GoCTI

https://github.com/weisshorn-cyd/gocti
Admin
GoCTI is an unofficial Go client for interacting with the OpenCTI platform through GraphQL queries...
Tokens:44,534
Snippets:158
Trust Score:4.8
License:MIT
Update:11 months ago
Show doc for...
Tokens:
Raw
### Install GoCTI Package

Source: https://github.com/weisshorn-cyd/gocti/blob/main/README.md

Demonstrates how to install the GoCTI package using the Go module system. This is the initial step to get GoCTI up and running.

```bash
go get github.com/weisshorn-cyd/gocti
```

--------------------------------

### Create Relationships between Threat Actor and Malware with GoCTI

Source: https://context7.com/weisshorn-cyd/gocti/llms.txt

Shows establishing a STIX relationship between a threat actor and a malware entity. Includes start time and confidence. Inputs: actor and malware

--------------------------------

### List Entities with Filters - Go

Source: https://context7.com/weisshorn-cyd/gocti/llms.txt

Demonstrates filtering OpenCTI entities using multiple criteria including search terms, date ranges, and confidence scores. Uses the gocti client with GraphQL query capabilities. Supports AND/OR filter modes, custom field selection, and ordered results with pagination support. Includes example filtering malwares created within the last 7 days with minimum confidence level.

```go
package main

import (
    "context"
    "log"
    "time"

    "github.com/weisshorn-cyd/gocti"
    "github.com/weisshorn-cyd/gocti/graphql"
    "github.com/weisshorn-cyd/gocti/list"
)

func main() {
    client, _ := gocti.NewOpenCTIAPIClient("http://localhost:8080", "token")
    ctx := context.Background()

    // List all malwares with filters and search
    sevenDaysAgo := time.Now().AddDate(0, 0, -7)
    malwares, err := client.ListMalwares(
        ctx,
        "id, name, description, created_at, confidence",
        false, // Use pagination instead of getting all
        nil,   // No pageInfo for first request
        list.WithSearch("RAT"),
        list.WithFilters(list.FilterGroup{
            Mode: list.FilterModeAnd,
            Filters: []list.Filter{
                {
                    Key:      []string{"created_at"},
                    Operator: list.FilterOperatorGt,
                    Values:   []any{sevenDaysAgo.Format(time.RFC3339)},
                },
                {
                    Key:      []string{"confidence"},
                    Operator: list.FilterOperatorGte,
                    Values:   []any{70},
                },
            },
        }),
        list.WithOrderBy("created_at"),
        list.WithOrderMode(list.OrderModeDesc),
        list.WithFirst(50),
    )
    if err != nil {
        log.Fatalf("Failed to list malwares: %v", err)
    }

    log.Printf("Found %d malwares", len(malwares))
    for _, m := range malwares {
        log.Printf("- %s (Confidence: %d)", m.Name, m.Confidence)
    }
}
```

--------------------------------

### Custom GraphQL Queries

Source: https://context7.com/weisshorn-cyd/gocti/llms.txt

This functionality enables executing custom GraphQL queries for advanced use cases not covered by helper methods. The example demonstrates fetching a report and its related objects using a custom query.

```APIDOC
## Custom GraphQL Queries

### Description
This functionality enables executing custom GraphQL queries for advanced use cases not covered by helper methods. The example demonstrates fetching a report and its related objects using a custom query.

### Method
POST

### Endpoint
/api/v1/query

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
- **query** (string) - Required - The GraphQL query to execute.
- **variables** (object) - Optional - Variables to pass to the GraphQL query.

### Request Example
{
  "query": "\
    query GetReportWithRelationships($id: String!) {\
        report(id: $id) {\
            id\
            name\
            description\
            published\
            report_types\
            objects {\
                edges {\
                    node {\
                        ... on StixDomainObject {\
                            id\
                            entity_type\
                        } \
                    } \
                } \
            } \
        } \
    }",
  "variables": {
    "id": "report--12345678-1234-1234-1234-123456789012"
  }
}

### Response
#### Success Response (200)
- **data** (object) - The result of the GraphQL query.
```

--------------------------------

### GET /api/entities

Source: https://github.com/weisshorn-cyd/gocti/blob/main/entity/default_properties/stix_core_relationship_default_properties.txt

