInformative CasePriority = -1
	PriorityUnchanged   CasePriority = 0
	PriorityLow         CasePriority = 40
	PriorityMedium      CasePriority = 60
	PriorityHigh        CasePriority = 80
	PriorityCritical    CasePriority = 100
)

CasePriority values for ManualCaseRequest.Priority and the priority verbs.

func ParseCasePriority added in v0.3.0 

func ParseCasePriority(s string) (CasePriority, error)

ParseCasePriority maps a priority name (or one of the server's raw integer codings) to the typed CasePriority. Only the server's defined, settable values are accepted — the integer scale is non-contiguous (Low=40 … Critical=100, Informative=-1), so an arbitrary number is rejected rather than passed through as an undefined priority (and 0/"Unchanged" is rejected as a silent no-op).

func (CasePriority) String added in v0.3.0 

func (p CasePriority) String() string

String returns the priority's label ("Low" … "Critical"), or the raw number for an unmapped value.

type CaseQueueRequest 

type CaseQueueRequest struct {
	SortBy        []any `json:"sortBy"`
	RequestedPage int   `json:"requestedPage"`
	PageSize      int   `json:"pageSize"`
	Statuses      []int `json:"statuses"` // 1=OPEN 2=CLOSED
}

CaseQueueRequest filters and pages the legacy case-queue (case cards) view. SortBy and the per-card payloads are freeform legacy shapes, so SortBy is left as []any. Pagination is offset-style: RequestedPage is 0-based and PageSize caps the cards returned.

type Client 

type Client struct {
	// contains filtered or unexported fields
}

Client speaks the Siemplify external-API (and bridge) SOAR surfaces. It is safe for concurrent use.

func NewClient 

func NewClient(s Settings, creds auth.Credentials, httpClient *http.Client) *Client

NewClient builds a legacy SOAR client. creds must be an AppKey credential (auth.SOARAppKey); auth resolves lazily on the first request. A nil httpClient uses a sensible default.

func (*Client) AddCaseComment 

func (c *Client) AddCaseComment(ctx context.Context, body any) (json.RawMessage, error)

AddCaseComment posts a comment to a case. body is the freeform legacy payload (typically {caseId:<int>, comment:"…"}); it carries the SOAR INTEGER case id.

func (*Client) AddCaseStageDefinitionRecord 

func (c *Client) AddCaseStageDefinitionRecord(ctx context.Context, body any) (RawJSON, error)

AddCaseStageDefinitionRecord creates or updates a case stage. LIVE MUTATION.

func (*Client) AddCaseTag 

func (c *Client) AddCaseTag(ctx context.Context, body any) (json.RawMessage, error)

AddCaseTag tags a case. body is the freeform legacy payload (typically {caseId:<int>, tag:"…"}); it carries the SOAR INTEGER case id.

func (*Client) AddEvidence 

func (c *Client) AddEvidence(ctx context.Context, body any) (RawJSON, error)

AddEvidence attaches evidence to a case.

func (*Client) AddOrUpdateCaseAssignmentPolicySettings 

func (c *Client) AddOrUpdateCaseAssignmentPolicySettings(ctx context.Context, body any) (RawJSON, error)

AddOrUpdateCaseAssignmentPolicySettings sets the case auto-assignment policy. LIVE MUTATION.

func (*Client) AddOrUpdateCaseTask 

func (c *Client) AddOrUpdateCaseTask(ctx context.Context, body any) (RawJSON, error)

AddOrUpdateCaseTask creates or updates a task on a case (case-scoped variant). LIVE MUTATION.

func (*Client) AddOrUpdateEntityProperty 

func (c *Client) AddOrUpdateEntityProperty(ctx context.Context, body any) (RawJSON, error)

AddOrUpdateEntityProperty sets a property on a case entity. LIVE MUTATION.

func (*Client) AddOrUpdateEnvironmentRecords 

func (c *Client) AddOrUpdateEnvironmentRecords(ctx context.Context, body any) (RawJSON, error)

AddOrUpdateEnvironmentRecords creates or updates environments. LIVE MUTATION.

func (*Client) AddOrUpdateMappingRules 

func (c *Client) AddOrUpdateMappingRules(ctx context.Context, body any) (RawJSON, error)

AddOrUpdateMappingRules creates or updates ontology mapping rules. body is the freeform rules payload. LIVE MUTATION.

func (*Client) AddOrUpdateModelBlockRecords 

func (c *Client) AddOrUpdateModelBlockRecords(ctx context.Context, body any) (RawJSON, error)

AddOrUpdateModelBlockRecords creates or updates block-list records. LIVE MUTATION.

func (*Client) AddOrUpdateMoveCaseBetweenEnvironmentsPolicySettings 

func (c *Client) AddOrUpdateMoveCaseBetweenEnvironmentsPolicySettings(ctx context.Context, body any) (RawJSON, error)

AddOrUpdateMoveCaseBetweenEnvironmentsPolicySettings sets the cross-environment case-move policy. LIVE MUTATION.

func (*Client) AddOrUpdateNetworkDetailsRecords 

func (c *Client) AddOrUpdateNetworkDetailsRecords(ctx context.Context, body any) (RawJSON, error)

AddOrUpdateNetworkDetailsRecords creates or updates network records. LIVE MUTATION.

func (*Client) AddOrUpdatePlaybookCategory 

func (c *Client) AddOrUpdatePlaybookCategory(ctx context.Context, body any) (RawJSON, error)

AddOrUpdatePlaybookCategory creates or renames a playbook category. body is the freeform category payload. LIVE MUTATION.

func (*Client) AddOrUpdateRootCauseClose 

func (c *Client) AddOrUpdateRootCauseClose(ctx context.Context, body any) (RawJSON, error)

AddOrUpdateRootCauseClose creates or updates a root-cause option. LIVE MUTATION.

func (*Client) AddOrUpdateTrackingListRecords 

func (c *Client) AddOrUpdateTrackingListRecords(ctx context.Context, body any) (RawJSON, error)

AddOrUpdateTrackingListRecords creates or updates tracking-list records. LIVE MUTATION.

func (*Client) AddOrUpdateVisualFamily 

func (c *Client) AddOrUpdateVisualFamily(ctx context.Context, body any) (RawJSON, error)

AddOrUpdateVisualFamily creates or updates a visual family. LIVE MUTATION.

func (*Client) AddOrUpdateVisualFamilyRules 

func (c *Client) AddOrUpdateVisualFamilyRules(ctx context.Context, body any) (RawJSON, error)

AddOrUpdateVisualFamilyRules creates or updates a visual family's rules. LIVE MUTATION.

func (*Client) AddRootCauseClose 

func (c *Client) AddRootCauseClose(ctx context.Context, rc RootCauseClose) (RawJSON, error)

AddRootCauseClose is the typed form of AddOrUpdateRootCauseClose. LIVE MUTATION.

func (*Client) AddSlaDefinition 

func (c *Client) AddSlaDefinition(ctx context.Context, def SlaDefinition) (RawJSON, error)

AddSlaDefinition is the typed form of AddSlaDefinitionsRecord. LIVE MUTATION.

func (*Client) AddSlaDefinitionsRecord 

func (c *Client) AddSlaDefinitionsRecord(ctx context.Context, body any) (RawJSON, error)

AddSlaDefinitionsRecord creates or updates an SLA definition. LIVE MUTATION.

func (*Client) AddTagDefinitionsRecords 

func (c *Client) AddTagDefinitionsRecords(ctx context.Context, body any) (RawJSON, error)

AddTagDefinitionsRecords creates or updates tag definitions. LIVE MUTATION.

func (*Client) AgentAdd 

func (c *Client) AgentAdd(ctx context.Context, body any) (RawJSON, error)

AgentAdd creates a new agent. body is the freeform agent payload. LIVE MUTATION.

func (*Client) AgentAddOrUpdatePublisher 

func (c *Client) AgentAddOrUpdatePublisher(ctx context.Context, body any) (RawJSON, error)

AgentAddOrUpdatePublisher creates a publisher or updates an existing one. body is the freeform publisher payload. LIVE MUTATION.

func (*Client) AgentDelete 

func (c *Client) AgentDelete(ctx context.Context, body any) (RawJSON, error)

AgentDelete deletes the agent identified by body. LIVE MUTATION; this cannot be undone.

func (*Client) AgentDeletePublishers 

func (c *Client) AgentDeletePublishers(ctx context.Context, body any) (RawJSON, error)

AgentDeletePublishers deletes the publishers identified by body. LIVE MUTATION; this cannot be undone.

func (*Client) AgentGet 

func (c *Client) AgentGet(ctx context.Context, agentIdentifier string) (RawJSON, error)

AgentGet returns one agent by its identifier.

func (*Client) AgentGetInformationByIdentifier 

func (c *Client) AgentGetInformationByIdentifier(ctx context.Context, agentIdentifier string) (RawJSON, error)

AgentGetInformationByIdentifier returns agent information for one agent by its identifier.

func (*Client) AgentGetInformationByIdentifiers 

func (c *Client) AgentGetInformationByIdentifiers(ctx context.Context, body any) (RawJSON, error)

AgentGetInformationByIdentifiers returns agent information for the identifiers in body.

func (*Client) AgentGetInformationByIntegrationInstance 

func (c *Client) AgentGetInformationByIntegrationInstance(ctx context.Context, integrationInstanceID string) (RawJSON, error)

AgentGetInformationByIntegrationInstance returns agent information for the given integration instance id.

func (*Client) AgentGetPublisher 

func (c *Client) AgentGetPublisher(ctx context.Context, publisherID string) (RawJSON, error)

AgentGetPublisher returns one publisher by id.

func (*Client) AgentGetSecondaryByPrimaryIdentifiers 

func (c *Client) AgentGetSecondaryByPrimaryIdentifiers(ctx context.Context, body any) (RawJSON, error)

AgentGetSecondaryByPrimaryIdentifiers returns secondary agents for the primary agent identifiers in body.

func (*Client) AgentList 

func (c *Client) AgentList(ctx context.Context) (RawJSON, error)

AgentList returns all agents.

func (*Client) AgentListAvailableEnvironments 

func (c *Client) AgentListAvailableEnvironments(ctx context.Context) (RawJSON, error)

AgentListAvailableEnvironments returns the environments available for agents.

func (*Client) AgentListByEnvironment 

func (c *Client) AgentListByEnvironment(ctx context.Context, body any) (RawJSON, error)

AgentListByEnvironment returns agents for the environments specified in body.

func (*Client) AgentListEnabled 

func (c *Client) AgentListEnabled(ctx context.Context) (RawJSON, error)

AgentListEnabled returns only the enabled agents.

func (*Client) AgentListIntegrationUpgradeUnsupported 

func (c *Client) AgentListIntegrationUpgradeUnsupported(ctx context.Context, requiredPythonVersion, integrationIdentifier, toggleStagingProduction string) (RawJSON, error)

AgentListIntegrationUpgradeUnsupported returns agents that do not support the integration upgrade for the given required Python version, integration, and staging/production toggle. requiredPythonVersion is the enum value (e.g. "0"= None, "1"=V2_7, "2"=V3_7, "3"=V3_11).

func (*Client) AgentListPublishers 

func (c *Client) AgentListPublishers(ctx context.Context) (RawJSON, error)

AgentListPublishers returns all configured publishers.

func (*Client) AgentListValidForConnector 

func (c *Client) AgentListValidForConnector(ctx context.Context, environment, integration string) (RawJSON, error)

AgentListValidForConnector returns agents valid to run a connector in the given environment and integration.

func (*Client) AgentListValidForIdeConnector 

func (c *Client) AgentListValidForIdeConnector(ctx context.Context, environment, integration string) (RawJSON, error)

AgentListValidForIdeConnector returns agents valid to run an IDE connector in the given environment and integration.

func (*Client) AgentListValidForJobs 

func (c *Client) AgentListValidForJobs(ctx context.Context, integration string) (RawJSON, error)

AgentListValidForJobs returns agents valid to run jobs for the given integration.

func (*Client) AgentRedeploy 

func (c *Client) AgentRedeploy(ctx context.Context, body any) (RawJSON, error)

AgentRedeploy redeploys the agent identified by body. LIVE MUTATION.

func (*Client) AgentTestPublisherConnectivity 

func (c *Client) AgentTestPublisherConnectivity(ctx context.Context, publisherID string) (RawJSON, error)

AgentTestPublisherConnectivity checks connectivity to one publisher by id.

func (*Client) AgentUpdate 

func (c *Client) AgentUpdate(ctx context.Context, body any) (RawJSON, error)

AgentUpdate updates an existing agent. body is the freeform agent payload. LIVE MUTATION.

func (*Client) AiGeneratePlaybook added in v0.3.0 

func (c *Client) AiGeneratePlaybook(ctx context.Context, body any) (json.RawMessage, error)

AiGeneratePlaybook generates a playbook draft from a description (legacyPlaybooks:legacyAiGenerate). body is the freeform request payload. LIVE MUTATION (creates a draft).

func (*Client) AiGeneratePlaybookByAlert added in v0.3.0 

func (c *Client) AiGeneratePlaybookByAlert(ctx context.Context, body any) (json.RawMessage, error)

AiGeneratePlaybookByAlert generates a playbook draft FROM a specific alert (legacyPlaybooks:legacyAiGenerateByAlert): body carries caseId (int64 as string), alertId, and the optional hashedUserId / forceRefreshData / isFirstRequest polling fields. LIVE MUTATION (creates a draft).

func (*Client) AiGenerationStatusByAlert added in v0.3.0 

func (c *Client) AiGenerationStatusByAlert(ctx context.Context, body any) (json.RawMessage, error)

AiGenerationStatusByAlert polls the by-alert generation status (legacyPlaybooks:legacyGetAiGenerationStatusByAlert). Read-only.

func (*Client) AiUpdatePlaybook added in v0.3.0 

func (c *Client) AiUpdatePlaybook(ctx context.Context, body any) (json.RawMessage, error)

AiUpdatePlaybook revises an existing playbook with AI (legacyPlaybooks:legacyAiUpdate). LIVE MUTATION.

func (*Client) ApprovalLinkApply 

func (c *Client) ApprovalLinkApply(ctx context.Context, body any) (RawJSON, error)

ApprovalLinkApply applies an approval-link decision (approve/reject) for a pending playbook step, resuming the waiting workflow. body is the freeform legacy approval-link payload. LIVE MUTATION.

func (*Client) AssignUserToCase 

func (c *Client) AssignUserToCase(ctx context.Context, body any) (RawJSON, error)

AssignUserToCase assigns a case to a user.

func (*Client) AttachNestedWorkflowToCase 

func (c *Client) AttachNestedWorkflowToCase(ctx context.Context, body any) (RawJSON, error)

AttachNestedWorkflowToCase attaches a nested workflow (block) to a case. LIVE MUTATION.

func (*Client) AttachPlaybookToCase 

func (c *Client) AttachPlaybookToCase(ctx context.Context, body any) (json.RawMessage, error)

AttachPlaybookToCase attaches a workflow to a case. body is a freeform request payload; the server echo is returned.

func (*Client) AttachWorkflowToCase 

func (c *Client) AttachWorkflowToCase(ctx context.Context, body any) (RawJSON, error)

AttachWorkflowToCase attaches a workflow to a case. body carries the case and workflow ids. LIVE MUTATION.

func (*Client) AttackSimCreateSimulatedCustomCase 

func (c *Client) AttackSimCreateSimulatedCustomCase(ctx context.Context, body any) (RawJSON, error)

AttackSimCreateSimulatedCustomCase creates a custom (simulated) case. body is the freeform custom-case definition. LIVE MUTATION.

func (*Client) AttackSimDeleteUseCase 

func (c *Client) AttackSimDeleteUseCase(ctx context.Context, body any) (RawJSON, error)

AttackSimDeleteUseCase deletes a given use case. body selects the use case (freeform legacy payload). LIVE MUTATION; this cannot be undone.

func (*Client) AttackSimExportCustomCase 

func (c *Client) AttackSimExportCustomCase(ctx context.Context, customCaseName string) (RawJSON, error)

AttackSimExportCustomCase exports a custom (simulated) case as a JSON file, selected by its name.

func (*Client) AttackSimGenerateUseCases 

func (c *Client) AttackSimGenerateUseCases(ctx context.Context, body any) (RawJSON, error)

AttackSimGenerateUseCases simulates a case so it is presented in the case queue. body is the freeform simulation payload. LIVE MUTATION.

func (*Client) AttackSimGetCustomCaseDetails 

func (c *Client) AttackSimGetCustomCaseDetails(ctx context.Context, body any) (RawJSON, error)

AttackSimGetCustomCaseDetails returns the details of a custom (simulated) case in your environment. body selects the case (freeform legacy payload).

func (*Client) AttackSimGetCustomCases 

func (c *Client) AttackSimGetCustomCases(ctx context.Context) (RawJSON, error)

AttackSimGetCustomCases returns all custom (simulated) cases in your environment.

func (*Client) AttackSimImportCustomCase 

func (c *Client) AttackSimImportCustomCase(ctx context.Context, body any) (RawJSON, error)

AttackSimImportCustomCase imports a custom (simulated) case from a JSON file. body is the freeform exported-case payload. LIVE MUTATION.

func (*Client) AttackSimIsCustomCaseExists 

func (c *Client) AttackSimIsCustomCaseExists(ctx context.Context, alertName string) (RawJSON, error)

AttackSimIsCustomCaseExists reports whether a custom-case name already exists.

func (*Client) AttackSimSimulateAlert 

func (c *Client) AttackSimSimulateAlert(ctx context.Context, body any) (RawJSON, error)

AttackSimSimulateAlert simulates a specific alert within a case; the alert is then presented as a Test case in your case queue. body is the freeform alert payload. LIVE MUTATION.

func (*Client) AuditGetData added in v0.2.4 

func (c *Client) AuditGetData(ctx context.Context, body any) (RawJSON, error)

AuditGetData returns audit log entries. body carries paging/filter params. The legacy external-API path for this is undocumented in the swagger; use the v1alpha legacySoarAudit surface (soar.Client.AuditGetData) instead.

func (*Client) BatchDeleteCustomLists 

func (c *Client) BatchDeleteCustomLists(ctx context.Context, body any) (RawJSON, error)

BatchDeleteCustomLists deletes custom-list records in bulk. LIVE MUTATION.

func (*Client) BulkAddCaseTag 

func (c *Client) BulkAddCaseTag(ctx context.Context, body any) (RawJSON, error)

BulkAddCaseTag tags many cases at once.

func (*Client) BulkAssign 

func (c *Client) BulkAssign(ctx context.Context, body any) (RawJSON, error)

BulkAssign assigns many cases to a user at once.

func (*Client) BulkAssignCaseQueue 

func (c *Client) BulkAssignCaseQueue(ctx context.Context, body any) (RawJSON, error)

BulkAssignCaseQueue assigns many queued cases at once (cases-queue variant).

func (*Client) BulkChangeCasePriority 

func (c *Client) BulkChangeCasePriority(ctx context.Context, body any) (RawJSON, error)

BulkChangeCasePriority changes the priority of many cases at once.

func (*Client) BulkChangeCaseStage 

func (c *Client) BulkChangeCaseStage(ctx context.Context, body any) (RawJSON, error)

BulkChangeCaseStage moves many cases to a stage at once.

func (*Client) BulkCloseCases 

func (c *Client) BulkCloseCases(ctx context.Context, req BulkCloseRequest) (json.RawMessage, error)

BulkCloseCases closes every case in req.CasesIDs with one operation. This is a live mutation against production cases — confirm the id set first.

func (*Client) BulkReopenCase 

func (c *Client) BulkReopenCase(ctx context.Context, body any) (RawJSON, error)

BulkReopenCase reopens many cases at once.

func (*Client) CaseChatGetAttachment 

func (c *Client) CaseChatGetAttachment(ctx context.Context, attachmentID int) (RawJSON, error)

CaseChatGetAttachment returns the bytes/metadata of one chat attachment.

func (*Client) CaseChatGetAttachmentPreview 

func (c *Client) CaseChatGetAttachmentPreview(ctx context.Context, attachmentID int) (RawJSON, error)

CaseChatGetAttachmentPreview returns a preview of one chat attachment.

func (*Client) CaseChatList 

func (c *Client) CaseChatList(ctx context.Context, caseID int, q url.Values) (RawJSON, error)

CaseChatList returns the chat thread for one case. The optional query parameters (pagesize, page, startMessageId, includeStartMessage, searchTerm) page and filter the messages; pass an empty url.Values for defaults.

func (*Client) CaseChatNewMessagesCount 

func (c *Client) CaseChatNewMessagesCount(ctx context.Context, caseID int) (RawJSON, error)

CaseChatNewMessagesCount returns the count of new (unread) chat messages for one case.

func (*Client) CaseChatPinMessage 

func (c *Client) CaseChatPinMessage(ctx context.Context, messageID int) (RawJSON, error)

CaseChatPinMessage pins one chat message. LIVE MUTATION.

func (*Client) CaseChatPost 

func (c *Client) CaseChatPost(ctx context.Context, caseID int, body any) (RawJSON, error)

CaseChatPost posts a new chat message to one case. body is the freeform message payload. LIVE MUTATION.

func (*Client) CaseChatUnpinMessage 

func (c *Client) CaseChatUnpinMessage(ctx context.Context, messageID int) (RawJSON, error)

CaseChatUnpinMessage unpins one chat message. LIVE MUTATION.

func (*Client) CaseOverviewGetAlertData 

func (c *Client) CaseOverviewGetAlertData(ctx context.Context, body any) (RawJSON, error)

CaseOverviewGetAlertData returns overview data for one alert. body is the freeform request payload selecting the alert.

func (*Client) CaseOverviewGetAlertsEntities 

func (c *Client) CaseOverviewGetAlertsEntities(ctx context.Context, body any) (RawJSON, error)

CaseOverviewGetAlertsEntities returns the entities associated with the requested alerts. body is the freeform request payload.

func (*Client) CaseOverviewGetCaseEntities 

func (c *Client) CaseOverviewGetCaseEntities(ctx context.Context, caseID int) (RawJSON, error)

CaseOverviewGetCaseEntities returns the entities associated with a case by its numeric case id.

func (*Client) CaseOverviewGetData 

func (c *Client) CaseOverviewGetData(ctx context.Context, body any) (RawJSON, error)

CaseOverviewGetData returns the rendered overview data for a case. body is the freeform request payload selecting the case and template.

func (*Client) CaseOverviewGetFullTemplateDetails 

func (c *Client) CaseOverviewGetFullTemplateDetails(ctx context.Context, templateIdentifier string) (RawJSON, error)

CaseOverviewGetFullTemplateDetails returns the full definition of one overview template by its identifier.

func (*Client) CaseOverviewGetTemplate 

func (c *Client) CaseOverviewGetTemplate(ctx context.Context, body any) (RawJSON, error)

CaseOverviewGetTemplate returns an overview template. body is the freeform request payload selecting the template.

func (*Client) CaseOverviewListPredefinedWidgets 

func (c *Client) CaseOverviewListPredefinedWidgets(ctx context.Context) (RawJSON, error)

CaseOverviewListPredefinedWidgets returns all built-in case predefined widgets.

func (*Client) CaseOverviewListTemplateCards 

func (c *Client) CaseOverviewListTemplateCards(ctx context.Context) (RawJSON, error)

CaseOverviewListTemplateCards returns basic info for each available overview template.

func (*Client) CaseOverviewPreviewWidget 

func (c *Client) CaseOverviewPreviewWidget(ctx context.Context, body any) (RawJSON, error)

CaseOverviewPreviewWidget renders a preview of an overview widget without persisting it. body is the freeform widget definition. LIVE MUTATION.

func (*Client) CaseOverviewResolveWidget 

func (c *Client) CaseOverviewResolveWidget(ctx context.Context, body any) (RawJSON, error)

CaseOverviewResolveWidget resolves an overview widget's values for a case. body is the freeform widget+context payload. LIVE MUTATION.

func (*Client) CaseOverviewSaveTemplate 

func (c *Client) CaseOverviewSaveTemplate(ctx context.Context, body any) (RawJSON, error)

CaseOverviewSaveTemplate creates or updates an overview template. body is the freeform template payload. LIVE MUTATION.

func (*Client) CaseSearchEverything 

func (c *Client) CaseSearchEverything(ctx context.Context, body any) (RawJSON, error)

CaseSearchEverything runs a full-text/structured search across cases. body is the freeform search request.

func (*Client) CaseXCreateComment 

func (c *Client) CaseXCreateComment(ctx context.Context, body any) (RawJSON, error)

CaseXCreateComment creates a case comment. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CaseXCreateWarRoomIncident 

func (c *Client) CaseXCreateWarRoomIncident(ctx context.Context, body any) (RawJSON, error)

CaseXCreateWarRoomIncident creates a Command Center incident from a given case. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CaseXDownloadCommentFile 

func (c *Client) CaseXDownloadCommentFile(ctx context.Context, fileID int) (RawJSON, error)

CaseXDownloadCommentFile downloads the file attached to a comment, by the integer file id.

func (*Client) CaseXExecuteBulkClose 

func (c *Client) CaseXExecuteBulkClose(ctx context.Context, body any) (RawJSON, error)

CaseXExecuteBulkClose performs a bulk close-case action over several cases at once. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CaseXExecuteStep 

func (c *Client) CaseXExecuteStep(ctx context.Context, body any) (RawJSON, error)

CaseXExecuteStep executes a single playbook step (triggering re-calculation). body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CaseXGenerateCollaboratorRequest 

func (c *Client) CaseXGenerateCollaboratorRequest(ctx context.Context, body any) (RawJSON, error)

CaseXGenerateCollaboratorRequest generates an alert of the request template in the environment. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CaseXGenerateReport 

func (c *Client) CaseXGenerateReport(ctx context.Context, body any) (RawJSON, error)

CaseXGenerateReport generates a report for a specific case. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CaseXGetCardsByRequest 

func (c *Client) CaseXGetCardsByRequest(ctx context.Context, body any) (RawJSON, error)

CaseXGetCardsByRequest returns minimal CaseCard data for cases matching the request. Read-only despite the POST verb. body is the freeform legacy payload.

func (*Client) CaseXGetCollaboratorRequestCount 

func (c *Client) CaseXGetCollaboratorRequestCount(ctx context.Context) (RawJSON, error)

CaseXGetCollaboratorRequestCount returns the collaborator-request count.

func (*Client) CaseXGetTasksCountForUser 

func (c *Client) CaseXGetTasksCountForUser(ctx context.Context) (RawJSON, error)

CaseXGetTasksCountForUser returns the task count for the logged-in user.

func (*Client) CaseXGetWallItemsForWarRoom 

func (c *Client) CaseXGetWallItemsForWarRoom(ctx context.Context, id int) (RawJSON, error)

CaseXGetWallItemsForWarRoom returns all wall items (case history) for a case for transfer into a Command Center incident, by integer case id.

func (*Client) CaseXListCollaboratorRequests 

func (c *Client) CaseXListCollaboratorRequests(ctx context.Context, q url.Values) (RawJSON, error)

CaseXListCollaboratorRequests returns collaborator requests matching the request. q carries the pagination and filter keys (RequestedPage, PageSize, SearchTerm, Filters, SortBy).

func (*Client) CaseXListComments 

func (c *Client) CaseXListComments(ctx context.Context, q url.Values) (RawJSON, error)

CaseXListComments returns all case comments matching the filter. q carries the filter keys (CaseId, AlertIdentifier, UserOwnerId, Spec.*).

func (*Client) CaseXListTasksByRequest 

func (c *Client) CaseXListTasksByRequest(ctx context.Context, q url.Values) (RawJSON, error)

CaseXListTasksByRequest returns case tasks matching the request. q carries the pagination and filter keys (RequestedPage, PageSize, SearchTerm, Filters, StatusFilter, SortBy).

func (*Client) CaseXMarkCommentDeleted 

func (c *Client) CaseXMarkCommentDeleted(ctx context.Context, id int) (RawJSON, error)

CaseXMarkCommentDeleted marks a case comment as deleted by integer id. LIVE MUTATION.

func (*Client) CaseXPauseAlertSla 

func (c *Client) CaseXPauseAlertSla(ctx context.Context, body any) (RawJSON, error)

CaseXPauseAlertSla pauses the SLA on an alert. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CaseXResumeAlertSla 

func (c *Client) CaseXResumeAlertSla(ctx context.Context, body any) (RawJSON, error)

CaseXResumeAlertSla resumes a previously-paused SLA on an alert. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CaseXSetWallItemFavourite 

func (c *Client) CaseXSetWallItemFavourite(ctx context.Context, body any) (RawJSON, error)

CaseXSetWallItemFavourite marks a case wall item as favourite. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CaseXUpdateComment 

func (c *Client) CaseXUpdateComment(ctx context.Context, id int, body any) (RawJSON, error)

CaseXUpdateComment updates an existing case comment by integer id. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CaseXValidateBulkCloseAssignees 

func (c *Client) CaseXValidateBulkCloseAssignees(ctx context.Context, body any) (RawJSON, error)

CaseXValidateBulkCloseAssignees validates case assignees before a bulk close-case action. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) ChangeCaseDescription 

func (c *Client) ChangeCaseDescription(ctx context.Context, body any) (RawJSON, error)

ChangeCaseDescription updates a case's description.

func (*Client) ChangeCaseImportanceStatus 

func (c *Client) ChangeCaseImportanceStatus(ctx context.Context, body any) (RawJSON, error)

ChangeCaseImportanceStatus updates a case's importance/status.

func (*Client) ChangeCasePriority 

func (c *Client) ChangeCasePriority(ctx context.Context, body any) (json.RawMessage, error)

ChangeCasePriority changes a case's priority. body is the freeform legacy payload (typically {caseId:<int>, priority:<int>}); it carries the SOAR INTEGER case id.

func (*Client) ChangeCaseStage 

func (c *Client) ChangeCaseStage(ctx context.Context, body any) (RawJSON, error)

ChangeCaseStage moves a case to a different stage.

func (*Client) CloneWorkflow added in v0.7.1 

func (c *Client) CloneWorkflow(ctx context.Context, body any) (RawJSON, error)

CloneWorkflow creates an exact copy of a workflow definition. body carries the source definition. Per Google docs, Clone is "exact copy" while Duplicate is "template-based" — they share the same request/response shape. LIVE MUTATION.

func (*Client) CloseAlert 

func (c *Client) CloseAlert(ctx context.Context, body any) (RawJSON, error)

CloseAlert closes a single alert within a case.

func (*Client) CloseCase 

func (c *Client) CloseCase(ctx context.Context, body any) (RawJSON, error)

CloseCase closes a case.

func (*Client) CloudLoggingDownloadAgentLogs 

func (c *Client) CloudLoggingDownloadAgentLogs(ctx context.Context, agentIdentifier string, hoursBack int) (RawJSON, error)

CloudLoggingDownloadAgentLogs downloads the logs of one remote agent by its identifier. hoursBack (when > 0) limits the results to the given timeframe.

func (*Client) CloudLoggingGetPythonLogs 

func (c *Client) CloudLoggingGetPythonLogs(ctx context.Context, body any) (RawJSON, error)

CloudLoggingGetPythonLogs returns the logs of Python executions (integrations, connectors, actions, jobs). body is the freeform legacy filter/paging payload.

func (*Client) CommandCenterCloseIncident 

func (c *Client) CommandCenterCloseIncident(ctx context.Context, body any) (RawJSON, error)

CommandCenterCloseIncident closes a War Room incident. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CommandCenterCreateIncident 

func (c *Client) CommandCenterCreateIncident(ctx context.Context, body any) (RawJSON, error)

CommandCenterCreateIncident creates a War Room incident. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CommandCenterCreateWarRoomAssessment 

func (c *Client) CommandCenterCreateWarRoomAssessment(ctx context.Context, body any) (RawJSON, error)

CommandCenterCreateWarRoomAssessment creates a War Room assessment. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CommandCenterCreateWarRoomComment 

func (c *Client) CommandCenterCreateWarRoomComment(ctx context.Context, body any) (RawJSON, error)

CommandCenterCreateWarRoomComment adds a comment to the War Room. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CommandCenterCreateWarRoomDecision 

func (c *Client) CommandCenterCreateWarRoomDecision(ctx context.Context, body any) (RawJSON, error)

CommandCenterCreateWarRoomDecision records a War Room decision. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CommandCenterCreateWarRoomFact 

func (c *Client) CommandCenterCreateWarRoomFact(ctx context.Context, body any) (RawJSON, error)

CommandCenterCreateWarRoomFact records a War Room fact. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CommandCenterCreateWarRoomReport 

func (c *Client) CommandCenterCreateWarRoomReport(ctx context.Context, incidentID int) (RawJSON, error)

CommandCenterCreateWarRoomReport generates the War Room report for one incident.

func (*Client) CommandCenterCreateWarRoomTask 

func (c *Client) CommandCenterCreateWarRoomTask(ctx context.Context, body any) (RawJSON, error)

CommandCenterCreateWarRoomTask creates a War Room task. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CommandCenterGetChatChannelCards 

func (c *Client) CommandCenterGetChatChannelCards(ctx context.Context, incidentID int) (RawJSON, error)

CommandCenterGetChatChannelCards lists the chat-channel cards for one incident.

func (*Client) CommandCenterGetChatChannelConversation 

func (c *Client) CommandCenterGetChatChannelConversation(ctx context.Context, body any) (RawJSON, error)

CommandCenterGetChatChannelConversation returns the conversation for a chat channel. body is the freeform legacy request payload.

func (*Client) CommandCenterGetDepartments 

func (c *Client) CommandCenterGetDepartments(ctx context.Context) (RawJSON, error)

CommandCenterGetDepartments lists the War Room departments.

func (*Client) CommandCenterGetFilterDepartments 

func (c *Client) CommandCenterGetFilterDepartments(ctx context.Context, incidentID int) (RawJSON, error)

CommandCenterGetFilterDepartments lists the departments available to filter by for one incident.

func (*Client) CommandCenterGetForgotPasswordTimeLimit 

func (c *Client) CommandCenterGetForgotPasswordTimeLimit(ctx context.Context) (RawJSON, error)

CommandCenterGetForgotPasswordTimeLimit returns the War Room forgot-password time limit setting.