Retrieve detailed information about entities including their relationships, attributes, and metadata. This endpoint supports complex queries with various filters.

```APIDOC
## GET /api/entities

### Description
Retrieve detailed information about entities including their relationships, attributes, and metadata. This endpoint supports complex queries with various filters.

### Method
GET

### Endpoint
/api/entities

### Parameters
#### Query Parameters
- **id** (string) - Optional - The unique identifier of the entity.
- **entity_type** (string) - Optional - The type of the entity.
- **spec_version** (string) - Optional - The specification version of the entity.

### Response
#### Success Response (200)
- **id** (string) - The unique identifier of the entity.
- **entity_type** (string) - The type of the entity.
- **parent_types** (array) - The parent types of the entity.
- **spec_version** (string) - The specification version of the entity.
- **created_at** (string) - The creation timestamp of the entity.
- **updated_at** (string) - The last update timestamp of the entity.
- **standard_id** (string) - The standard identifier of the entity.
- **relationship_type** (string) - The type of relationship.
- **description** (string) - The description of the entity.
- **start_time** (string) - The start time of the entity.
- **stop_time** (string) - The stop time of the entity.
- **revoked** (boolean) - Indicates if the entity is revoked.
- **confidence** (integer) - The confidence level of the entity.
- **lang** (string) - The language of the entity.
- **created** (string) - The creation timestamp.
- **modified** (string) - The last modification timestamp.
- **status** (object) - The status of the entity.
- **createdBy** (object) - The creator of the entity.
- **objectMarking** (object) - The object marking of the entity.
- **objectOrganization** (object) - The organization associated with the entity.
- **objectLabel** (object) - The label of the entity.
- **externalReferences** (object) - The external references of the entity.
- **from** (object) - The source of the relationship.
- **to** (object) - The target of the relationship.

#### Response Example
{
  "id": "entity-123",
  "entity_type": "StixObject",
  "parent_types": ["BasicObject"],
  "spec_version": "2.1",
  "created_at": "2023-01-01T00:00:00Z",
  "updated_at": "2023-01-02T00:00:00Z",
  "standard_id": "stix--123",
  "relationship_type": "related-to",
  "description": "Example entity description",
  "start_time": "2023-01-01T00:00:00Z",
  "stop_time": "2023-01-02T00:00:00Z",
  "revoked": false,
  "confidence": 90,
  "lang": "en",
  "created": "2023-01-01T00:00:00Z",
  "modified": "2023-01-02T00:00:00Z",
  "status": {
    "id": "status-123",
    "template": {
      "id": "template-123",
      "name": "Active",
      "color": "#00ff00"
    }
  },
  "createdBy": {
    "id": "identity-123",
    "standard_id": "identity--123",
    "entity_type": "Identity",
    "parent_types": ["BasicObject"],
    "spec_version": "2.1",
    "identity_class": "organization",
    "name": "Example Org",
    "description": "Example organization",
    "roles": ["admin"],
    "contact_information": "contact@example.com",
    "x_opencti_aliases": ["alias1", "alias2"],
    "created": "2023-01-01T00:00:00Z",
    "modified": "2023-01-02T00:00:00Z",
    "objectLabel": {
      "id": "label-123",
      "value": "important",
      "color": "#ff0000"
    }
  },
  "objectMarking": {
    "id": "marking-123",
    "standard_id": "marking--123",
    "entity_type": "MarkingDefinition",
    "definition_type": "statement",
    "definition": "Example marking definition",
    "created": "2023-01-01T00:00:00Z",
    "modified": "2023-01-02T00:00:00Z",
    "x_opencti_order": 1,
    "x_opencti_color": "#0000ff"
  },
  "objectOrganization": {
    "id": "org-123",
    "standard_id": "org--123",
    "name": "Example Org"
  },
  "objectLabel": {
    "id": "label-123",
    "value": "important",
    "color": "#ff0000"
  },
  "externalReferences": {
    "edges": [
      {
        "node": {
          "id": "ref-123",
          "standard_id": "ref--123",
          "entity_type": "ExternalReference",
          "source_name": "Example Source",
          "description": "Example reference",
          "url": "https://example.com",
          "hash": "abc123",
          "external_id": "ext-123",
          "created": "2023-01-01T00:00:00Z",
          "modified": "2023-01-02T00:00:00Z",
          "importFiles": {
            "edges": [
              {
                "node": {
                  "id": "file-123",
                  "name": "example.txt",
                  "size": 1024,
                  "metaData": {
                    "mimetype": "text/plain",
                    "version": "1.0"
                  }
                }
              }
            ]
          }
        }
      }
    ]
  },
  "from": {
    "id": "from-123",
    "entity_type": "BasicObject",
    "parent_types": ["BasicObject"],
    "standard_id": "stix--123",
    "spec_version": "2.1",
    "created_at": "2023-01-01T00:00:00Z",
    "updated_at": "2023-01-02T00:00:00Z",
    "name": "Example From"
  },
  "to": {
    "id": "to-123",
    "entity_type": "BasicObject",
    "parent_types": ["BasicObject"],
    "standard_id": "stix--123",
    "spec_version": "2.1",
    "created_at": "2023-01-01T00:00:00Z",
    "updated_at": "2023-01-02T00:00:00Z",
    "name": "Example To"
  }
}
```

--------------------------------

### Create a Malware Entity (Go)

Source: https://github.com/weisshorn-cyd/gocti/blob/main/README.md

Illustrates how to create a malware entity in OpenCTI using the `CreateMalware` method.  It requires a context, entity ID (empty string provided), and an input struct with malware details.

```go
malware, err := client.CreateMalware(ctx, "", entity.MalwareAddInput{
	Name:        "Example Malware",
	Description: "An example of a very malicious malware.",
})
```