func (*Client) CommandCenterGetIncident 

func (c *Client) CommandCenterGetIncident(ctx context.Context, id int) (RawJSON, error)

CommandCenterGetIncident returns the full details of one War Room incident.

func (*Client) CommandCenterGetIncidentUserByID 

func (c *Client) CommandCenterGetIncidentUserByID(ctx context.Context, id int) (RawJSON, error)

CommandCenterGetIncidentUserByID returns one War Room incident user by id.

func (*Client) CommandCenterGetLastSeverityScore 

func (c *Client) CommandCenterGetLastSeverityScore(ctx context.Context, id int) (RawJSON, error)

CommandCenterGetLastSeverityScore returns the most recent severity score for an incident.

func (*Client) CommandCenterGetWarRoomAuditors 

func (c *Client) CommandCenterGetWarRoomAuditors(ctx context.Context) (RawJSON, error)

CommandCenterGetWarRoomAuditors lists the War Room auditors.

func (*Client) CommandCenterGetWarRoomUserForIncident 

func (c *Client) CommandCenterGetWarRoomUserForIncident(ctx context.Context, incidentID int) (RawJSON, error)

CommandCenterGetWarRoomUserForIncident returns the War Room user record for one incident.

func (*Client) CommandCenterGetWarRoomWallItems 

func (c *Client) CommandCenterGetWarRoomWallItems(ctx context.Context, body any) (RawJSON, error)

CommandCenterGetWarRoomWallItems returns the War Room wall items. body is the freeform legacy request payload.

func (*Client) CommandCenterSaveSeverityScore 

func (c *Client) CommandCenterSaveSeverityScore(ctx context.Context, body any) (RawJSON, error)

CommandCenterSaveSeverityScore saves an incident severity score. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CommandCenterSendChatMessage 

func (c *Client) CommandCenterSendChatMessage(ctx context.Context, body any) (RawJSON, error)

CommandCenterSendChatMessage sends a War Room chat message. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CommandCenterUpdateWarRoomAssessment 

func (c *Client) CommandCenterUpdateWarRoomAssessment(ctx context.Context, body any) (RawJSON, error)

CommandCenterUpdateWarRoomAssessment updates a War Room assessment. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CommandCenterUpdateWarRoomComment 

func (c *Client) CommandCenterUpdateWarRoomComment(ctx context.Context, body any) (RawJSON, error)

CommandCenterUpdateWarRoomComment updates a War Room comment. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CommandCenterUpdateWarRoomDecision 

func (c *Client) CommandCenterUpdateWarRoomDecision(ctx context.Context, body any) (RawJSON, error)

CommandCenterUpdateWarRoomDecision updates a War Room decision. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CommandCenterUpdateWarRoomFact 

func (c *Client) CommandCenterUpdateWarRoomFact(ctx context.Context, body any) (RawJSON, error)

CommandCenterUpdateWarRoomFact updates a War Room fact. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) CommandCenterUpdateWarRoomTask 

func (c *Client) CommandCenterUpdateWarRoomTask(ctx context.Context, body any) (RawJSON, error)

CommandCenterUpdateWarRoomTask updates a War Room task. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) ConfigItemBatchUpdate 

func (c *Client) ConfigItemBatchUpdate(ctx context.Context, tenantID string, body any) (RawJSON, error)

ConfigItemBatchUpdate applies a batch of changes to a tenant's configuration items. body is the freeform batch payload. LIVE MUTATION.

func (*Client) ConfigItemList 

func (c *Client) ConfigItemList(ctx context.Context, tenantID, key, category string) (RawJSON, error)

ConfigItemList returns the configuration items for one tenant. key and category are optional filters; pass "" to omit either.

func (*Client) ConfigItemUpdate 

func (c *Client) ConfigItemUpdate(ctx context.Context, tenantID string, body any) (RawJSON, error)

ConfigItemUpdate replaces the configuration items for one tenant. body is the freeform configuration-items payload. LIVE MUTATION.

func (*Client) CreateAPIKey added in v0.3.0 

func (c *Client) CreateAPIKey(ctx context.Context, name, secret string, permissionGroupID, socRoleID int, environments []string) error

CreateAPIKey registers a new external-API key record (POST /settings/addOrUpdateApiKeyRecord). THE KEY VALUE IS CLIENT-GENERATED: the server stores the supplied secret verbatim and only ever returns it masked afterwards — mint it from crypto/rand, surface it to the user exactly once, and never persist or log it. socRoleID <= 0 sends null (the server defaults the role). LIVE MUTATION.

func (*Client) CreateCase 

func (c *Client) CreateCase(ctx context.Context, body any) (RawJSON, error)

CreateCase creates a case. body is the freeform case payload.

func (*Client) CreateCaseEntity 

func (c *Client) CreateCaseEntity(ctx context.Context, body any) (RawJSON, error)

CreateCaseEntity adds an entity to a case.

func (*Client) CreateCaseInsight 

func (c *Client) CreateCaseInsight(ctx context.Context, body any) (RawJSON, error)

CreateCaseInsight adds an insight to a case.

func (*Client) CreateCaseTask 

func (c *Client) CreateCaseTask(ctx context.Context, body any) (RawJSON, error)

CreateCaseTask creates a case task. LIVE MUTATION.

func (*Client) CreateExternalAuthSetting 

func (c *Client) CreateExternalAuthSetting(ctx context.Context, body any) (RawJSON, error)

CreateExternalAuthSetting creates an external auth provider. LIVE MUTATION.

func (*Client) CreateIdpGroupMapping 

func (c *Client) CreateIdpGroupMapping(ctx context.Context, body any) (RawJSON, error)

CreateIdpGroupMapping creates an IdP group mapping. LIVE MUTATION.

func (*Client) CreateIntegrationInstance 

func (c *Client) CreateIntegrationInstance(ctx context.Context, body any) (RawJSON, error)

CreateIntegrationInstance creates a new integration instance. body is the freeform instance payload. LIVE MUTATION.

func (*Client) CreateJobInstance 

func (c *Client) CreateJobInstance(ctx context.Context, body any) (RawJSON, error)

CreateJobInstance adds a new job instance. body is the freeform instance payload. LIVE MUTATION.

func (*Client) CreateManualCase 

func (c *Client) CreateManualCase(ctx context.Context, req ManualCaseRequest) (int, error)

CreateManualCase creates a manual (analyst-authored) case and returns the new SOAR integer case id. It forces the Entities/Playbooks/Tags collections to non-null so the server's missing null-guards cannot 500 after creating the case.

DEVIATION: unlike the freeform single-case actions in cases_actions.go, this is typed — the empty-collection contract is load-bearing (a null trips a server NPE), so the request is modeled rather than left freeform.

func (*Client) CreateWebhook 

func (c *Client) CreateWebhook(ctx context.Context, body any) (RawJSON, error)

CreateWebhook creates a webhook. body is the freeform webhook payload. LIVE MUTATION.

func (*Client) DashboardAddOrUpdate 

func (c *Client) DashboardAddOrUpdate(ctx context.Context, body any) (RawJSON, error)

DashboardAddOrUpdate creates a new dashboard or updates an existing one. body is the freeform dashboard payload. LIVE MUTATION.

func (*Client) DashboardAddOrUpdateWidget 

func (c *Client) DashboardAddOrUpdateWidget(ctx context.Context, body any) (RawJSON, error)

DashboardAddOrUpdateWidget creates a new dashboard widget or updates an existing one. body is the freeform widget payload. LIVE MUTATION.

func (*Client) DashboardDelete 

func (c *Client) DashboardDelete(ctx context.Context, dashboardID int) (RawJSON, error)

DashboardDelete deletes a dashboard by id. This cannot be undone. LIVE MUTATION.

func (*Client) DashboardDeleteWidget 

func (c *Client) DashboardDeleteWidget(ctx context.Context, widgetID int) (RawJSON, error)

DashboardDeleteWidget deletes a dashboard widget by id. This cannot be undone. LIVE MUTATION.

func (*Client) DashboardGetWidgetCaseIds 

func (c *Client) DashboardGetWidgetCaseIds(ctx context.Context, body any) (RawJSON, error)

DashboardGetWidgetCaseIds returns the case ids backing a widget's value. body is the freeform legacy widget-query payload.

func (*Client) DashboardGetWidgetValues 

func (c *Client) DashboardGetWidgetValues(ctx context.Context, body any) (RawJSON, error)

DashboardGetWidgetValues resolves the rendered values for a widget. body is the freeform legacy widget-query payload.

func (*Client) DashboardImport 

func (c *Client) DashboardImport(ctx context.Context, body any) (RawJSON, error)

DashboardImport imports a dashboard from an exported definition. body is the freeform dashboard-import payload. LIVE MUTATION.

func (*Client) DashboardSaveAsReportTemplate 

func (c *Client) DashboardSaveAsReportTemplate(ctx context.Context, body any) (RawJSON, error)

DashboardSaveAsReportTemplate saves a dashboard as a reusable report template. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DashboardWidgetDefinitionList 

func (c *Client) DashboardWidgetDefinitionList(ctx context.Context) (RawJSON, error)

DashboardWidgetDefinitionList returns all available widget definitions (independent of any specific dashboard).

func (*Client) DeleteCaseTask 

func (c *Client) DeleteCaseTask(ctx context.Context, id string) (RawJSON, error)

DeleteCaseTask deletes a case task by id. LIVE MUTATION; cannot be undone.

func (*Client) DeleteConnector 

func (c *Client) DeleteConnector(ctx context.Context, identifier string) (RawJSON, error)

DeleteConnector deletes a connector instance by identifier. LIVE MUTATION; this cannot be undone.

func (*Client) DeleteExternalAuthSetting 

func (c *Client) DeleteExternalAuthSetting(ctx context.Context, id string) (RawJSON, error)

DeleteExternalAuthSetting deletes an external auth provider by id. LIVE MUTATION.

func (*Client) DeleteFamilyData 

func (c *Client) DeleteFamilyData(ctx context.Context, familyID string) (RawJSON, error)

DeleteFamilyData deletes a visual family's data by id. DEVIATION: the legacy route is a GET that mutates — it deletes despite the verb. LIVE MUTATION; this cannot be undone.

func (*Client) DeleteIdpGroupMapping 

func (c *Client) DeleteIdpGroupMapping(ctx context.Context, id string) (RawJSON, error)

DeleteIdpGroupMapping deletes an IdP group mapping by id. LIVE MUTATION.

func (*Client) DeleteIntegrationInstance 

func (c *Client) DeleteIntegrationInstance(ctx context.Context, body any) (RawJSON, error)

DeleteIntegrationInstance deletes an integration instance. body carries the instance id. LIVE MUTATION; this cannot be undone.

func (*Client) DeleteJobData 

func (c *Client) DeleteJobData(ctx context.Context, body any) (RawJSON, error)

DeleteJobData removes a job (definition-level). body carries the job identifier. LIVE MUTATION; this cannot be undone.

func (*Client) DeleteJobInstance 

func (c *Client) DeleteJobInstance(ctx context.Context, id string) (RawJSON, error)

DeleteJobInstance removes a job instance by id. LIVE MUTATION; cannot be undone.

func (*Client) DeleteMappingRule 

func (c *Client) DeleteMappingRule(ctx context.Context, body any) (RawJSON, error)

DeleteMappingRule deletes one mapping rule. body carries its key. LIVE MUTATION.

func (*Client) DeleteNetwork 

func (c *Client) DeleteNetwork(ctx context.Context, identifier string) (RawJSON, error)

DeleteNetwork deletes one network by identifier. LIVE MUTATION.

func (*Client) DeletePermittedNetworks 

func (c *Client) DeletePermittedNetworks(ctx context.Context) (RawJSON, error)

DeletePermittedNetworks deletes the permitted-networks set. LIVE MUTATION.

func (*Client) DeleteVisualFamilyRule 

func (c *Client) DeleteVisualFamilyRule(ctx context.Context, body any) (RawJSON, error)

DeleteVisualFamilyRule deletes one visual family rule. body carries its key. LIVE MUTATION.

func (*Client) DeleteWebhook 

func (c *Client) DeleteWebhook(ctx context.Context, identifier string) (RawJSON, error)

DeleteWebhook deletes a webhook by identifier. LIVE MUTATION; cannot be undone.

func (*Client) DeleteWorkflow 

func (c *Client) DeleteWorkflow(ctx context.Context, body any) (RawJSON, error)

DeleteWorkflow deletes a single workflow definition. body carries its id. LIVE MUTATION; this cannot be undone.

func (*Client) DeleteWorkflows 

func (c *Client) DeleteWorkflows(ctx context.Context, body any) (RawJSON, error)

DeleteWorkflows deletes multiple workflow definitions. body carries the ids. LIVE MUTATION; this cannot be undone.

func (*Client) DownloadAndInstallIntegration 

func (c *Client) DownloadAndInstallIntegration(ctx context.Context, req InstallIntegrationRequest) (RawJSON, error)

DownloadAndInstallIntegration installs one integration package from the store. LIVE MUTATION — adds an integration plus its connector/job/action DEFINITIONS to the tenant. Not reversible via this surface (uninstall is v1alpha-only), so there is no self-cleaning smoke for it.

func (*Client) DuplicateVisualFamilyForSettings 

func (c *Client) DuplicateVisualFamilyForSettings(ctx context.Context, body any) (RawJSON, error)

DuplicateVisualFamilyForSettings clones a visual family. LIVE MUTATION.

func (*Client) DuplicateWorkflow 

func (c *Client) DuplicateWorkflow(ctx context.Context, body any) (RawJSON, error)

DuplicateWorkflow clones one workflow definition. body carries the source id. LIVE MUTATION.

func (*Client) DuplicateWorkflows 

func (c *Client) DuplicateWorkflows(ctx context.Context, body any) (RawJSON, error)

DuplicateWorkflows clones multiple workflow definitions. LIVE MUTATION.

func (*Client) DynamicCaseXAddCaseComment 

func (c *Client) DynamicCaseXAddCaseComment(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXAddCaseComment adds a comment to a case. body is the freeform legacy payload. Deprecated upstream in favour of AddComment. LIVE MUTATION.

func (*Client) DynamicCaseXAddComment 

func (c *Client) DynamicCaseXAddComment(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXAddComment adds a comment (optionally with attachment) to a case. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXAddEvidence 

func (c *Client) DynamicCaseXAddEvidence(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXAddEvidence adds an evidence (attachment) to a case. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXAddOrUpdateTask 

func (c *Client) DynamicCaseXAddOrUpdateTask(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXAddOrUpdateTask adds or updates a task assigned to a user in a case. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXAddTag 

func (c *Client) DynamicCaseXAddTag(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXAddTag adds a tag to a case for later filtering. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXAssignUser 

func (c *Client) DynamicCaseXAssignUser(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXAssignUser assigns a specific user to a case. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXChangeDescription 

func (c *Client) DynamicCaseXChangeDescription(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXChangeDescription changes the description of a case. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXChangeImportanceStatus 

func (c *Client) DynamicCaseXChangeImportanceStatus(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXChangeImportanceStatus changes the "is important" status of a case. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXChangeStage 

func (c *Client) DynamicCaseXChangeStage(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXChangeStage changes the case handling stage. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXClose 

func (c *Client) DynamicCaseXClose(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXClose closes a case. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXCloseAlert 

func (c *Client) DynamicCaseXCloseAlert(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXCloseAlert closes an alert in a case. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXCreate 

func (c *Client) DynamicCaseXCreate(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXCreate injects a case into the Siemplify Data Processing Engine. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXCreateEntity 

func (c *Client) DynamicCaseXCreateEntity(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXCreateEntity manually adds an entity to an alert in a case. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXExecuteBulkReopen 

func (c *Client) DynamicCaseXExecuteBulkReopen(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXExecuteBulkReopen reopens alert cases in bulk. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXGenerateReport 

func (c *Client) DynamicCaseXGenerateReport(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXGenerateReport generates a case report. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXGenerateReportBytes added in v0.7.2 

func (c *Client) DynamicCaseXGenerateReportBytes(ctx context.Context, body any) ([]byte, error)

DynamicCaseXGenerateReportBytes is like DynamicCaseXGenerateReport but returns the raw bytes (the response may be binary content, not JSON).

func (*Client) DynamicCaseXGetWallActivitiesForCommandCenter 

func (c *Client) DynamicCaseXGetWallActivitiesForCommandCenter(ctx context.Context, id int) (RawJSON, error)

DynamicCaseXGetWallActivitiesForCommandCenter returns the wall items (case history) transferred into the Command Center incident, by integer id.

func (*Client) DynamicCaseXMarkTaskDone 

func (c *Client) DynamicCaseXMarkTaskDone(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXMarkTaskDone marks a case task as done by the logged-in user. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXRaiseIncident 

func (c *Client) DynamicCaseXRaiseIncident(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXRaiseIncident raises a case to the "Incident" stage. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXRemoveTag 

func (c *Client) DynamicCaseXRemoveTag(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXRemoveTag removes a tag from a case. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXRename 

func (c *Client) DynamicCaseXRename(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXRename changes the case title. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXRequest 

func (c *Client) DynamicCaseXRequest(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXRequest adds an evidence (attachment) to a case via the request endpoint. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXUnraiseIncident 

func (c *Client) DynamicCaseXUnraiseIncident(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXUnraiseIncident removes the incident flag from a case. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXUpdateAlertPriority 

func (c *Client) DynamicCaseXUpdateAlertPriority(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXUpdateAlertPriority changes the priority of an alert. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicCaseXUpdateCasePriority 

func (c *Client) DynamicCaseXUpdateCasePriority(ctx context.Context, body any) (RawJSON, error)

DynamicCaseXUpdateCasePriority changes the priority of a case. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) DynamicGetCaseDetails 

func (c *Client) DynamicGetCaseDetails(ctx context.Context, caseID int) (RawJSON, error)

DynamicGetCaseDetails returns the modern case-detail blob for a case.

func (*Client) DynamicGetEvidenceData 

func (c *Client) DynamicGetEvidenceData(ctx context.Context, evidenceID string) (RawJSON, error)

DynamicGetEvidenceData returns a piece of case evidence (dynamic surface).

func (*Client) DynamicIsCaseUpdated 

func (c *Client) DynamicIsCaseUpdated(ctx context.Context, body any) (RawJSON, error)

DynamicIsCaseUpdated checks for case changes (dynamic surface).

func (*Client) EntitySearchCount 

func (c *Client) EntitySearchCount(ctx context.Context, body any) (RawJSON, error)

EntitySearchCount returns the total number of entities matching the search request. body is the freeform entity-search request payload.

func (*Client) EntitySearchEverything 

func (c *Client) EntitySearchEverything(ctx context.Context, body any) (RawJSON, error)

EntitySearchEverything runs a search across entities. body is the freeform search request.

func (*Client) EntitySearchListEntities 

func (c *Client) EntitySearchListEntities(ctx context.Context, body any) (RawJSON, error)

EntitySearchListEntities returns a page of entities matching the search request. body is the freeform entity-search request payload (filters, pagination, etc.).

func (*Client) ExecuteManualAction 

func (c *Client) ExecuteManualAction(ctx context.Context, body any) (RawJSON, error)

ExecuteManualAction runs an integration action against a case manually.

func (*Client) ExportOntology 

func (c *Client) ExportOntology(ctx context.Context, body any) (RawJSON, error)

ExportOntology exports the ontology (mapping rules) bundle for storing as code. body selects what to export.

func (*Client) ExportPlaybook 

func (c *Client) ExportPlaybook(ctx context.Context, identifier string) (json.RawMessage, error)

ExportPlaybook returns the full playbook definition (workflow plus all blocks) for the given identifier, as raw JSON to persist verbatim.

GET /playbooks/ExportWorkflowWithBlocksByIdentifier/<identifier>.

func (*Client) ExportPlaybookDefinitions 

func (c *Client) ExportPlaybookDefinitions(ctx context.Context, body any) (RawJSON, error)

ExportPlaybookDefinitions exports a set of playbook definitions. body selects what to export; the result is the portable bundle for storing as code.

func (*Client) ExportStoreUseCase 

func (c *Client) ExportStoreUseCase(ctx context.Context, body any) (RawJSON, error)

ExportStoreUseCase exports a use-case bundle. body selects what to export.

func (*Client) ExportVisualFamily 

func (c *Client) ExportVisualFamily(ctx context.Context, body any) (RawJSON, error)

ExportVisualFamily exports a visual family bundle for storing as code.

func (*Client) ExportWebhookLogs 

func (c *Client) ExportWebhookLogs(ctx context.Context, identifier string) (RawJSON, error)

ExportWebhookLogs exports a webhook's logs.

func (*Client) ExportWorkflowWithBlocks 

func (c *Client) ExportWorkflowWithBlocks(ctx context.Context, apiWfIdentifier string) (RawJSON, error)

ExportWorkflowWithBlocks exports one workflow (with its nested blocks) by identifier — the portable definition for storing as code.

func (*Client) FederationBatchPatchCases 

func (c *Client) FederationBatchPatchCases(ctx context.Context, body any) (RawJSON, error)

FederationBatchPatchCases applies a batch of partial updates to federated cases. body is the freeform legacy patch payload. LIVE MUTATION.

func (*Client) FederationDeletePlatform 

func (c *Client) FederationDeletePlatform(ctx context.Context, id int) (RawJSON, error)

FederationDeletePlatform removes a federated platform by its numeric id. LIVE MUTATION; this cannot be undone.

func (*Client) FederationListCases 

func (c *Client) FederationListCases(ctx context.Context, continuationToken string, pageSize int) (RawJSON, error)

FederationListCases returns federated cases, paginated. continuationToken is the opaque cursor from a prior page (empty for the first page); pageSize caps the number of cases returned (<=0 omits it, letting the server default apply).

func (*Client) FederationListPlatforms 

func (c *Client) FederationListPlatforms(ctx context.Context) (RawJSON, error)

FederationListPlatforms returns the platforms federated with this instance.

func (*Client) FetchConnectorSampleData 

func (c *Client) FetchConnectorSampleData(ctx context.Context, body any) (RawJSON, error)

FetchConnectorSampleData executes a connector once for testing and returns the sample it produced. body is the freeform connector payload. This RUNS the connector against its live source — use only on connectors you intend to test.

func (*Client) GetActionResult 

func (c *Client) GetActionResult(ctx context.Context, resultID string) (RawJSON, error)

GetActionResult returns a stored action result by its (string) id.

func (*Client) GetAlertEvents 

func (c *Client) GetAlertEvents(ctx context.Context, body any) (RawJSON, error)

GetAlertEvents returns the events of an alert. body selects the alert.

func (*Client) GetAlertNames 

func (c *Client) GetAlertNames(ctx context.Context, body any) (RawJSON, error)

GetAlertNames returns the distinct alert names in the queue. body is the freeform filter payload.

func (*Client) GetAllModelBlockRecords 

func (c *Client) GetAllModelBlockRecords(ctx context.Context) (RawJSON, error)

GetAllModelBlockRecords returns every block-list (model block) record.

func (*Client) GetBlockListDetails 

func (c *Client) GetBlockListDetails(ctx context.Context, body any) (RawJSON, error)

GetBlockListDetails returns details for specific block-list records. body is the freeform selector payload.

func (*Client) GetCaseAssignmentPolicySettings 

func (c *Client) GetCaseAssignmentPolicySettings(ctx context.Context) (RawJSON, error)

GetCaseAssignmentPolicySettings returns the case auto-assignment policy.

func (*Client) GetCaseExists 

func (c *Client) GetCaseExists(ctx context.Context, caseID int) (RawJSON, error)

GetCaseExists reports whether a case id exists.

func (*Client) GetCaseFullDetails 

func (c *Client) GetCaseFullDetails(ctx context.Context, caseID int) (json.RawMessage, error)

GetCaseFullDetails returns the full legacy detail blob for one case. caseID is the SOAR INTEGER case id (see the dual case-id gotcha above). The shape is large and unstable, so it is returned raw.

func (*Client) GetCaseInsights 

func (c *Client) GetCaseInsights(ctx context.Context, caseID int) (RawJSON, error)

GetCaseInsights returns the insights attached to a case.

func (*Client) GetCaseStageDefinitionRecords 

func (c *Client) GetCaseStageDefinitionRecords(ctx context.Context, body any) (RawJSON, error)

GetCaseStageDefinitionRecords returns the case-stage definitions. body is the freeform filter payload.

func (*Client) GetCaseTask 

func (c *Client) GetCaseTask(ctx context.Context, id string) (RawJSON, error)

GetCaseTask returns one case task by id.

func (*Client) GetCaseWall 

func (c *Client) GetCaseWall(ctx context.Context, caseID int) (RawJSON, error)

GetCaseWall returns the case wall (timeline of items) for a case.

func (*Client) GetCaseWallActivities 

func (c *Client) GetCaseWallActivities(ctx context.Context, body any) (RawJSON, error)

GetCaseWallActivities returns filtered case-wall activities. body is the freeform filter payload.

func (*Client) GetCaseWallActivitiesCount 

func (c *Client) GetCaseWallActivitiesCount(ctx context.Context, body any) (RawJSON, error)

GetCaseWallActivitiesCount returns the count of matching wall activities.

func (*Client) GetCasesFilterUserAndRoles 

func (c *Client) GetCasesFilterUserAndRoles(ctx context.Context, body any) (RawJSON, error)

GetCasesFilterUserAndRoles returns the user/role filter values for case search.

func (*Client) GetCasesFilterValues 

func (c *Client) GetCasesFilterValues(ctx context.Context, body any) (RawJSON, error)

GetCasesFilterValues returns the available case-search filter values.

func (*Client) GetConnector 

func (c *Client) GetConnector(ctx context.Context, identifier string) (RawJSON, error)

GetConnector returns the full configuration of one connector instance by its identifier (the connector instance id, a string).

func (*Client) GetConnectorStatistics 

func (c *Client) GetConnectorStatistics(ctx context.Context, identifier string) (RawJSON, error)

GetConnectorStatistics returns runtime statistics for one connector instance.

func (*Client) GetConnectorTemplate 

func (c *Client) GetConnectorTemplate(ctx context.Context, body any) (RawJSON, error)

GetConnectorTemplate returns detailed info for a specific connector definition. body selects the template (freeform legacy payload).

func (*Client) GetEntitiesFilterValues 

func (c *Client) GetEntitiesFilterValues(ctx context.Context, body any) (RawJSON, error)

GetEntitiesFilterValues returns the available entity-search filter values.

func (*Client) GetEnvironmentInstanceUrls 

func (c *Client) GetEnvironmentInstanceUrls(ctx context.Context) (RawJSON, error)

GetEnvironmentInstanceUrls returns the per-environment instance URLs.

func (*Client) GetEnvironmentLoadBalancingStatus 

func (c *Client) GetEnvironmentLoadBalancingStatus(ctx context.Context) (RawJSON, error)

GetEnvironmentLoadBalancingStatus returns whether load balancing is on.

func (*Client) GetEnvironmentPriorities 

func (c *Client) GetEnvironmentPriorities(ctx context.Context) (RawJSON, error)

GetEnvironmentPriorities returns the environment priority ordering.

func (*Client) GetEnvironmentPriority 

func (c *Client) GetEnvironmentPriority(ctx context.Context, environment string) (RawJSON, error)

GetEnvironmentPriority returns one environment's priority.

func (*Client) GetEnvironments 

func (c *Client) GetEnvironments(ctx context.Context, body any) (RawJSON, error)

GetEnvironments returns the configured environments. body is the freeform filter payload.

func (*Client) GetEvidenceData 

func (c *Client) GetEvidenceData(ctx context.Context, evidenceID string) (RawJSON, error)

GetEvidenceData returns a piece of case evidence by id.

func (*Client) GetExternalAuthSetting 

func (c *Client) GetExternalAuthSetting(ctx context.Context, id string) (RawJSON, error)

GetExternalAuthSetting returns one external auth provider by id.

func (*Client) GetHtmlViewPresets 

func (c *Client) GetHtmlViewPresets(ctx context.Context) (RawJSON, error)

GetHtmlViewPresets returns the store HTML view presets.

func (*Client) GetIdpGroupMapping 

func (c *Client) GetIdpGroupMapping(ctx context.Context, id string) (RawJSON, error)

GetIdpGroupMapping returns one IdP group mapping by id.

func (*Client) GetIdpGroupMappingCount 

func (c *Client) GetIdpGroupMappingCount(ctx context.Context) (RawJSON, error)

GetIdpGroupMappingCount returns the number of IdP group mappings.

func (*Client) GetIntegrationDefaultInstance 

func (c *Client) GetIntegrationDefaultInstance(ctx context.Context, integrationIdentifier string) (RawJSON, error)

GetIntegrationDefaultInstance returns the default instance of an integration, keyed by the integration identifier.

func (*Client) GetIntegrationInstanceSettings 

func (c *Client) GetIntegrationInstanceSettings(ctx context.Context, integrationInstanceID string) (RawJSON, error)

GetIntegrationInstanceSettings returns the settings of one integration instance.

func (*Client) GetIntegrationsStoreData 

func (c *Client) GetIntegrationsStoreData(ctx context.Context, staging bool) (RawJSON, error)

GetIntegrationsStoreData returns the integrations available in the store. staging selects the staging catalog.

func (*Client) GetMetadata added in v0.7.1 

func (c *Client) GetMetadata(ctx context.Context) (RawJSON, error)

GetMetadata returns instance-wide metadata (case stages, users, alert types, assignment policy, environment type).

func (*Client) GetMoveCaseBetweenEnvironmentsPolicySettings 

func (c *Client) GetMoveCaseBetweenEnvironmentsPolicySettings(ctx context.Context) (RawJSON, error)

GetMoveCaseBetweenEnvironmentsPolicySettings returns the cross-environment case-move policy.

func (*Client) GetNetworkDetails 

func (c *Client) GetNetworkDetails(ctx context.Context, body any) (RawJSON, error)

GetNetworkDetails returns the configured network records. body is the freeform filter payload.

func (*Client) GetPackageDetails 

func (c *Client) GetPackageDetails(ctx context.Context, body any) (RawJSON, error)

GetPackageDetails returns a store package's details prior to install. body is the freeform selector the UI sends (the package identifier/version). Read-only.

func (*Client) GetPlaybook 

func (c *Client) GetPlaybook(ctx context.Context, identifier string) (Playbook, error)

GetPlaybook fetches a full playbook definition by its workflow identifier.

func (*Client) GetPlaybookByName 

func (c *Client) GetPlaybookByName(ctx context.Context, name string, enabledOnly bool) (Playbook, error)

GetPlaybookByName lists the menu cards, matches on Name, and reads the full definition. When enabledOnly is set, disabled cards are skipped.

DEVIATION: the listing carries no full body, so this is a two-call helper (list then read) rather than a single round-trip.

func (*Client) GetPlaybookStats 

func (c *Client) GetPlaybookStats(ctx context.Context, body any) (json.RawMessage, error)

GetPlaybookStats returns the playbook stats map. body is a freeform request payload; the server echo is returned.

func (*Client) GetPlaybooksUsingInstance 

func (c *Client) GetPlaybooksUsingInstance(ctx context.Context, integrationInstanceID string) (RawJSON, error)

GetPlaybooksUsingInstance returns the names of playbooks that use a specific integration instance (useful before changing or deleting it).

func (*Client) GetPowerUpsStoreData 

func (c *Client) GetPowerUpsStoreData(ctx context.Context) (RawJSON, error)

GetPowerUpsStoreData returns the power-ups available in the store.

func (*Client) GetProxySettings 

func (c *Client) GetProxySettings(ctx context.Context) (RawJSON, error)

GetProxySettings returns the outbound proxy configuration.

func (*Client) GetPublicCertificate 

func (c *Client) GetPublicCertificate(ctx context.Context) (RawJSON, error)

GetPublicCertificate returns the platform's public certificate.

func (*Client) GetRelatedEntitiesByFamilyName 

func (c *Client) GetRelatedEntitiesByFamilyName(ctx context.Context, familyName string) (RawJSON, error)

GetRelatedEntitiesByFamilyName returns the entities related to a visual family.

func (*Client) GetReportsStoreData 

func (c *Client) GetReportsStoreData(ctx context.Context) (RawJSON, error)

GetReportsStoreData returns the reports available in the store.

func (*Client) GetRootCauseCloseRecords 

func (c *Client) GetRootCauseCloseRecords(ctx context.Context) (RawJSON, error)

GetRootCauseCloseRecords returns the close root-cause options.

func (*Client) GetSearchResultsAsCsv 

func (c *Client) GetSearchResultsAsCsv(ctx context.Context, body any) (RawJSON, error)

GetSearchResultsAsCsv runs a search and returns the results as CSV. body is the freeform search request.

func (*Client) GetSlaDefinitions 

func (c *Client) GetSlaDefinitions(ctx context.Context, body any) (RawJSON, error)

GetSlaDefinitions returns filtered SLA definitions. body is the filter payload.

func (*Client) GetSlaDefinitionsRecords 

func (c *Client) GetSlaDefinitionsRecords(ctx context.Context) (RawJSON, error)

GetSlaDefinitionsRecords returns every SLA definition.

func (*Client) GetStoreIntegrationDependencies 

func (c *Client) GetStoreIntegrationDependencies(ctx context.Context, integrationIdentifier string) (RawJSON, error)

GetStoreIntegrationDependencies returns a store integration's dependencies.

func (*Client) GetStoreIntegrationFullDetails 

func (c *Client) GetStoreIntegrationFullDetails(ctx context.Context, body any) (RawJSON, error)

GetStoreIntegrationFullDetails returns full details for a store integration. body selects the integration.

func (*Client) GetSystemEventEntityTypes 

func (c *Client) GetSystemEventEntityTypes(ctx context.Context) (RawJSON, error)

GetSystemEventEntityTypes returns the system's event entity types.

func (*Client) GetSystemVersion 

func (c *Client) GetSystemVersion(ctx context.Context) (RawJSON, error)

GetSystemVersion returns the SOAR platform version.

func (*Client) GetTagDefinitionNames 

func (c *Client) GetTagDefinitionNames(ctx context.Context) (RawJSON, error)

GetTagDefinitionNames returns the defined tag names.

func (*Client) GetTagDefinitionsRecords 

func (c *Client) GetTagDefinitionsRecords(ctx context.Context, body any) (RawJSON, error)