--------------------------------

### GET /weisshorn-cyd/gocti

Source: https://github.com/weisshorn-cyd/gocti/blob/main/entity/default_properties/case_rft_default_properties.txt

Retrieves information about a specific gocti entity. This endpoint allows fetching detailed attributes of a gocti object, including its status, creator, associated organizations, markings, external references, and related objects.

```APIDOC
## GET /weisshorn-cyd/gocti

### Description
Retrieves detailed information about a specific gocti entity. This endpoint allows fetching detailed attributes of a gocti object, including its status, creator, associated organizations, markings, external references, and related objects.

### Method
GET

### Endpoint
/weisshorn-cyd/gocti

### Parameters
#### Query Parameters
- **id** (string) - Optional - The unique identifier of the gocti entity.
- **standard_id** (string) - Optional - The STIX standard identifier of the gocti entity.

### Request Example
```
GET /weisshorn-cyd/gocti?id=12345-abcde
```

### Response
#### Success Response (200)
- **id** (string) - The unique identifier of the gocti entity.
- **standard_id** (string) - The STIX standard identifier.
- **entity_type** (string) - The type of the entity.
- **parent_types** (array) - An array of parent types.
- **spec_version** (string) - The STIX specification version.
- **created_at** (string) - The creation timestamp.
- **updated_at** (string) - The last update timestamp.
- **status** (object) - The current status of the entity.
- **createdBy** (object) - Information about the creator of the entity.
- **objectOrganization** (array) - Organizations associated with the entity.
- **objectMarking** (array) - Markings applied to the entity.
- **objectLabel** (array) - Labels associated with the entity.
- **externalReferences** (array) - External references linked to the entity.
- **revoked** (boolean) - Indicates if the entity has been revoked.
- **confidence** (integer) - The confidence level of the entity.
- **created** (string) - The creation timestamp (STIX format).
- **modified** (string) - The last modification timestamp (STIX format).
- **name** (string) - The name of the gocti entity.
- **description** (string) - The description of the gocti entity.
- **severity** (integer) - The severity level.
- **priority** (integer) - The priority level.
- **takedown_types** (array) - Types of takedown actions.
- **objects** (array) - Related STIX objects.
- **importFiles** (array) - Imported files associated with the entity.

#### Response Example
```json
{
  "id": "d9417377-17c4-4176-910d-227428767804",
  "standard_id": "indicator--82c78939-7127-46a8-9789-20975a48a294",
  "entity_type": "indicator",
  "parent_types": [
    "stix-object"
  ],
  "spec_version": "2.1",
  "created_at": "2023-10-27T10:30:00.000Z",
  "updated_at": "2023-10-27T10:30:00.000Z",
  "status": {
    "id": "status--00000000-1000-4000-8000-000000000001",
    "template": {
      "id": "template--00000000-1000-4000-8000-000000000001",
      "name": "In Progress",
      "color": "#337ab7"
    }
  },
  "createdBy": {
    "id": "identity--3f4c0b1b-0b1d-4b1b-8b1b-1b1b1b1b1b1b",
    "standard_id": "identity--3f4c0b1b-0b1d-4b1b-8b1b-1b1b1b1b1b1b",
    "entity_type": "identity",
    "parent_types": [
      "identity"
    ],
    "spec_version": "2.1",
    "identity_class": "individual",
    "name": "John Doe",
    "description": "An analyst.",
    "roles": [
      "analyst"
    ],
    "contact_information": "john.doe@example.com",
    "x_opencti_aliases": [],
    "created": "2023-01-01T12:00:00.000Z",
    "modified": "2023-01-01T12:00:00.000Z",
    "objectLabel": []
  },
  "objectOrganization": [],
  "objectMarking": [],
  "objectLabel": [],
  "externalReferences": [],
  "revoked": false,
  "confidence": 100,
  "created": "2023-10-27T10:30:00.000Z",
  "modified": "2023-10-27T10:30:00.000Z",
  "name": "Malicious IP Address",
  "description": "This indicator identifies a known malicious IP address.",
  "severity": 5,
  "priority": 1,
  "takedown_types": [],
  "objects": [],
  "importFiles": []
}
```
```

--------------------------------

### Initialize OpenCTI client using GoCTI

Source: https://context7.com/weisshorn-cyd/gocti/llms.txt

Sets up a new OpenCTI API client with authentication and health checks. Demonstrates basic error handling and connectivity verification. Inputs: server URL, API token; Outputs: initialized client or fatal log on error.

```Go
package main\n\nimport (\n    \"context\"\n    \"log\"\n    \"log/slog\"\n\n    \"github.com/weisshorn-cyd/gocti\"\n)\n\nfunc main() {\n    // Basic client creation\n    client, err := gocti.NewOpenCTIAPIClient(\n        \"http://localhost:8080\",\n        \"your_api_token_here\",\n        gocti.WithHealthCheck(),\n        gocti.WithDefaultTimeout(30 * time.Second),\n        gocti.WithLogLevel(slog.LevelInfo),\n    )\n    if err != nil {\n        log.Fatalf(\"Failed to create client: %v\", err)\n    }\n\n    // Verify connection with health check\n    ctx := context.Background()\n    if err := client.HealthCheck(ctx); err != nil {\n        log.Fatalf(\"Health check failed: %v\", err)\n    }\n\n    log.Println(\"Successfully connected to OpenCTI\")\n}\n
```