GetTagDefinitionsRecords returns the tag definitions. body is the filter payload.

func (*Client) GetTrackingListRecords 

func (c *Client) GetTrackingListRecords(ctx context.Context) (RawJSON, error)

GetTrackingListRecords returns every tracking-list record.

func (*Client) GetTrackingListRecordsFiltered 

func (c *Client) GetTrackingListRecordsFiltered(ctx context.Context, body any) (RawJSON, error)

GetTrackingListRecordsFiltered returns filtered tracking-list records. body is the freeform filter payload.

func (*Client) GetUsecasesCards 

func (c *Client) GetUsecasesCards(ctx context.Context) (RawJSON, error)

GetUsecasesCards returns the use-case cards in the store.

func (*Client) GetVisualFamily 

func (c *Client) GetVisualFamily(ctx context.Context, body any) (RawJSON, error)

GetVisualFamily returns one visual family. body carries its selector.

func (*Client) GetWallActivities 

func (c *Client) GetWallActivities(ctx context.Context, caseID int) (RawJSON, error)

GetWallActivities returns the case-wall activities for a case.

func (*Client) GetWallActivitiesV2 

func (c *Client) GetWallActivitiesV2(ctx context.Context, caseID int) (RawJSON, error)

GetWallActivitiesV2 returns the v2 case-wall activities for a case.

func (*Client) GetWebhook 

func (c *Client) GetWebhook(ctx context.Context, identifier string) (RawJSON, error)

GetWebhook returns one webhook by identifier.

func (*Client) GetWebhookLogs 

func (c *Client) GetWebhookLogs(ctx context.Context, webhookIdentifier, minimumLogLevel string) (RawJSON, error)

GetWebhookLogs returns webhook logs, optionally filtered by webhook identifier and minimum log level (both may be empty).

func (*Client) GetWebhookStatistics 

func (c *Client) GetWebhookStatistics(ctx context.Context, identifier string) (RawJSON, error)

GetWebhookStatistics returns runtime statistics for a webhook.

func (*Client) GetWorkflowFullInfo 

func (c *Client) GetWorkflowFullInfo(ctx context.Context, apiWfIdentifier string) (RawJSON, error)

GetWorkflowFullInfo returns the full definition of one workflow by its api workflow identifier.

func (*Client) GetWorkflowFullInfoWithEnvFilter 

func (c *Client) GetWorkflowFullInfoWithEnvFilter(ctx context.Context, apiWfIdentifier string) (RawJSON, error)

GetWorkflowFullInfoWithEnvFilter is GetWorkflowFullInfo scoped to the caller's environment filter.

func (*Client) GetWorkflowInstance added in v0.7.2 

func (c *Client) GetWorkflowInstance(ctx context.Context, body any) (RawJSON, error)

GetWorkflowInstance returns the full step-by-step execution detail for one playbook run. body carries: caseId (string), alertIdentifier, definitionIdentifier, shouldFetchSteps, collapseBlocks, loopsRequestedIterations.

func (*Client) GetWorkflowInstanceSummary 

func (c *Client) GetWorkflowInstanceSummary(ctx context.Context, body any) (RawJSON, error)

GetWorkflowInstanceSummary returns the playbook-run summary for a case. body carries the case/alert selector.

func (*Client) GetWorkflowInstancesCards added in v0.7.2 

func (c *Client) GetWorkflowInstancesCards(ctx context.Context, body any) (RawJSON, error)

GetWorkflowInstancesCards returns the playbook execution cards for a case+alert. body carries: caseId (string), alertIdentifier.

func (*Client) GetWorkflowVersionLogs 

func (c *Client) GetWorkflowVersionLogs(ctx context.Context, body any) (RawJSON, error)

GetWorkflowVersionLogs returns the version history of workflow definitions. body is the freeform selector payload.

func (*Client) HomepageCreateAttachment 

func (c *Client) HomepageCreateAttachment(ctx context.Context, body any) (RawJSON, error)

HomepageCreateAttachment adds a homepage attachment widget. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) HomepageCreateContact 

func (c *Client) HomepageCreateContact(ctx context.Context, body any) (RawJSON, error)

HomepageCreateContact adds a homepage contact widget. body is the freeform legacy payload. LIVE MUTATION. 

func (c *Client) HomepageCreateLink(ctx context.Context, body any) (RawJSON, error)

HomepageCreateLink adds a homepage link widget. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) HomepageCreateNote 

func (c *Client) HomepageCreateNote(ctx context.Context, body any) (RawJSON, error)

HomepageCreateNote adds a homepage note widget. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) HomepageCreateRss 

func (c *Client) HomepageCreateRss(ctx context.Context, body any) (RawJSON, error)

HomepageCreateRss adds a homepage RSS-feed widget. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) HomepageDeleteAttachment 

func (c *Client) HomepageDeleteAttachment(ctx context.Context, id int) (RawJSON, error)

HomepageDeleteAttachment deletes one homepage attachment widget by id. LIVE MUTATION; this cannot be undone.

func (*Client) HomepageDeleteContact 

func (c *Client) HomepageDeleteContact(ctx context.Context, id int) (RawJSON, error)

HomepageDeleteContact deletes one homepage contact widget by id. LIVE MUTATION; this cannot be undone. 

func (c *Client) HomepageDeleteLink(ctx context.Context, id int) (RawJSON, error)

HomepageDeleteLink deletes one homepage link widget by id. LIVE MUTATION; this cannot be undone.

func (*Client) HomepageDeleteNote 

func (c *Client) HomepageDeleteNote(ctx context.Context, id int) (RawJSON, error)

HomepageDeleteNote deletes one homepage note widget by id. LIVE MUTATION; this cannot be undone.

func (*Client) HomepageDeleteRss 

func (c *Client) HomepageDeleteRss(ctx context.Context, id int) (RawJSON, error)

HomepageDeleteRss deletes one homepage RSS-feed widget by id. LIVE MUTATION; this cannot be undone.

func (*Client) HomepageGetAttachment 

func (c *Client) HomepageGetAttachment(ctx context.Context, id int) (RawJSON, error)

HomepageGetAttachment returns one homepage attachment widget by id.

func (*Client) HomepageGetCasesCount deprecated 

func (c *Client) HomepageGetCasesCount(ctx context.Context) (RawJSON, error)

HomepageGetCasesCount returns the count of cases shown on the homepage.

Deprecated: the /cases/homepagecases endpoints return a server-side HTTP 500 (errorCode 2000) — the homepage-cases feature appears to be unprovisioned or broken on the backend, not in this SDK. The request is well-formed; the server errors. Kept for surface completeness; do not rely on it. Use GetCaseExists / the case-queue endpoints instead.

func (*Client) HomepageGetContact 

func (c *Client) HomepageGetContact(ctx context.Context, id int) (RawJSON, error)

HomepageGetContact returns one homepage contact widget by id. 

func (c *Client) HomepageGetLink(ctx context.Context, id int) (RawJSON, error)

HomepageGetLink returns one homepage link widget by id.

func (*Client) HomepageGetNote 

func (c *Client) HomepageGetNote(ctx context.Context, id int) (RawJSON, error)

HomepageGetNote returns one homepage note widget by id.

func (*Client) HomepageGetRss 

func (c *Client) HomepageGetRss(ctx context.Context, id int) (RawJSON, error)

HomepageGetRss returns one homepage RSS-feed widget by id.

func (*Client) HomepageGetRssCount 

func (c *Client) HomepageGetRssCount(ctx context.Context) (RawJSON, error)

HomepageGetRssCount returns the count of homepage RSS-feed widgets.

func (*Client) HomepageListAttachments 

func (c *Client) HomepageListAttachments(ctx context.Context, requestedPage, pageSize int, searchTerm string) (RawJSON, error)

HomepageListAttachments returns a paged list of homepage attachment widgets.

func (*Client) HomepageListCases deprecated 

func (c *Client) HomepageListCases(ctx context.Context, requestedPage, pageSize int, searchTerm string, extra url.Values) (RawJSON, error)

HomepageListCases returns the homepage case list for a filtered/paged request. extra carries the optional Filters/SlaFilters/PriorityFilters/SortBy query values; pass nil for none.

Deprecated: the /cases/homepagecases endpoints return a server-side HTTP 500 (errorCode 2000) — the homepage-cases feature appears to be unprovisioned or broken on the backend, not in this SDK. The request is well-formed; the server errors. Kept for surface completeness; do not rely on it. Use the case-queue / search endpoints instead.

func (*Client) HomepageListContacts 

func (c *Client) HomepageListContacts(ctx context.Context, requestedPage, pageSize int, searchTerm string) (RawJSON, error)

HomepageListContacts returns a paged list of homepage contact widgets. 

func (c *Client) HomepageListLinks(ctx context.Context, requestedPage, pageSize int, searchTerm string) (RawJSON, error)

HomepageListLinks returns a paged list of homepage link widgets.

func (*Client) HomepageListNotes 

func (c *Client) HomepageListNotes(ctx context.Context, requestedPage, pageSize int, searchTerm string) (RawJSON, error)

HomepageListNotes returns a paged list of homepage note widgets.

func (*Client) HomepageListRss 

func (c *Client) HomepageListRss(ctx context.Context, requestedPage, pageSize int, searchTerm string) (RawJSON, error)

HomepageListRss returns a paged list of homepage RSS-feed widgets.

func (*Client) HomepageUpdateAttachment 

func (c *Client) HomepageUpdateAttachment(ctx context.Context, body any) (RawJSON, error)

HomepageUpdateAttachment updates a homepage attachment widget. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) HomepageUpdateContact 

func (c *Client) HomepageUpdateContact(ctx context.Context, body any) (RawJSON, error)

HomepageUpdateContact updates a homepage contact widget. body is the freeform legacy payload. LIVE MUTATION. 

func (c *Client) HomepageUpdateLink(ctx context.Context, body any) (RawJSON, error)

HomepageUpdateLink updates a homepage link widget. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) HomepageUpdateNote 

func (c *Client) HomepageUpdateNote(ctx context.Context, body any) (RawJSON, error)

HomepageUpdateNote updates a homepage note widget. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) HomepageUpdateRss 

func (c *Client) HomepageUpdateRss(ctx context.Context, body any) (RawJSON, error)

HomepageUpdateRss updates a homepage RSS-feed widget. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) IdpMappingCreate 

func (c *Client) IdpMappingCreate(ctx context.Context, body any) (RawJSON, error)

IdpMappingCreate creates an IdP group mapping. body is the freeform CreateManagementIdpGroupMapperDto payload. LIVE MUTATION.

func (*Client) IdpMappingList 

func (c *Client) IdpMappingList(ctx context.Context, externalProviderName string) (RawJSON, error)

IdpMappingList returns the configured IdP group mappings for an external identity provider. externalProviderName selects the provider (e.g. "SecOps"); pass "" to use the server default.

func (*Client) ImportOntology 

func (c *Client) ImportOntology(ctx context.Context, body any) (RawJSON, error)

ImportOntology imports a previously exported ontology bundle. LIVE MUTATION.

func (*Client) ImportPlaybookDefinitions 

func (c *Client) ImportPlaybookDefinitions(ctx context.Context, body any) (RawJSON, error)

ImportPlaybookDefinitions imports a previously exported definition bundle. LIVE MUTATION.

func (*Client) ImportVisualFamily 

func (c *Client) ImportVisualFamily(ctx context.Context, body any) (RawJSON, error)

ImportVisualFamily imports a previously exported visual family. LIVE MUTATION.

func (*Client) IngestCaseInOtherEnvironment 

func (c *Client) IngestCaseInOtherEnvironment(ctx context.Context, body any) (RawJSON, error)

IngestCaseInOtherEnvironment moves/ingests a case into another environment. LIVE MUTATION.

func (*Client) IsCaseUpdated 

func (c *Client) IsCaseUpdated(ctx context.Context, body any) (RawJSON, error)

IsCaseUpdated checks whether cases changed since a prior snapshot. body carries the case ids and timestamps.

func (*Client) IsPermittedToEnvironment 

func (c *Client) IsPermittedToEnvironment(ctx context.Context, environmentName string) (RawJSON, error)

IsPermittedToEnvironment reports whether the caller may access an environment.

func (*Client) IsVisualFamilyExists 

func (c *Client) IsVisualFamilyExists(ctx context.Context, body any) (RawJSON, error)

IsVisualFamilyExists reports whether a visual family already exists. body carries the name.

func (*Client) ListAPIKeys 

func (c *Client) ListAPIKeys(ctx context.Context) ([]APIKey, error)

ListAPIKeys returns the SOAR external-API keys as metadata (no secret value). GET /settings/GetApiKeys. Read-only.

func (*Client) ListAlertVendors 

func (c *Client) ListAlertVendors(ctx context.Context) (RawJSON, error)

ListAlertVendors returns the alert vendors seen in the queue.

func (*Client) ListCaseCards 

func (c *Client) ListCaseCards(ctx context.Context, req CaseQueueRequest) (json.RawMessage, error)

ListCaseCards returns the case-queue cards matching req. The response is the raw legacy page payload (cards plus a total count); decode the slice of cards the caller needs. Page with req.RequestedPage / req.PageSize.

func (*Client) ListConnectorCards 

func (c *Client) ListConnectorCards(ctx context.Context) (RawJSON, error)

ListConnectorCards returns basic info for each accessible connector instance.

func (*Client) ListConnectorTemplateCards 

func (c *Client) ListConnectorTemplateCards(ctx context.Context) (RawJSON, error)

ListConnectorTemplateCards returns basic info for each connector *definition* (template) available to configure instances from.

func (*Client) ListEnabledPlaybooks 

func (c *Client) ListEnabledPlaybooks(ctx context.Context) (json.RawMessage, error)

ListEnabledPlaybooks returns the enabled playbook "WF cards" (the lightweight catalog entries used to drive an export). The body is the raw response JSON.

POST /playbooks/GetEnabledWFCards with an empty object body.

func (*Client) ListEnabledWorkflowCards 

func (c *Client) ListEnabledWorkflowCards(ctx context.Context, body any) (RawJSON, error)

ListEnabledWorkflowCards returns summary cards for enabled workflows. body is the freeform filter payload.

func (*Client) ListEnvironmentCards 

func (c *Client) ListEnvironmentCards(ctx context.Context, body any) (RawJSON, error)

ListEnvironmentCards returns the environments as summary cards. body is the freeform filter payload.

func (*Client) ListEnvironmentInstalledIntegrations 

func (c *Client) ListEnvironmentInstalledIntegrations(ctx context.Context, body any) (RawJSON, error)

ListEnvironmentInstalledIntegrations returns the installed integrations per environment. body is the freeform filter payload.

func (*Client) ListExternalAuthSettings 

func (c *Client) ListExternalAuthSettings(ctx context.Context) (RawJSON, error)

ListExternalAuthSettings returns every external authentication provider.

func (*Client) ListIdpGroupMappings 

func (c *Client) ListIdpGroupMappings(ctx context.Context) (RawJSON, error)

ListIdpGroupMappings returns every IdP group-to-role mapping.

func (*Client) ListInstalledIntegrations 

func (c *Client) ListInstalledIntegrations(ctx context.Context) (RawJSON, error)

ListInstalledIntegrations returns every installed integration in the platform.

func (*Client) ListInstalledJobs 

func (c *Client) ListInstalledJobs(ctx context.Context) (RawJSON, error)

ListInstalledJobs returns every installed job in the platform.

func (*Client) ListJobInstances 

func (c *Client) ListJobInstances(ctx context.Context) (RawJSON, error)

ListJobInstances returns every configured job instance.

func (*Client) ListJobTemplates 

func (c *Client) ListJobTemplates(ctx context.Context) (RawJSON, error)

ListJobTemplates returns the configurable job templates in the system.

func (*Client) ListMappingRules 

func (c *Client) ListMappingRules(ctx context.Context, body any) (RawJSON, error)

ListMappingRules returns the ontology mapping rules. body is the freeform selector payload (source/product/event filters).

func (*Client) ListOptionalIntegrationInstances 

func (c *Client) ListOptionalIntegrationInstances(ctx context.Context, body any) (RawJSON, error)

ListOptionalIntegrationInstances returns the instances available for a specific integration. body is the freeform selector payload.

func (*Client) ListPlaybooks 

func (c *Client) ListPlaybooks(ctx context.Context, types []string) ([]PlaybookCard, error)

ListPlaybooks returns the playbook menu cards. types filters the card kinds; it defaults to ["NESTED","REGULAR"] when empty.

func (*Client) ListSavedFilters 

func (c *Client) ListSavedFilters(ctx context.Context) (RawJSON, error)

ListSavedFilters returns the saved case-queue filters.

func (*Client) ListUserProfiles added in v0.1.1 

func (c *Client) ListUserProfiles(ctx context.Context) ([]UserProfile, error)

ListUserProfiles returns the SOAR user directory as a typed view (over SettingXGetUserProfiles) — the assignee lookup `soar case assign --user` needs, since the case read shows an assignee's display NAME but not the id. Read-only; metadata only (no image, no secret). It pages through every user (no silent truncation), bounded by a runaway backstop.

func (*Client) ListVisualFamilies 

func (c *Client) ListVisualFamilies(ctx context.Context) (RawJSON, error)

ListVisualFamilies returns every visual family.

func (*Client) ListWebhookCards 

func (c *Client) ListWebhookCards(ctx context.Context) (RawJSON, error)

ListWebhookCards returns summary cards for every webhook.

func (*Client) ListWorkflowCategories 

func (c *Client) ListWorkflowCategories(ctx context.Context) (RawJSON, error)

ListWorkflowCategories returns every playbook (workflow) category.

func (*Client) MarkCaseTaskDone 

func (c *Client) MarkCaseTaskDone(ctx context.Context, body any) (RawJSON, error)

MarkCaseTaskDone marks a case task done. body carries the task id. LIVE MUTATION.

func (*Client) MarkCommentAsDeleted 

func (c *Client) MarkCommentAsDeleted(ctx context.Context, id string) (RawJSON, error)

MarkCommentAsDeleted soft-deletes a case comment by id. LIVE MUTATION.

func (*Client) MergeCases 

func (c *Client) MergeCases(ctx context.Context, body any) (RawJSON, error)

MergeCases merges multiple cases into one. body carries the source/target ids.

func (*Client) MoveAlertToNewCase 

func (c *Client) MoveAlertToNewCase(ctx context.Context, body any) (RawJSON, error)

MoveAlertToNewCase splits an alert out into a new case. LIVE MUTATION.

func (*Client) MoveDefinitionsToCategory 

func (c *Client) MoveDefinitionsToCategory(ctx context.Context, body any) (RawJSON, error)

MoveDefinitionsToCategory moves workflow definitions into a category. body carries the definition ids and target category. LIVE MUTATION.

func (*Client) NotificationCloseAll 

func (c *Client) NotificationCloseAll(ctx context.Context) (RawJSON, error)

NotificationCloseAll dismisses all of the current user's notifications. Modeled upstream as a GET. LIVE MUTATION.

func (*Client) NotificationCloseSystem 

func (c *Client) NotificationCloseSystem(ctx context.Context, recordID int) (RawJSON, error)

NotificationCloseSystem dismisses one system notification by its record id. Modeled upstream as a GET. LIVE MUTATION.

func (*Client) NotificationCloseUser 

func (c *Client) NotificationCloseUser(ctx context.Context, recordID int) (RawJSON, error)

NotificationCloseUser dismisses one user notification by its record id. Modeled upstream as a GET. LIVE MUTATION.

func (*Client) NotificationGetUnreadCount 

func (c *Client) NotificationGetUnreadCount(ctx context.Context) (RawJSON, error)

NotificationGetUnreadCount returns the count of unread notifications.

func (*Client) NotificationGetUserSettings 

func (c *Client) NotificationGetUserSettings(ctx context.Context) (RawJSON, error)

NotificationGetUserSettings returns the current user's notification settings.

func (*Client) NotificationListUser 

func (c *Client) NotificationListUser(ctx context.Context) (RawJSON, error)

NotificationListUser returns the current user's notifications.

func (*Client) NotificationSaveUserSettings 

func (c *Client) NotificationSaveUserSettings(ctx context.Context, body any) (RawJSON, error)

NotificationSaveUserSettings updates the current user's notification settings. body is the freeform settings payload. LIVE MUTATION.

func (*Client) OntologyOrVisualFamilyExists 

func (c *Client) OntologyOrVisualFamilyExists(ctx context.Context, body any) (RawJSON, error)

OntologyOrVisualFamilyExists reports whether an ontology record or visual family already exists (a pre-write existence check). body carries the key.

func (*Client) PatchExternalAuthSetting 

func (c *Client) PatchExternalAuthSetting(ctx context.Context, id string, body any) (RawJSON, error)

PatchExternalAuthSetting partially updates an external auth provider by id. LIVE MUTATION.

func (*Client) PermissionAddOrUpdate 

func (c *Client) PermissionAddOrUpdate(ctx context.Context, body any) (RawJSON, error)

PermissionAddOrUpdate creates a new permission group or updates an existing one. body is the freeform permission-group payload. LIVE MUTATION.

func (*Client) PermissionDelete 

func (c *Client) PermissionDelete(ctx context.Context, id int) (RawJSON, error)

PermissionDelete deletes a permission group by id. LIVE MUTATION; this cannot be undone.

func (*Client) PermissionDuplicate 

func (c *Client) PermissionDuplicate(ctx context.Context, id int) (RawJSON, error)

PermissionDuplicate clones an existing permission group by id, returning the new group. LIVE MUTATION.

func (*Client) PermissionGet 

func (c *Client) PermissionGet(ctx context.Context, id int) (RawJSON, error)

PermissionGet returns the full configuration of one permission group by id.

func (*Client) PermissionGetAllEnvironmentStatus 

func (c *Client) PermissionGetAllEnvironmentStatus(ctx context.Context) (RawJSON, error)

PermissionGetAllEnvironmentStatus returns per-environment status across all permission groups.

func (*Client) PermissionGetEnvironmentStatusByGroup 

func (c *Client) PermissionGetEnvironmentStatusByGroup(ctx context.Context, permissionGroupID int) (RawJSON, error)

PermissionGetEnvironmentStatusByGroup returns per-environment status for one permission group by its id.

func (*Client) PermissionGetGroupTemplateByType 

func (c *Client) PermissionGetGroupTemplateByType(ctx context.Context, permissionType int) (RawJSON, error)

PermissionGetGroupTemplateByType returns the permission-group template for a given permission type.

func (*Client) PermissionListGroupCards 

func (c *Client) PermissionListGroupCards(ctx context.Context) (RawJSON, error)

PermissionListGroupCards returns basic info for each permission group.

func (*Client) PermissionListGroupTypes 

func (c *Client) PermissionListGroupTypes(ctx context.Context) (RawJSON, error)

PermissionListGroupTypes returns the available permission-group types.

func (*Client) PermissionUpdate 

func (c *Client) PermissionUpdate(ctx context.Context, body any) (RawJSON, error)

PermissionUpdate updates an existing permission group. body is the freeform permission-group payload. LIVE MUTATION.

func (*Client) PlaybookXCheckNameInDifferentEnvironments 

func (c *Client) PlaybookXCheckNameInDifferentEnvironments(ctx context.Context, body any) (RawJSON, error)

PlaybookXCheckNameInDifferentEnvironments checks whether a workflow name is available across the given environments. body is the freeform legacy payload.

func (*Client) PlaybookXDeletePermissions 

func (c *Client) PlaybookXDeletePermissions(ctx context.Context, identifier, workflowOriginalIdentifier string) (RawJSON, error)

PlaybookXDeletePermissions deletes the permissions for a playbook by its identifier, scoped to the given workflow original identifier. LIVE MUTATION.

func (*Client) PlaybookXDuplicateNestedWorkflows 

func (c *Client) PlaybookXDuplicateNestedWorkflows(ctx context.Context, body any) (RawJSON, error)

PlaybookXDuplicateNestedWorkflows duplicates a set of nested workflows. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) PlaybookXExecuteStep 

func (c *Client) PlaybookXExecuteStep(ctx context.Context, body any) (RawJSON, error)

PlaybookXExecuteStep executes a single workflow step. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) PlaybookXGetActionResultsOfWFId 

func (c *Client) PlaybookXGetActionResultsOfWFId(ctx context.Context, wfInstanceID int) (RawJSON, error)

PlaybookXGetActionResultsOfWFId returns the action results produced by a workflow instance, by its (integer) workflow-instance id.

func (*Client) PlaybookXGetActionWidgetTemplate 

func (c *Client) PlaybookXGetActionWidgetTemplate(ctx context.Context) (RawJSON, error)

PlaybookXGetActionWidgetTemplate returns the action-widget template.

func (*Client) PlaybookXGetCaseEntities 

func (c *Client) PlaybookXGetCaseEntities(ctx context.Context, caseID int) (RawJSON, error)

PlaybookXGetCaseEntities returns the entities of a case, by its (integer) case id, in the playbook context.

func (*Client) PlaybookXGetContextGroupByKey 

func (c *Client) PlaybookXGetContextGroupByKey(ctx context.Context, key string) (RawJSON, error)

PlaybookXGetContextGroupByKey returns the workflow context group for a key.

func (*Client) PlaybookXGetDebugStepCaseData 

func (c *Client) PlaybookXGetDebugStepCaseData(ctx context.Context, body any) (RawJSON, error)

PlaybookXGetDebugStepCaseData returns the case data backing a debug step. body is the freeform legacy payload.

func (*Client) PlaybookXGetOverviewTemplate 

func (c *Client) PlaybookXGetOverviewTemplate(ctx context.Context, templateIdentifier string) (RawJSON, error)

PlaybookXGetOverviewTemplate returns one overview template by its identifier.

func (*Client) PlaybookXGetOverviewTemplateByRequest 

func (c *Client) PlaybookXGetOverviewTemplateByRequest(ctx context.Context, body any) (RawJSON, error)

PlaybookXGetOverviewTemplateByRequest returns an overview template matching the request. body is the freeform legacy payload.

func (*Client) PlaybookXGetPendingStep 

func (c *Client) PlaybookXGetPendingStep(ctx context.Context, body any) (RawJSON, error)

PlaybookXGetPendingStep returns the details of a pending workflow step. body is the freeform legacy payload.

func (*Client) PlaybookXGetPendingStepsCountForUser 

func (c *Client) PlaybookXGetPendingStepsCountForUser(ctx context.Context) (RawJSON, error)

PlaybookXGetPendingStepsCountForUser returns the number of pending workflow steps assigned to the current user.

func (*Client) PlaybookXGetPendingStepsUserRelated 

func (c *Client) PlaybookXGetPendingStepsUserRelated(ctx context.Context) (RawJSON, error)

PlaybookXGetPendingStepsUserRelated returns the pending workflow steps related to the current user.

func (*Client) PlaybookXGetPermissionsOptions 

func (c *Client) PlaybookXGetPermissionsOptions(ctx context.Context, body any) (RawJSON, error)

PlaybookXGetPermissionsOptions returns the available playbook permission options. body is the freeform legacy payload.

func (*Client) PlaybookXGetSimulationEnrichment 

func (c *Client) PlaybookXGetSimulationEnrichment(ctx context.Context, body any) (RawJSON, error)

PlaybookXGetSimulationEnrichment returns enrichment data for a playbook simulation. body is the freeform legacy payload.

func (*Client) PlaybookXGetStatsMap 

func (c *Client) PlaybookXGetStatsMap(ctx context.Context, body any) (RawJSON, error)

PlaybookXGetStatsMap returns the playbook statistics map. body is the freeform legacy payload.

func (*Client) PlaybookXGetTestCases 

func (c *Client) PlaybookXGetTestCases(ctx context.Context, body any) (RawJSON, error)

PlaybookXGetTestCases returns the test cases available for a playbook. body is the freeform legacy payload.

func (*Client) PlaybookXGetTriggerTags 

func (c *Client) PlaybookXGetTriggerTags(ctx context.Context, body any) (RawJSON, error)

PlaybookXGetTriggerTags returns the trigger tags for a playbook. body is the freeform legacy payload.

func (*Client) PlaybookXGetWorkflowStepInstance 

func (c *Client) PlaybookXGetWorkflowStepInstance(ctx context.Context, body any) (RawJSON, error)

PlaybookXGetWorkflowStepInstance returns a single workflow step instance. body is the freeform legacy payload.

func (*Client) PlaybookXGetWorkflowsInvolvingAction 

func (c *Client) PlaybookXGetWorkflowsInvolvingAction(ctx context.Context, body any) (RawJSON, error)

PlaybookXGetWorkflowsInvolvingAction returns the workflows that use a given action. body is the freeform legacy payload.

func (*Client) PlaybookXRerun 

func (c *Client) PlaybookXRerun(ctx context.Context, body any) (RawJSON, error)

PlaybookXRerun reruns a playbook. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) PlaybookXRerunBlock 

func (c *Client) PlaybookXRerunBlock(ctx context.Context, body any) (RawJSON, error)

PlaybookXRerunBlock reruns a workflow block. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) PlaybookXRunInDebug 

func (c *Client) PlaybookXRunInDebug(ctx context.Context, body any) (RawJSON, error)

PlaybookXRunInDebug runs a playbook in debug mode. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) PlaybookXSaveLogVersionOfWorkflowDefinitions 

func (c *Client) PlaybookXSaveLogVersionOfWorkflowDefinitions(ctx context.Context, body any) (RawJSON, error)

PlaybookXSaveLogVersionOfWorkflowDefinitions saves a log version of the given workflow definitions. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) PlaybookXSetPermissions 

func (c *Client) PlaybookXSetPermissions(ctx context.Context, body any) (RawJSON, error)

PlaybookXSetPermissions sets the permissions for a playbook. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) PubSubBackfillTrigger 

func (c *Client) PubSubBackfillTrigger(ctx context.Context, tenantID string, body any) (RawJSON, error)

PubSubBackfillTrigger starts a PubSub backfill for the given tenant. body is the freeform PubSubBackfillRequest payload. LIVE MUTATION.

func (*Client) RaiseIncident 

func (c *Client) RaiseIncident(ctx context.Context, body any) (RawJSON, error)

RaiseIncident marks a case as an incident.

func (*Client) Raw 

func (c *Client) Raw(ctx context.Context, method, op string, body any) (RawJSON, error)

Raw is the escape hatch for external-API operations not yet modeled by a typed method: it issues method against op (the path under /api/external/v1, leading slash optional) with an optional JSON body and returns the raw response. The CLI's `soar legacy call` uses this so the full surface is reachable as config-as-code without a wrapper per endpoint.

func (*Client) ReassignCaseTask 

func (c *Client) ReassignCaseTask(ctx context.Context, body any) (RawJSON, error)

ReassignCaseTask reassigns a case task to another user. LIVE MUTATION.

func (*Client) ReinstallAllIntegrations 

func (c *Client) ReinstallAllIntegrations(ctx context.Context, body any) (RawJSON, error)

ReinstallAllIntegrations reinstalls every integration from the store. LIVE MUTATION with very high blast radius — use with extreme care.

func (*Client) RemoveAllNetworkDetailsRecords 

func (c *Client) RemoveAllNetworkDetailsRecords(ctx context.Context, body any) (RawJSON, error)

RemoveAllNetworkDetailsRecords deletes every network record. LIVE MUTATION; high blast radius.

func (*Client) RemoveCaseStageDefinitionRecords 

func (c *Client) RemoveCaseStageDefinitionRecords(ctx context.Context, body any) (RawJSON, error)

RemoveCaseStageDefinitionRecords deletes case stages. LIVE MUTATION.

func (*Client) RemoveCaseTag 

func (c *Client) RemoveCaseTag(ctx context.Context, body any) (RawJSON, error)

RemoveCaseTag removes a tag from a case.

func (*Client) RemoveEnvironmentRecords 

func (c *Client) RemoveEnvironmentRecords(ctx context.Context, body any) (RawJSON, error)

RemoveEnvironmentRecords deletes environments. LIVE MUTATION.

func (*Client) RemoveModelBlockRecords 

func (c *Client) RemoveModelBlockRecords(ctx context.Context, body any) (RawJSON, error)

RemoveModelBlockRecords deletes block-list records. LIVE MUTATION.

func (*Client) RemoveNetworkDetailsRecords 

func (c *Client) RemoveNetworkDetailsRecords(ctx context.Context, body any) (RawJSON, error)

RemoveNetworkDetailsRecords deletes specific network records. LIVE MUTATION.

func (*Client) RemovePlaybookCategories 

func (c *Client) RemovePlaybookCategories(ctx context.Context, body any) (RawJSON, error)

RemovePlaybookCategories deletes playbook categories. body carries the ids. LIVE MUTATION.

func (*Client) RemoveRootCauseClose 

func (c *Client) RemoveRootCauseClose(ctx context.Context, body any) (RawJSON, error)

RemoveRootCauseClose deletes root-cause options. LIVE MUTATION.

func (*Client) RemoveSlaDefinitionRecords 

func (c *Client) RemoveSlaDefinitionRecords(ctx context.Context, body any) (RawJSON, error)

RemoveSlaDefinitionRecords deletes SLA definitions. LIVE MUTATION.

func (*Client) RemoveTagDefinitionRecords 

func (c *Client) RemoveTagDefinitionRecords(ctx context.Context, body any) (RawJSON, error)

RemoveTagDefinitionRecords deletes tag definitions. LIVE MUTATION.

func (*Client) RemoveTrackingListRecords 

func (c *Client) RemoveTrackingListRecords(ctx context.Context, body any) (RawJSON, error)

RemoveTrackingListRecords deletes tracking-list records. LIVE MUTATION.

func (*Client) RenameCase 

func (c *Client) RenameCase(ctx context.Context, body any) (RawJSON, error)

RenameCase renames a case.

func (*Client) ReopenAlert 

func (c *Client) ReopenAlert(ctx context.Context, body any) (RawJSON, error)

ReopenAlert reopens a closed alert. LIVE MUTATION.

func (*Client) ReportAddOrUpdateSchedule 

func (c *Client) ReportAddOrUpdateSchedule(ctx context.Context, body any) (RawJSON, error)

ReportAddOrUpdateSchedule creates a new report schedule or updates an existing one. body is the freeform report-schedule payload. LIVE MUTATION.