--------------------------------

### POST /graphql - Get Reports Query

Source: https://github.com/weisshorn-cyd/gocti/blob/main/entity/default_properties/report_default_properties.txt

GraphQL query endpoint for retrieving comprehensive report information including metadata, relationships, external references, and nested objects from the OpenCTI threat intelligence platform.

```APIDOC
## POST /graphql

### Description
Retrieves detailed threat intelligence reports with comprehensive metadata, relationships, external references, and nested objects from the OpenCTI platform.

### Method
POST

### Endpoint
/graphql

### Parameters
#### Path Parameters
- None

#### Query Parameters
- None

#### Request Body
- **query** (string) - Required - GraphQL query string
- **variables** (object) - Optional - Query variables object

### Request Example
{
  "query": "query GetReports($first: Int) { reports(first: $first) { edges { node { id standard_id entity_type created_at updated_at status { id template { id name color } } createdBy { ... on Identity { id standard_id entity_type name description roles } ... on Organization { x_opencti_organization_type } ... on Individual { x_opencti_firstname x_opencti_lastname } } objectMarking { id standard_id definition_type definition x_opencti_color } externalReferences { edges { node { id standard_id source_name description url hash external_id created modified importFiles { edges { node { id name size metaData { mimetype version } } } } } } } revoked x_opencti_reliability confidence created modified name description report_types published objects(all: true) { edges { node { ... on BasicObject { id entity_type parent_types } ... on StixObject { standard_id spec_version created_at updated_at } ... on AttackPattern { name } ... on Malware { name } ... on ThreatActor { name } ... on Indicator { name } } } } importFiles { edges { node { id name size metaData { mimetype version } } } } } } } }",
  "variables": { "first": 10 }
}

### Response
#### Success Response (200)
- **data** (object) - Contains the reports query results
- **reports** (object) - Reports collection with edges and nodes
- **edges** (array) - Array of report edges
- **node** (object) - Individual report object with all fields
- **errors** (array) - Array of GraphQL errors if any

#### Response Example
{
  "data": {
    "reports": {
      "edges": [
        {
          "node": {
            "id": "report-uuid-here",
            "standard_id": "report--uuid",
            "entity_type": "Report",
            "created_at": "2024-01-01T00:00:00.000Z",
            "updated_at": "2024-01-01T00:00:00.000Z",
            "status": {
              "id": "status-uuid",
              "template": {
                "id": "template-uuid",
                "name": "New",
                "color": "#ffffff"
              }
            },
            "createdBy": {
              "id": "identity-uuid",
              "standard_id": "identity--uuid",
              "entity_type": "Identity",
              "name": "Example Organization",
              "description": "Threat intelligence organization"
            },
            "name": "Monthly Threat Report",
            "description": "Comprehensive monthly threat analysis report",
            "report_types": ["threat-report"],
            "published": "2024-01-01T00:00:00.000Z",
            "objects": {
              "edges": [
                {
                  "node": {
                    "id": "malware-uuid",
                    "entity_type": "Malware",
                    "name": "Example Malware"
                  }
                }
              ]
            },
            "externalReferences": {
              "edges": [
                {
                  "node": {
                    "id": "ref-uuid",
                    "source_name": "External Source",
                    "description": "External reference",
                    "url": "https://example.com"
                  }
                }
              ]
            },
            "importFiles": {
              "edges": [
                {
                  "node": {
                    "id": "file-uuid",
                    "name": "report.pdf",
                    "size": 1024000,
                    "metaData": {
                      "mimetype": "application/pdf",
                      "version": "1.0"
                    }
                  }
                }
              ]
            }
          }
        }
      ]
    }
  }
}
```

--------------------------------

### Create Malware and Threat Actor Entities with GoCTI

Source: https://context7.com/weisshorn-cyd/gocti/llms.txt

Demonstrates creating a malware entity with detailed attributes and a threat actor group. Includes input construction and error handling. Inputs: entity details; Outputs: created entities with IDs and names.

```Go
package main\n\nimport (\n    \"context\"\n    \"log\"\n    \"time\"\n\n    \"github.com/weisshorn-cyd/gocti\"\n    \"github.com/weisshorn-cyd/gocti/entity\"\n)\n\nfunc main() {\n    client, _ := gocti.NewOpenCTIAPIClient("http://localhost:8080", "token")\n    ctx := context.Background()\n\n    // Create a malware entity with detailed attributes\n    firstSeen := time.Now().AddDate(0, -6, 0)\n    malware, err := client.CreateMalware(ctx, \"\", entity.MalwareAddInput{\n        Name:        \"ExampleRAT\",\n        Description: \"Remote Access Trojan used by APT groups\",\n        MalwareTypes: []string{\"remote-access-trojan\"},\n        IsFamily:    true,\n        FirstSeen:   &firstSeen,\n        Aliases:     []string{\"RAT-2024\", \"Example Trojan\"},\n        Confidence:  85,\n    })\n    if err != nil {\n        log.Fatalf(\"Failed to create malware: %v\", err)\n    }\n\n    log.Printf(\"Created malware: %s (ID: %s)\", malware.Name, malware.ID)\n\n    // Create a threat actor group\n    threatActor, err := client.CreateThreatActorGroup(ctx, \"\", entity.ThreatActorGroupAddInput{\n        Name:        \"APT-Example\",\n        Description: \"Advanced persistent threat group targeting financial sector\",\n        ThreatActorTypes: []string{\"crime-syndicate\"},\n        Sophistication:   \"advanced\",\n        ResourceLevel:    \"government\",\n        Confidence:       90,\n    })\n    if err != nil {\n        log.Fatalf(\"Failed to create threat actor: %v\", err)\n    }\n\n    log.Printf(\"Created threat actor: %s (ID: %s)\", threatActor.Name, threatActor.ID)\n}\n
```

--------------------------------

### File Upload and Entity Creation in Go

Source: https://context7.com/weisshorn-cyd/gocti/llms.txt

This Go code demonstrates how to upload a file and create an associated entity, such as a malware analysis report. It uses the 'gocti' package, specifically the 'api.File' struct to bundle file data with its metadata. The function reads a local file and sends it as part of a 'MalwareAnalysisAddInput'.

```go
package main

import (
    "context"
    "io/ioutil"
    "log"

    "github.com/weisshorn-cyd/gocti"
    "github.com/weisshorn-cyd/gocti/api"
    "github.com/weisshorn-cyd/gocti/entity"
)

func main() {
    client, _ := gocti.NewOpenCTIAPIClient("http://localhost:8080", "token")
    ctx := context.Background()

    // Read a malware sample file
    sampleData, err := ioutil.ReadFile("/path/to/malware_sample.exe")
    if err != nil {
        log.Fatalf("Failed to read file: %v", err)
    }

    // Create malware analysis with file upload
    analysis, err := client.CreateMalwareAnalysis(ctx, "", entity.MalwareAnalysisAddInput{
        Name:        "Sample Analysis 2024-01",
        Description: "Behavioral analysis of ExampleRAT variant",
        Result:      "malicious",
        AnalysisScoId: []string{"analysis-123"},
        Sample: api.File{
            Name: "malware_sample.exe",
            Data: sampleData,
            MIME: "application/x-msdownload",
        },
    })
    if err != nil {
        log.Fatalf("Failed to create malware analysis: %v", err)
    }

    log.Printf("Created malware analysis: %s (ID: %s)", analysis.Name, analysis.ID)
}
```

--------------------------------

### Query OpenCTI Platform Data (Go)

Source: https://github.com/weisshorn-cyd/gocti/blob/main/README.md

Demonstrates how to execute a GraphQL query against the OpenCTI platform using the `Query` method available on the client object.  It returns a map containing queried values.

```go
func (client *OpenCTIAPIClient) Query(
	ctx context.Context,
	query string,
	variables any,
) (map[string]any, error)
```

--------------------------------

### Create a New OpenCTI API Client (Go)

Source: https://github.com/weisshorn-cyd/gocti/blob/main/README.md

Shows how to create a new OpenCTI API client using the `gocti.NewOpenCTIAPIClient` function. It highlights options like health check and requires a URL and authentication token.

```go
client, err := gocti.NewOpenCTIAPIClient(
	"http://localhost:8080",
	"my_secret_token",
    gocti.WithHealthCheck(),
)
```

--------------------------------

### Fetch Tools with Filters and Pagination

Source: https://github.com/weisshorn-cyd/gocti/blob/main/entity/list_queries/tool_list_query.txt

Queries tools with support for filters, ordering, and pagination. The response includes tool nodes and pagination metadata. The fields returned for each tool are dynamically inserted using a placeholder.

```GraphQL
query ($after: ID
       $filters: FilterGroup
       $first: Int
       $orderBy: ToolsOrdering
       $orderMode: OrderingMode
       $search: String
       $toStix: Boolean) {
    tools (after: $after
           filters: $filters
           first: $first
           orderBy: $orderBy
           orderMode: $orderMode
           search: $search
           toStix: $toStix) {
        edges {
            node {%s}
        }
        pageInfo {
            startCursor
            endCursor
            hasNextPage
            hasPreviousPage
            globalCount
        }
    }
}
```