func (*Client) ReportAddOrUpdateTemplate 

func (c *Client) ReportAddOrUpdateTemplate(ctx context.Context, body any) (RawJSON, error)

ReportAddOrUpdateTemplate creates a new report template or updates an existing one. body is the freeform report-template payload. LIVE MUTATION.

func (*Client) ReportAddOrUpdateWidget 

func (c *Client) ReportAddOrUpdateWidget(ctx context.Context, body any) (RawJSON, error)

ReportAddOrUpdateWidget creates a new report widget or updates an existing one. body is the freeform report-widget payload. LIVE MUTATION.

func (*Client) ReportDeleteSchedule 

func (c *Client) ReportDeleteSchedule(ctx context.Context, id int) (RawJSON, error)

ReportDeleteSchedule deletes a report schedule by its numeric id. Despite the HTTP GET verb, this is a LIVE MUTATION; it cannot be undone.

func (*Client) ReportDuplicateTemplate 

func (c *Client) ReportDuplicateTemplate(ctx context.Context, body any) (RawJSON, error)

ReportDuplicateTemplate copies an existing report template into a new one. body is the freeform legacy payload selecting the source template. LIVE MUTATION.

func (*Client) ReportGenerateTemplate 

func (c *Client) ReportGenerateTemplate(ctx context.Context, body any) (RawJSON, error)

ReportGenerateTemplate generates a report from a template. body is the freeform generation payload. LIVE MUTATION.

func (*Client) ReportGetSchedules 

func (c *Client) ReportGetSchedules(ctx context.Context, body any) (RawJSON, error)

ReportGetSchedules returns the report schedules matching the request. body is the freeform legacy filter payload.

func (*Client) ReportGetTemplates 

func (c *Client) ReportGetTemplates(ctx context.Context) (RawJSON, error)

ReportGetTemplates returns all available advanced report templates.

func (*Client) ReportImportTemplate 

func (c *Client) ReportImportTemplate(ctx context.Context, body any) (RawJSON, error)

ReportImportTemplate imports a report template from an exported definition. body is the freeform template-definition payload. LIVE MUTATION.

func (*Client) ReportRefreshAdvanced 

func (c *Client) ReportRefreshAdvanced(ctx context.Context) (RawJSON, error)

ReportRefreshAdvanced recomputes the advanced reports and returns the result.

func (*Client) ReportRemoveTemplate 

func (c *Client) ReportRemoveTemplate(ctx context.Context, templateID int) (RawJSON, error)

ReportRemoveTemplate deletes a report template by its numeric id. Despite the HTTP GET verb, this is a LIVE MUTATION; it cannot be undone.

func (*Client) ReportRemoveWidget 

func (c *Client) ReportRemoveWidget(ctx context.Context, widgetID int) (RawJSON, error)

ReportRemoveWidget deletes a report widget by its numeric id. Despite the HTTP GET verb, this is a LIVE MUTATION; it cannot be undone.

func (*Client) ReportShareAdvanced 

func (c *Client) ReportShareAdvanced(ctx context.Context, body any) (RawJSON, error)

ReportShareAdvanced shares an advanced report. body is the freeform sharing payload. LIVE MUTATION.

func (*Client) ResetEnvironmentPriorities 

func (c *Client) ResetEnvironmentPriorities(ctx context.Context, body any) (RawJSON, error)

ResetEnvironmentPriorities resets all environment priorities. LIVE MUTATION.

func (*Client) ResourceDownloadAuditControllerActionsCsv 

func (c *Client) ResourceDownloadAuditControllerActionsCsv(ctx context.Context) (RawJSON, error)

ResourceDownloadAuditControllerActionsCsv returns the audit-controller actions log as CSV.

func (*Client) ResourceGetActionResultsById 

func (c *Client) ResourceGetActionResultsById(ctx context.Context, caseID int, actionResultID string) (RawJSON, error)

ResourceGetActionResultsById returns the result of one action by its result id within the given case.

func (*Client) ResourceGetCaseFullDetailsById 

func (c *Client) ResourceGetCaseFullDetailsById(ctx context.Context, parentID string, caseID int) (RawJSON, error)

ResourceGetCaseFullDetailsById returns the full details of a case by its id, scoped to the given parent id.

func (*Client) ResourceGetEntityInsightsById 

func (c *Client) ResourceGetEntityInsightsById(ctx context.Context, caseID, insightsID int) (RawJSON, error)

ResourceGetEntityInsightsById returns the entity insights identified by insightsId within the given case.

func (*Client) RestoreWorkflowDefinition 

func (c *Client) RestoreWorkflowDefinition(ctx context.Context, body any) (RawJSON, error)

RestoreWorkflowDefinition restores a workflow definition to a prior version. body carries the target. LIVE MUTATION.

func (*Client) RetentionDeleteCases 

func (c *Client) RetentionDeleteCases(ctx context.Context, body any) (RawJSON, error)

RetentionDeleteCases bulk-deletes cases matching the supplied request. body is the freeform case-deletion request payload. LIVE MUTATION; permanently destroys the matched cases and cannot be undone.

func (*Client) RetentionRunSystem 

func (c *Client) RetentionRunSystem(ctx context.Context, body any) (RawJSON, error)

RetentionRunSystem performs a manual system-data retention pass. body is the freeform retention request payload. LIVE MUTATION; permanently purges aged system data and cannot be undone.

func (*Client) RetentionRunUser 

func (c *Client) RetentionRunUser(ctx context.Context, body any) (RawJSON, error)

RetentionRunUser performs a manual user-data retention pass. body is the freeform retention request payload. LIVE MUTATION; permanently purges aged user data and cannot be undone.

func (*Client) RevokeAPIKey added in v0.3.0 

func (c *Client) RevokeAPIKey(ctx context.Context, rec APIKey) error

RevokeAPIKey removes one key record (POST /settings/RemoveApiKeyRecord). The endpoint expects the full record as listed, so rec must come from ListAPIKeys (its Raw form is posted verbatim). LIVE MUTATION.

func (*Client) RevokeWebhook 

func (c *Client) RevokeWebhook(ctx context.Context, identifier string, body any) (RawJSON, error)

RevokeWebhook revokes a webhook's key by identifier. LIVE MUTATION.

func (*Client) RunJob 

func (c *Client) RunJob(ctx context.Context, body any) (RawJSON, error)

RunJob runs a job by identifier. body is the freeform run payload (carries the job identifier). LIVE: this executes the job now.

func (*Client) RunJobInstance 

func (c *Client) RunJobInstance(ctx context.Context, body any) (RawJSON, error)

RunJobInstance runs a specific job instance now. body carries the instance id. LIVE: this executes the job now.

func (*Client) SaveConnector 

func (c *Client) SaveConnector(ctx context.Context, body any) (RawJSON, error)

SaveConnector adds a new connector instance or updates an existing one. body is the freeform connector-instance payload. LIVE MUTATION.

func (*Client) SaveOrUpdateJob 

func (c *Client) SaveOrUpdateJob(ctx context.Context, body any) (RawJSON, error)

SaveOrUpdateJob adds or updates a job (definition-level). body is the freeform job payload. LIVE MUTATION.

func (*Client) SavePlaybook 

func (c *Client) SavePlaybook(ctx context.Context, body json.RawMessage) (json.RawMessage, error)

SavePlaybook saves a whole playbook definition. The body's field types are coerced to what SOAR expects (see coercePlaybookTypes) and its display name is validated (see validatePlaybookName) before the call. The server echo is returned.

WARNING: a save is a whole-body REPLACE, not a patch — omitted fields are dropped. SOAR also mints a NEW UUID for the saved workflow, so the identifier you sent goes stale immediately; re-resolve the playbook by name (see GetPlaybookByName) after saving rather than reusing the old identifier.

func (*Client) SaveStoreIntegrationConfigurationProperties 

func (c *Client) SaveStoreIntegrationConfigurationProperties(ctx context.Context, body any) (RawJSON, error)

SaveStoreIntegrationConfigurationProperties saves integration configuration properties from the store. LIVE MUTATION.

func (*Client) SaveWorkflowDefinitions 

func (c *Client) SaveWorkflowDefinitions(ctx context.Context, body any) (RawJSON, error)

SaveWorkflowDefinitions creates or updates workflow definitions. body is the freeform definitions payload. LIVE MUTATION — mints a new version.

func (*Client) SettingXAddCollaboratorRequest 

func (c *Client) SettingXAddCollaboratorRequest(ctx context.Context, body any) (RawJSON, error)

SettingXAddCollaboratorRequest creates a new collaborator request. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) SettingXAddLicenseAgreementSignature 

func (c *Client) SettingXAddLicenseAgreementSignature(ctx context.Context, body any) (RawJSON, error)

SettingXAddLicenseAgreementSignature records the calling user's signature of the license agreement. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) SettingXAddOrUpdateUserProfile 

func (c *Client) SettingXAddOrUpdateUserProfile(ctx context.Context, body any) (RawJSON, error)

SettingXAddOrUpdateUserProfile creates or updates a user profile. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) SettingXCreateFormDynamicParameter 

func (c *Client) SettingXCreateFormDynamicParameter(ctx context.Context, body any) (RawJSON, error)

SettingXCreateFormDynamicParameter creates a new form dynamic parameter. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) SettingXDeleteCollaboratorRequest 

func (c *Client) SettingXDeleteCollaboratorRequest(ctx context.Context, id int) (RawJSON, error)

SettingXDeleteCollaboratorRequest deletes a collaborator request by its numeric id. LIVE MUTATION; this cannot be undone.

func (*Client) SettingXDeleteFormDynamicParameter 

func (c *Client) SettingXDeleteFormDynamicParameter(ctx context.Context, id int) (RawJSON, error)

SettingXDeleteFormDynamicParameter deletes a form dynamic parameter by its numeric id. LIVE MUTATION; this cannot be undone.

func (*Client) SettingXExportAuditLastWeekAsCsv 

func (c *Client) SettingXExportAuditLastWeekAsCsv(ctx context.Context, body any) (RawJSON, error)

SettingXExportAuditLastWeekAsCsv exports the last week of audit records as CSV. body is the freeform legacy request payload. LIVE MUTATION.

func (*Client) SettingXExportAuditLastWeekAsCsvV2 

func (c *Client) SettingXExportAuditLastWeekAsCsvV2(ctx context.Context, body any) (RawJSON, error)

SettingXExportAuditLastWeekAsCsvV2 exports the last week of audit records as CSV (v2 endpoint). body is the freeform legacy request payload. LIVE MUTATION.

func (*Client) SettingXGetAdvancedReportsSettings 

func (c *Client) SettingXGetAdvancedReportsSettings(ctx context.Context) (RawJSON, error)

SettingXGetAdvancedReportsSettings returns the advanced-reports configuration.

func (*Client) SettingXGetAllCollaboratorRequests 

func (c *Client) SettingXGetAllCollaboratorRequests(ctx context.Context) (RawJSON, error)

SettingXGetAllCollaboratorRequests returns every collaborator request.

func (*Client) SettingXGetAnalysts 

func (c *Client) SettingXGetAnalysts(ctx context.Context, body any) (RawJSON, error)

SettingXGetAnalysts returns the analysts matching the request. body is the freeform legacy filter payload.

func (*Client) SettingXGetCollaboratorRequestsByUser 

func (c *Client) SettingXGetCollaboratorRequestsByUser(ctx context.Context) (RawJSON, error)

SettingXGetCollaboratorRequestsByUser returns collaborator requests scoped to the calling user.

func (*Client) SettingXGetFormDynamicParameter 

func (c *Client) SettingXGetFormDynamicParameter(ctx context.Context, id int) (RawJSON, error)

SettingXGetFormDynamicParameter returns one form dynamic parameter by its numeric id.

func (*Client) SettingXGetLatestLicenseAgreement 

func (c *Client) SettingXGetLatestLicenseAgreement(ctx context.Context) (RawJSON, error)

SettingXGetLatestLicenseAgreement returns the most recent license agreement.

func (*Client) SettingXGetMaximumAlertsGroupingConfiguration 

func (c *Client) SettingXGetMaximumAlertsGroupingConfiguration(ctx context.Context) (RawJSON, error)

SettingXGetMaximumAlertsGroupingConfiguration returns the maximum-alerts grouping configuration.

func (*Client) SettingXGetUserImage 

func (c *Client) SettingXGetUserImage(ctx context.Context, body any) (RawJSON, error)

SettingXGetUserImage returns a user's avatar image. body selects the user (freeform legacy payload).

func (*Client) SettingXGetUserProfileCards 

func (c *Client) SettingXGetUserProfileCards(ctx context.Context, body any) (RawJSON, error)

SettingXGetUserProfileCards returns summary cards for user profiles. body is the freeform legacy filter payload.

func (*Client) SettingXGetUserProfiles 

func (c *Client) SettingXGetUserProfiles(ctx context.Context, body any) (RawJSON, error)

SettingXGetUserProfiles returns user profiles matching the request. body is the freeform legacy filter payload.

func (*Client) SettingXGetUserProfilesByEnvironments 

func (c *Client) SettingXGetUserProfilesByEnvironments(ctx context.Context, body any) (RawJSON, error)

SettingXGetUserProfilesByEnvironments returns user profiles filtered by environment. body is the freeform legacy filter payload.

func (*Client) SettingXListFormDynamicParameters 

func (c *Client) SettingXListFormDynamicParameters(ctx context.Context) (RawJSON, error)

SettingXListFormDynamicParameters returns all form dynamic parameters.

func (*Client) SettingXListFormDynamicParametersByType 

func (c *Client) SettingXListFormDynamicParametersByType(ctx context.Context, formType string) (RawJSON, error)

SettingXListFormDynamicParametersByType returns the form dynamic parameters for one form type. The collection GET requires a formType filter (the unfiltered read is rejected), so config-as-code lists per type; FormType has a single usable value, "CloseCase".

func (*Client) SettingXSaveAdvancedReportsSettings 

func (c *Client) SettingXSaveAdvancedReportsSettings(ctx context.Context, body any) (RawJSON, error)

SettingXSaveAdvancedReportsSettings persists the advanced-reports configuration. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) SettingXTestAdvancedReportsSettings 

func (c *Client) SettingXTestAdvancedReportsSettings(ctx context.Context) (RawJSON, error)

SettingXTestAdvancedReportsSettings tests connectivity to the configured advanced-reports backend.

func (*Client) SettingXUpdateAlertGroupingRule 

func (c *Client) SettingXUpdateAlertGroupingRule(ctx context.Context, body any) (RawJSON, error)

SettingXUpdateAlertGroupingRule updates an alert-grouping rule. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) SettingXUpdateCollaboratorRequest 

func (c *Client) SettingXUpdateCollaboratorRequest(ctx context.Context, body any) (RawJSON, error)

SettingXUpdateCollaboratorRequest updates an existing collaborator request. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) SettingXUpdateFormDynamicParameter 

func (c *Client) SettingXUpdateFormDynamicParameter(ctx context.Context, id int, body any) (RawJSON, error)

SettingXUpdateFormDynamicParameter updates a form dynamic parameter by its numeric id. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) SettingXUpdateUserImage 

func (c *Client) SettingXUpdateUserImage(ctx context.Context, body any) (RawJSON, error)

SettingXUpdateUserImage sets a user's avatar image. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) SettingXUploadCustomActionResultJson 

func (c *Client) SettingXUploadCustomActionResultJson(ctx context.Context, body any) (RawJSON, error)

SettingXUploadCustomActionResultJson uploads a custom action-result JSON definition. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) SkipAlert deprecated 

func (c *Client) SkipAlert(ctx context.Context, body any) (RawJSON, error)

SkipAlert is the historical name of SkipStep — the op skips a pending PLAYBOOK STEP, not an alert.