--------------------------------

### User Impersonation in Go

Source: https://context7.com/weisshorn-cyd/gocti/llms.txt

This Go code snippet demonstrates how to perform user impersonation for administrative operations. It uses the 'gocti' package to set up impersonation for a specific query, allowing actions to be performed on behalf of another user. This is useful for testing or executing tasks with specific user permissions.

```go
package main

import (
    "context"
    "log"

    "github.com/weisshorn-cyd/gocti"
    "github.com/weisshorn-cyd/gocti/entity"
)

func main() {
    client, _ := gocti.NewOpenCTIAPIClient("http://localhost:8080", "admin_token")
    ctx := context.Background()

    // Set up impersonation for next query only
    err := client.Impersonate(ctx, "analyst_user")
    if err != nil {
        log.Fatalf("Failed to set up impersonation: %v", err)
    }

    // This query will be executed as "analyst_user"
    reports, err := client.ListReports(ctx, "id, name, created_by", true, nil)
    if err != nil {
        log.Fatalf("Failed to list reports: %v", err)
    }

    log.Printf("Found %d reports visible to analyst_user", len(reports))

    // Subsequent queries will use the original admin credentials
    users, err := client.ListUsers(ctx, "id, name", true, nil)
    if err != nil {
        log.Fatalf("Failed to list users: %v", err)
    }

    log.Printf("System has %d users", len(users))
}
```

--------------------------------

### Updating Supported OpenCTI Version (Makefile)

Source: https://github.com/weisshorn-cyd/gocti/blob/main/README.md

Provides a checklist of file updates and actions to perform when updating the supported OpenCTI version.

```makefile
- Update the [docker-compose](./docker-compose.yml) file
- Update the pycti version in [project.toml](./tools/gocti_type_generator/pyproject.toml)
- Update the [changelog](./CHANGELOG.md) with: `- Support OpenCTI version X.Y.Z`
- Update the version in the [readme](./README.md)
- Regenerate the files through `make generate`
```

--------------------------------

### List with Pagination - Go

Source: https://context7.com/weisshorn-cyd/gocti/llms.txt

Implements cursor-based pagination for handling large entity collections in OpenCTI. Uses the gocti client with GraphQL pagination support to iterate through all indicators efficiently. Tracks page information including end cursor and next page status. Continues fetching until no more results are available, aggregating all results into a single collection.

```go
package main

import (
    "context"
    "log"

    "github.com/weisshorn-cyd/gocti"
    "github.com/weisshorn-cyd/gocti/graphql"
    "github.com/weisshorn-cyd/gocti/list"
)

func main() {
    client, _ := gocti.NewOpenCTIAPIClient("http://localhost:8080", "token")
    ctx := context.Background()

    // Paginate through all indicators
    var allIndicators []entity.Indicator
    pageInfo := &graphql.PageInfo{}
    hasNextPage := true

    for hasNextPage {
        indicators, err := client.ListIndicators(
            ctx,
            "id, name, pattern, pattern_type",
            false,
            pageInfo,
            list.WithFirst(100),
            list.WithOrderBy("created_at"),
            list.WithAfter(pageInfo.EndCursor),
        )
        if err != nil {
            log.Fatalf("Failed to list indicators: %v", err)
        }

        allIndicators = append(allIndicators, indicators...)

        // Update pagination state
        if pageInfo.HasNextPage && pageInfo.EndCursor != "" {
            hasNextPage = true
        } else {
            hasNextPage = false
        }

        log.Printf("Retrieved %d indicators (Total: %d)", len(indicators), len(allIndicators))
    }

    log.Printf("Total indicators retrieved: %d", len(allIndicators))
}
```

--------------------------------

### Fetch Channels with GraphQL

Source: https://github.com/weisshorn-cyd/gocti/blob/main/entity/list_queries/channel_list_query.txt

This GraphQL query fetches channels with optional pagination, filtering, ordering, and search capabilities. The input parameters include 'after', 'filters', 'first', 'orderBy', 'orderMode' and 'search'. The response includes 'edges' and 'pageInfo'.

```graphql
query ($after: ID
       $filters: FilterGroup
       $first: Int
       $orderBy: ChannelsOrdering
       $orderMode: OrderingMode
       $search: String) {
    channels (after: $after
              filters: $filters
              first: $first
              orderBy: $orderBy
              orderMode: $orderMode
              search: $search) {
        edges {
            node {%s}
        }
        pageInfo {
            startCursor
            endCursor
            hasNextPage
            hasPreviousPage
            globalCount
        }
    }
}
```