Deprecated: use SkipStep; this alias remains for compatibility.

func (*Client) SkipStep added in v0.3.0 

func (c *Client) SkipStep(ctx context.Context, step RawJSON, skipComment string) (RawJSON, error)

SkipAlert skips an alert. SkipStep skips a pending playbook step (action) so the workflow continues past it — the reject half of the manual/approval flow (POST /cases/Skip). step is the full step-instance object exactly as fetched (the same shape ExecuteStep takes, ApiSkipStepInstanceDataModel); a non-empty skipComment is overlaid onto the wire's skipComment field WITHOUT re-decoding the step's other values, so large int64 identifiers survive byte-exact (a map[string]any round-trip would coerce them through float64).

func (*Client) SocRoleAddOrUpdate 

func (c *Client) SocRoleAddOrUpdate(ctx context.Context, body any) (RawJSON, error)

SocRoleAddOrUpdate creates a new SOC role or updates an existing one. body is the freeform SOC role payload. LIVE MUTATION.

func (*Client) SocRoleDelete 

func (c *Client) SocRoleDelete(ctx context.Context, body any) (RawJSON, error)

SocRoleDelete deletes a SOC role. body selects the role to remove (freeform legacy payload). LIVE MUTATION; this cannot be undone.

func (*Client) SocRoleGet 

func (c *Client) SocRoleGet(ctx context.Context, id int) (RawJSON, error)

SocRoleGet returns one SOC role record by its numeric id.

func (*Client) SocRoleHasAssignedUsers 

func (c *Client) SocRoleHasAssignedUsers(ctx context.Context, id int) (RawJSON, error)

SocRoleHasAssignedUsers reports whether the SOC role with the given numeric id still has users assigned (check before deletion).

func (*Client) SocRoleList 

func (c *Client) SocRoleList(ctx context.Context) (RawJSON, error)

SocRoleList returns all SOC role records in the tenant.

func (*Client) SocRoleListByEnvironments 

func (c *Client) SocRoleListByEnvironments(ctx context.Context, body any) (RawJSON, error)

SocRoleListByEnvironments returns SOC role records scoped to the environments named in body (a freeform legacy payload).

func (*Client) SystemGetLicenseStatus added in v0.2.4 

func (c *Client) SystemGetLicenseStatus(ctx context.Context) (RawJSON, error)

SystemGetLicenseStatus returns the SOAR license status.

func (*Client) SystemGetMaxDataRetention added in v0.2.4 

func (c *Client) SystemGetMaxDataRetention(ctx context.Context) (RawJSON, error)

SystemGetMaxDataRetention returns the maximum data retention period (months).

func (*Client) SystemGetVersion added in v0.2.4 

func (c *Client) SystemGetVersion(ctx context.Context) (RawJSON, error)

SystemGetVersion returns the SOAR platform version.

func (*Client) TestProxySettings 

func (c *Client) TestProxySettings(ctx context.Context, body any) (RawJSON, error)

TestProxySettings tests a proxy configuration. body carries the proxy details.

func (*Client) TestStoreIntegration 

func (c *Client) TestStoreIntegration(ctx context.Context, integrationInstanceID string) (RawJSON, error)

TestStoreIntegration tests a store integration instance.

func (*Client) ToggleEnvironmentLoadBalancing 

func (c *Client) ToggleEnvironmentLoadBalancing(ctx context.Context, body any) (RawJSON, error)

ToggleEnvironmentLoadBalancing turns environment load balancing on/off. LIVE MUTATION.

func (*Client) UnraiseIncident 

func (c *Client) UnraiseIncident(ctx context.Context, body any) (RawJSON, error)

UnraiseIncident clears the incident flag on a case.

func (*Client) UpdateAlertPriority 

func (c *Client) UpdateAlertPriority(ctx context.Context, body any) (RawJSON, error)

UpdateAlertPriority changes a single alert's priority.

func (*Client) UpdateCaseTask 

func (c *Client) UpdateCaseTask(ctx context.Context, body any) (RawJSON, error)

UpdateCaseTask updates a case task. LIVE MUTATION.

func (*Client) UpdateComment 

func (c *Client) UpdateComment(ctx context.Context, body any) (RawJSON, error)

UpdateComment edits an existing case comment. LIVE MUTATION.

func (*Client) UpdateConnectorFromIDE 

func (c *Client) UpdateConnectorFromIDE(ctx context.Context, body any) (RawJSON, error)

UpdateConnectorFromIDE updates a connector instance to its definition's latest version. body is the freeform legacy payload. LIVE MUTATION.

func (*Client) UpdateEnvironmentPriority 

func (c *Client) UpdateEnvironmentPriority(ctx context.Context, environment string, body any) (RawJSON, error)

UpdateEnvironmentPriority patches one environment's priority. LIVE MUTATION.

func (*Client) UpdateExternalAuthSetting 

func (c *Client) UpdateExternalAuthSetting(ctx context.Context, id string, body any) (RawJSON, error)

UpdateExternalAuthSetting replaces an external auth provider by id. LIVE MUTATION.

func (*Client) UpdateIdpGroupMapping 

func (c *Client) UpdateIdpGroupMapping(ctx context.Context, id string, body any) (RawJSON, error)

UpdateIdpGroupMapping updates an IdP group mapping by id. LIVE MUTATION.

func (*Client) UpdateJobInstance 

func (c *Client) UpdateJobInstance(ctx context.Context, body any) (RawJSON, error)

UpdateJobInstance updates an existing job instance. body is the freeform instance payload. LIVE MUTATION.

func (*Client) UpdateVisualFamilyImage 

func (c *Client) UpdateVisualFamilyImage(ctx context.Context, body any) (RawJSON, error)

UpdateVisualFamilyImage updates a visual family's image. LIVE MUTATION.

func (*Client) UpdateWebhook 

func (c *Client) UpdateWebhook(ctx context.Context, body any) (RawJSON, error)

UpdateWebhook updates a webhook. LIVE MUTATION.

type CloseAlertRequest added in v0.3.0 

type CloseAlertRequest struct {
	SourceCaseID    int    `json:"sourceCaseId"`
	AlertIdentifier string `json:"alertIdentifier"`
	Reason          string `json:"reason"`
	RootCause       string `json:"rootCause"`
	Comment         string `json:"comment"`
	Usefulness      string `json:"usefulness,omitempty"`
}

CloseAlertRequest closes one alert within a case (the case stays open). Reason takes the PascalCase wire token (Malicious | NotMalicious | Maintenance | Inconclusive — alerts take no Unknown); Usefulness is the optional None | NotUseful | Useful stat.

type CloseReason 

type CloseReason int

CloseReason is the legacy bulk-close reason code (the server's CloseReasonEnum). 

const (
	CloseMalicious    CloseReason = 0
	CloseNotMalicious CloseReason = 1
	CloseMaintenance  CloseReason = 2
	CloseInconclusive CloseReason = 3
	CloseUnknown      CloseReason = 4
)

CloseReason values accepted by BulkCloseCases. The integer encoding is the server's, not alphabetical — Malicious is 0, per the swagger CloseReasonEnum description (Malicious=0 / NotMalicious=1 / Maintenance=2 / Inconclusive=3 / Unknown=4). Do not reorder.

func (CloseReason) String 

func (r CloseReason) String() string

String returns the reason name (for CLI/log output).

type Error 

type Error = transport.Error

Error is the typed error the legacy SOAR client returns for a non-2xx response (method, URL, HTTP status, body, server request id). errors.As it to inspect the status, mirroring chronicle.APIError and soar.Error.

type InstallIntegrationRequest 

type InstallIntegrationRequest struct {
	Identifier      string `json:"identifier"`
	Name            string `json:"name"`
	IsCertified     bool   `json:"isCertified"`
	Version         int    `json:"version"`
	OverrideMapping bool   `json:"overrideMapping"`
}

InstallIntegrationRequest installs one integration from the local store; fields match the Content-Hub UI request. Identifier is the integration id (e.g. "CloudIdentity"); OverrideMapping replaces existing ontology mapping on (re)install.

type ManualCaseRequest 

type ManualCaseRequest struct {
	Title                       string       `json:"title"`
	AssignedUser                string       `json:"assignedUser"`
	Reason                      string       `json:"reason"`
	Priority                    CasePriority `json:"priority"`
	Environment                 string       `json:"environment"`
	IsImportant                 bool         `json:"isImportant"`
	AlertName                   string       `json:"alertName"`
	OccurenceTime               string       `json:"occurenceTime"`
	SLAExpirationDateTime       *string      `json:"slaExpirationDateTime"`
	Entities                    []any        `json:"entities"`
	Playbooks                   []string     `json:"playbooks"`
	AutomaticPlaybookAttachment bool         `json:"automaticPlaybookAttachment"`
	Tags                        []string     `json:"tags"`
}

ManualCaseRequest is the body for CreateManualCase (an analyst-authored case).

The collection fields (Entities, Playbooks, Tags) are ALWAYS serialized — their json tags carry no omitempty and CreateManualCase normalizes nil to empty — because the legacy server does not null-guard them: omitting any one makes the call throw a server-side 500 *after* it has already created the case (leaving an orphan). AssignedUser must be non-empty: a username, or a role as "@RoleName". OccurenceTime is an RFC3339 timestamp. Priority is a CasePriority enum value (0/40/60/80/100, or -1 for Informative). SLAExpirationDateTime is optional.

type MoveAlertRequest added in v0.3.0 

type MoveAlertRequest struct {
	AlertIdentifier   string `json:"alertIdentifier"`
	SourceCaseID      int    `json:"sourceCaseId"`
	DestinationCaseID int    `json:"destinationCaseId,omitempty"`
}

MoveAlertRequest moves one alert out of a case: into DestinationCaseID, or into a brand-new case when DestinationCaseID is zero (omitted on the wire).

type Playbook 

type Playbook = json.RawMessage

Playbook is a full playbook definition body. It is intentionally opaque: the payload is large and freeform, so callers round-trip the raw JSON.

func BuildPlaybookFromMolds added in v0.1.6 

func BuildPlaybookFromMolds(base Playbook, opts PlaybookBuildOptions) (Playbook, error)

BuildPlaybookFromMolds composes a save-ready playbook body from a full base playbook and exported step molds. It is offline only: callers should still run the normal playbook dry-run/save path for SOAR validation.

func InsertActionStep added in v0.3.0 

func InsertActionStep(playbook Playbook, opts PlaybookStepInsertOptions) (Playbook, error)

InsertActionStep splices a brand-new action step into a playbook after the anchor step selected by opts.After, preserving every unknown field of both the playbook and the mold. Offline only — the result still flows through the normal validate → guarded-save path, where SOAR is the final validator.

func PatchPlaybookTrigger added in v0.2.0 

func PatchPlaybookTrigger(playbook Playbook, opts PlaybookTriggerPatchOptions) (Playbook, error)

PatchPlaybookTrigger edits the trigger fields that secopsctl can safely represent, preserving every unknown playbook and trigger field. It is offline only; callers should validate/save the returned body through the normal guarded playbook path.

type PlaybookBuildOptions added in v0.1.6 

type PlaybookBuildOptions struct {
	Name             string
	CronSchedule     string
	StepReplacements []PlaybookStepReplacement
}

PlaybookBuildOptions controls an offline playbook composition pass. The base playbook and every step mold should come from SOAR-exported JSON; this helper edits that known-good shape rather than inventing playbook bodies.

type PlaybookCard 

type PlaybookCard struct {
	// ID is the card's numeric menu id. DEVIATION: the SOAR menu RPC returns this
	// as a JSON number, so it is typed json.Number to decode it without error; the
	// uuid used for workflow operations is Identifier.
	ID           json.Number     `json:"id"`
	Identifier   string          `json:"identifier"`
	Name         string          `json:"name"`
	CategoryName string          `json:"categoryName"`
	IsEnabled    bool            `json:"isEnabled"`
	Raw          json.RawMessage `json:"-"`
}

PlaybookCard is a single entry from the playbook menu listing. Raw holds the untouched card object for callers that need fields beyond the typed ones.

type PlaybookStepInsertOptions added in v0.3.0 

type PlaybookStepInsertOptions struct {
	Mold json.RawMessage
	// After matches the anchor step by name, identifier, or
	// originalStepIdentifier.
	After string
	// Branch selects which outgoing relation of the anchor to splice when the
	// anchor has several (the relation's condition value, e.g. "1" for a
	// condition step's first branch). Empty requires the anchor to have at
	// most one outgoing relation; a tail anchor (none) appends the new step
	// after it.
	Branch string
	// InstanceName overrides the generated unique instance name
	// ("<actionName>_<n>", the designer's convention).
	InstanceName string
	// NewIdentifier pins the minted step identifier (tests); empty mints a
	// random UUID.
	NewIdentifier string
}

PlaybookStepInsertOptions describes a brand-new action step spliced into a playbook after an existing anchor step. The mold supplies the wired action body (an ExtractActionStepMold result, or a step exported from the designer); the insert mints FRESH graph identity for it and rewires the anchor's outgoing relation through the new step.

type PlaybookStepReplacement added in v0.1.6 

type PlaybookStepReplacement struct {
	Match string
	Mold  json.RawMessage
}

PlaybookStepReplacement replaces one step in the base playbook with an exported integration-action step mold while preserving the base step's graph identity fields. Match resolves against the base step name, identifier, or originalStepIdentifier.

type PlaybookTriggerPatchOptions added in v0.2.0 

type PlaybookTriggerPatchOptions struct {
	PlaybookEnabled    *bool
	TriggerEnabled     *bool
	Type               any
	ExecutionMode      string
	CronSchedule       *string
	Conditions         json.RawMessage
	ReactionConditions json.RawMessage
}

PlaybookTriggerPatchOptions controls an offline trigger-edit pass. Empty fields are preserved; pointer fields distinguish "not provided" from false/empty.

type RawJSON 

type RawJSON = json.RawMessage

RawJSON is an undecoded legacy response body.

type ReopenAlertRequest added in v0.3.0 

type ReopenAlertRequest struct {
	CaseID          int    `json:"caseId"`
	AlertIdentifier string `json:"alertIdentifier"`
}

ReopenAlertRequest reopens one closed alert within a case.

type RootCauseClose 

type RootCauseClose struct {
	ID             int         `json:"id,omitempty"`
	RootCause      string      `json:"rootCause"`
	ForCloseReason CloseReason `json:"forCloseReason"`
}

RootCauseClose is a close root-cause option (a GetRootCauseCloseRecords record and the AddOrUpdateRootCauseClose body). ForCloseReason is the close reason this root cause is offered under — the SAME enum as BulkCloseCases (CloseReason: Malicious=0, …), carried here in the `forCloseReason` field. (The v1alpha twin is caseCloseDefinitions, which expresses the same link as a string closeReason.)

type Settings 

type Settings = transport.Settings

Settings identifies a tenant SOAR instance (host + v1alpha path components).

type SlaAlertType 

type SlaAlertType int

SlaAlertType scopes an SLA to all alerts or specific ones (ApiSlaAlertType). 

const (
	SlaAllAlerts      SlaAlertType = 0
	SlaSpecificAlerts SlaAlertType = 1
)

type SlaDefinition 

type SlaDefinition struct {
	ID                 int             `json:"id,omitempty"`
	ValueType          SlaProviderType `json:"valueType"`
	Value              string          `json:"value"`
	Values             []string        `json:"values"`
	SlaPeriod          int             `json:"slaPeriod"`
	SlaPeriodType      SlaPeriodType   `json:"slaPeriodType"`
	CriticalPeriod     int             `json:"criticalPeriod"`
	CriticalPeriodType SlaPeriodType   `json:"criticalPeriodType"`
	AlertType          SlaAlertType    `json:"alertType"`
	Environments       []string        `json:"environments"`
}

SlaDefinition is the typed body for an SLA definition (ApiSlaDefinition). For a CasePriority SLA the server stores Value as a JSON-array string (e.g. `["High"]`, the v1alpha slaTypeValue form), so set Value that way for a clean read round-trip; Values is the plain array.

type SlaPeriodType 

type SlaPeriodType int

SlaPeriodType is an SLA period unit (ApiPeriodTypeEnum). 

const (
	SlaMinutes SlaPeriodType = 0
	SlaHours   SlaPeriodType = 1
	SlaDays    SlaPeriodType = 2
	SlaSeconds SlaPeriodType = 3
)

type SlaProviderType 

type SlaProviderType int

SlaProviderType is an SLA's subject type (ApiSlaProviderTypeEnum). 

const (
	SlaAlertRuleGenerator SlaProviderType = 2
	SlaCaseStage          SlaProviderType = 3
	SlaCasePriority       SlaProviderType = 4
	SlaAlertPriority      SlaProviderType = 5
)

type UpdateAlertPriorityRequest added in v0.3.0 

type UpdateAlertPriorityRequest struct {
	CaseID           int          `json:"caseId"`
	AlertIdentifier  string       `json:"alertIdentifier"`
	AlertName        string       `json:"alertName"`
	PreviousPriority CasePriority `json:"previousPriority"`
	Priority         CasePriority `json:"priority"`
}

UpdateAlertPriorityRequest re-prioritizes one alert within its case. The request carries the alert's name and current priority alongside the target.

type UserProfile added in v0.1.1 

type UserProfile struct {
	UserName        string `json:"userName"`
	FirstName       string `json:"firstName"`
	LastName        string `json:"lastName"`
	Email           string `json:"email"`
	SOCRole         string `json:"socRole"`
	PermissionGroup string `json:"permissionGroup"`
	IsDisabled      bool   `json:"isDisabled"`
}

UserProfile is the assignee-directory view of a SOAR user (a subset of GetUserProfiles). It is metadata only — no image blob and no secret (House Rule 4). UserName is the login identifier and the value `soar case assign --user` consumes.

func (UserProfile) FullName added in v0.1.1 

func (u UserProfile) FullName() string

FullName joins first and last name (trimmed) for the directory's NAME column.

type WorkflowStatus added in v0.7.2 

type WorkflowStatus int

WorkflowStatus is the status of a workflow instance (playbook run). The integer values are the server's WorkflowInstanceStatusEnum — sourced from the swagger schema description. 

const (
	WorkflowFaulted           WorkflowStatus = 0
	WorkflowInProgress        WorkflowStatus = 1
	WorkflowCompleted         WorkflowStatus = 2
	WorkflowPendingUserInput  WorkflowStatus = 3
	WorkflowPendingPrevSteps  WorkflowStatus = 4
	WorkflowStarted           WorkflowStatus = 5
	WorkflowFaultedAndSkipped WorkflowStatus = 6
	WorkflowHandledTimedout   WorkflowStatus = 7
)

func (WorkflowStatus) String added in v0.7.2 

func (s WorkflowStatus) String() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.