--------------------------------

### Advanced Filtering with Complex Conditions in Go

Source: https://context7.com/weisshorn-cyd/gocti/llms.txt

This Go code demonstrates how to build sophisticated queries with nested filter groups and multiple operators. It requires the 'gocti/list' package and interacts with the OpenCTI API client. The function takes a context and filter criteria as input, returning a list of indicators or an error.

```go
package main

import (
    "context"
    "log"
    "time"

    "github.com/weisshorn-cyd/gocti"
    "github.com/weisshorn-cyd/gocti/list"
)

func main() {
    client, _ := gocti.NewOpenCTIAPIClient("http://localhost:8080", "token")
    ctx := context.Background()

    // Complex filter: Find high-confidence indicators from last 30 days
    // that are either IPs or domains and not revoked
    thirtyDaysAgo := time.Now().AddDate(0, 0, -30)

    indicators, err := client.ListIndicators(
        ctx,
        "id, name, pattern, pattern_type, confidence, revoked, created_at",
        true,
        nil,
        list.WithFilters(list.FilterGroup{
            Mode: list.FilterModeAnd,
            Filters: []list.Filter{
                {
                    Key:      []string{"created_at"},
                    Operator: list.FilterOperatorGt,
                    Values:   []any{thirtyDaysAgo.Format(time.RFC3339)},
                },
                {
                    Key:      []string{"confidence"},
                    Operator: list.FilterOperatorGte,
                    Values:   []any{80},
                },
                {
                    Key:      []string{"revoked"},
                    Operator: list.FilterOperatorEq,
                    Values:   []any{false},
                },
            },
            FilterGroups: []list.FilterGroup{
                {
                    Mode: list.FilterModeOr,
                    Filters: []list.Filter{
                        {
                            Key:      []string{"pattern_type"},
                            Operator: list.FilterOperatorEq,
                            Values:   []any{"stix", "ipv4-addr"},
                        },
                        {
                            Key:      []string{"pattern_type"},
                            Operator: list.FilterOperatorEq,
                            Values:   []any{"stix", "domain-name"},
                        },
                    },
                },
            },
        }),
    )
    if err != nil {
        log.Fatalf("Failed to query indicators: %v", err)
    }

    log.Printf("Found %d high-confidence network indicators", len(indicators))
    for _, ind := range indicators {
        log.Printf("- %s: %s (Confidence: %d)", ind.PatternType, ind.Pattern, ind.Confidence)
    }
}
```

--------------------------------

### GraphQL Languages Query with Pagination and Filters

Source: https://github.com/weisshorn-cyd/gocti/blob/main/entity/list_queries/language_list_query.txt

This query fetches languages using pagination (after, first), filters (FilterGroup), ordering (LanguagesOrdering, OrderingMode), and search (String). It returns edges with nodes containing specified fields (placeholder %s) and pageInfo for cursors, page flags, and global count. Dependencies include a GraphQL endpoint supporting these input types; outputs are structured as edges and pageInfo objects. Limitations: Requires proper field selection in %s and handling of null cursors for initial loads.

```graphql
query ($after: ID
       $filters: FilterGroup
       $first: Int
       $orderBy: LanguagesOrdering
       $orderMode: OrderingMode
       $search: String) {
    languages (after: $after
               filters: $filters
               first: $first
               orderBy: $orderBy
               orderMode: $orderMode
               search: $search) {
        edges {
            node {%s}
        }
        pageInfo {
            startCursor
            endCursor
            hasNextPage
            hasPreviousPage
            globalCount
        }
    }
}
```

--------------------------------

### Read Entity by ID - Go

Source: https://context7.com/weisshorn-cyd/gocti/llms.txt

Retrieves specific OpenCTI entities by their unique identifiers using the gocti client. Demonstrates reading both malware and indicator entities with custom field selection. Supports partial field retrieval to optimize query performance. Includes error handling for failed read operations and logging of retrieved entity properties including creation timestamps and confidence scores.

```go
package main

import (
    "context"
    "log"

    "github.com/weisshorn-cyd/gocti"
)

func main() {
    client, _ := gocti.NewOpenCTIAPIClient("http://localhost:8080", "token")
    ctx := context.Background()

    // Read a specific malware by ID
    malwareID := "malware--a1b2c3d4-e5f6-7890-abcd-ef1234567890"
    malware, err := client.ReadMalware(ctx, "", malwareID)
    if err != nil {
        log.Fatalf("Failed to read malware: %v", err)
    }

    log.Printf("Malware: %s", malware.Name)
    log.Printf("Description: %s", malware.Description)
    log.Printf("Created: %s", malware.CreatedAt)
    log.Printf("Confidence: %d", malware.Confidence)

    // Read with custom attributes (only specific fields)
    indicator, err := client.ReadIndicator(
        ctx,
        "id, name, pattern, pattern_type, valid_from, created_at",
        "indicator--12345678-1234-1234-1234-123456789012",
    )
    if err != nil {
        log.Fatalf("Failed to read indicator: %v", err)
    }

    log.Printf("Indicator: %s (%s)", indicator.Name, indicator.PatternType)
}
```

--------------------------------

### ObjectMarking Structure

Source: https://github.com/weisshorn-cyd/gocti/blob/main/entity/default_properties/campaign_default_properties.txt

Describes the structure of the objectMarking data.

```APIDOC
## ObjectMarking Structure

### Description
Describes the structure of the objectMarking data.

### Fields
#### id (string) - Required - Unique identifier
#### standard_id (string) - Optional - Standard identifier
#### entity_type (string) - Required - Type of entity
#### definition_type (string) - Required - Definition type
#### definition (string) - Required - Definition
#### created (datetime) - Required - Creation timestamp
#### modified (datetime) - Required - Last updated timestamp
#### x_opencti_order (string) - Optional - Order
#### x_opencti_color (string) - Optional - Color

```

--------------------------------

### QUERY /labels

Source: https://github.com/weisshorn-cyd/gocti/blob/main/entity/list_queries/label_list_query.txt

Retrieves a list of labels with pagination support. Supports filtering, search, and custom ordering. Returns paginated results with cursor-based navigation.

```APIDOC
## QUERY /labels

### Description
Retrieves a list of labels with comprehensive filtering, search, and pagination capabilities. Returns paginated results with cursor-based navigation and metadata.

### Method
QUERY

### Endpoint
/labels

### Parameters
#### Query Parameters
- **after** (ID) - Optional - Cursor for pagination, fetch results after this cursor
- **filters** (FilterGroup) - Optional - Filter criteria to apply to the labels query
- **first** (Int) - Optional - Number of results to return per page
- **orderBy** (LabelsOrdering) - Optional - Field to order results by
- **orderMode** (OrderingMode) - Optional - Ordering direction (ASC or DESC)
- **search** (String) - Optional - Search term to filter labels

#### Request Body
- **query** (String) - Required - GraphQL query string
- **variables** (Object) - Optional - Variables for the GraphQL query

### Request Example
{
  "query": "query ($after: ID, $filters: FilterGroup, $first: Int, $orderBy: LabelsOrdering, $orderMode: OrderingMode, $search: String) { labels(after: $after, filters: $filters, first: $first, orderBy: $orderBy, orderMode: $orderMode, search: $search) { edges { node { ... } } pageInfo { startCursor endCursor hasNextPage hasPreviousPage globalCount } } }",
  "variables": {
    "first": 10,
    "search": "example"
  }
}

### Response
#### Success Response (200)
- **edges** (Array) - List of label nodes
- **pageInfo** (Object) - Pagination metadata containing cursor information
  - **startCursor** (String) - Cursor for the first item
  - **endCursor** (String) - Cursor for the last item
  - **hasNextPage** (Boolean) - Indicates if there are more pages
  - **hasPreviousPage** (Boolean) - Indicates if there are previous pages
  - **globalCount** (Int) - Total number of items

#### Response Example
{
  "data": {
    "labels": {
      "edges": [
        {
          "node": {
            "id": "label-1",
            "name": "Example Label"
          }
        }
      ],
      "pageInfo": {
        "startCursor": "cursor-1",
        "endCursor": "cursor-10",
        "hasNextPage": true,
        "hasPreviousPage": false,
        "globalCount": 42
      }
    }
  }
}
```

--------------------------------

### QUERY /graphql/tools

Source: https://github.com/weisshorn-cyd/gocti/blob/main/entity/list_queries/tool_list_query.txt

Query tools with advanced filtering, pagination, and ordering options. Supports searching and STIX format conversion.

```APIDOC
## QUERY /graphql/tools

### Description
GraphQL query endpoint for retrieving tools with comprehensive filtering, pagination, ordering, and search capabilities. Supports conversion to STIX format.

### Method
QUERY

### Endpoint
/graphql/tools

### Parameters
#### Query Parameters
- **after** (ID) - Optional - Cursor for pagination, fetch results after this ID
- **filters** (FilterGroup) - Optional - Filter criteria for tools
- **first** (Int) - Optional - Number of results to return per page
- **orderBy** (ToolsOrdering) - Optional - Field to order results by
- **orderMode** (OrderingMode) - Optional - Ordering direction (ASC or DESC)
- **search** (String) - Optional - Search term to filter tools
- **toStix** (Boolean) - Optional - Convert results to STIX format

### Request Example
query ($after: ID, $filters: FilterGroup, $first: Int, $orderBy: ToolsOrdering, $orderMode: OrderingMode, $search: String, $toStix: Boolean) {
  tools(after: $after, filters: $filters, first: $first, orderBy: $orderBy, orderMode: $orderMode, search: $search, toStix: $toStix) {
    edges {
      node {%s}
    }
    pageInfo {
      startCursor
      endCursor
      hasNextPage
      hasPreviousPage
      globalCount
    }
  }
}

### Response
#### Success Response (200)
- **edges** (array) - List of tool nodes
- **pageInfo** (object) - Pagination information
  - **startCursor** (string) - Cursor for the first item
  - **endCursor** (string) - Cursor for the last item
  - **hasNextPage** (boolean) - Indicates if more pages are available
  - **hasPreviousPage** (boolean) - Indicates if previous pages are available
  - **globalCount** (integer) - Total number of items

#### Response Example
{
  "data": {
    "tools": {
      "edges": [
        {
          "node": {
            // Tool data fields
          }
        }
      ],
      "pageInfo": {
        "startCursor": "cursor1",
        "endCursor": "cursor2",
        "hasNextPage": true,
        "hasPreviousPage": false,
        "globalCount": 100
      }
    }
  }
}
```
Tokens:
Raw