{"id":45053654,"url":"https://github.com/weisshorn-cyd/gocti","last_synced_at":"2026-02-19T09:20:12.967Z","repository":{"id":268671873,"uuid":"899098753","full_name":"weisshorn-cyd/gocti","owner":"weisshorn-cyd","description":"Unofficial OpenCTI Golang Client","archived":false,"fork":false,"pushed_at":"2026-02-12T04:35:49.000Z","size":1641,"stargazers_count":13,"open_issues_count":3,"forks_count":1,"subscribers_count":3,"default_branch":"main","last_synced_at":"2026-02-12T14:25:25.214Z","etag":null,"topics":["cyber-threat-intelligence","go","golang","opencti"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/weisshorn-cyd.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-12-05T16:07:58.000Z","updated_at":"2026-02-04T16:19:56.000Z","dependencies_parsed_at":"2025-12-11T13:07:59.140Z","dependency_job_id":null,"html_url":"https://github.com/weisshorn-cyd/gocti","commit_stats":null,"previous_names":["weisshorn-cyd/gocti"],"tags_count":62,"template":false,"template_full_name":null,"purl":"pkg:github/weisshorn-cyd/gocti","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/weisshorn-cyd%2Fgocti","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/weisshorn-cyd%2Fgocti/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/weisshorn-cyd%2Fgocti/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/weisshorn-cyd%2Fgocti/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/weisshorn-cyd","download_url":"https://codeload.github.com/weisshorn-cyd/gocti/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/weisshorn-cyd%2Fgocti/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29609524,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-19T06:47:36.664Z","status":"ssl_error","status_checked_at":"2026-02-19T06:45:47.551Z","response_time":117,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cyber-threat-intelligence","go","golang","opencti"],"created_at":"2026-02-19T09:20:12.325Z","updated_at":"2026-02-19T09:20:12.952Z","avatar_url":"https://github.com/weisshorn-cyd.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n    \u003cpicture\u003e\n      \u003cimg alt=\"GoCTI Banner\" title=\"GoCTI Banner\" src=\"docs/assets/banner.png\" width=800\u003e\n    \u003c/picture\u003e\n\u003c/p\u003e\n\n# GoCTI\n\nUnofficial [OpenCTI](https://github.com/OpenCTI-Platform/opencti) Go client. GoCTI is under development, hence breaking changes are to be expected until a version 1.0.0 is released.\n\nGoCTI is currently compatible with OpenCTI version 6.9.20.\n\nLike with [pycti](https://github.com/OpenCTI-Platform/client-python), the OpenCTI platform version supported by GoCTI should exactly match the version of your OpenCTI instance.\nNo guarantees can be made with regards to back and forwards compatibility.\n\nFeedback and suggestions are welcome through Github issues.\n\n## Quick Start\n\n```bash\ngo get github.com/weisshorn-cyd/gocti\n```\n\n### Create a new Client\n\n```go\n// The client supports additional options: See api/options.go\nclient, err := gocti.NewOpenCTIAPIClient(\n\t\"http://localhost:8080\",\n\t\"my_secret_token\",\n    gocti.WithHealthCheck(),\n)\n```\n\n### Interact with Platform Data\n\nThe client holds a basic `Query` method to make any GraphQl query to OpenCTI:\n\n```go\nfunc (client *OpenCTIAPIClient) Query(\n\tctx context.Context,\n\tquery string,\n\tvariables any,\n) (map[string]any, error)\n```\n\nEntities have their own methods for creation, deletion, listing, and reading. These return a (list of) structs representing the target entity.\nThese are also methods held by the client.\nFor example, to create a malware entity:\n\n```go\nmalware, err := client.CreateMalware(ctx, \"\", entity.MalwareAddInput{\n\tName:        \"Example Malware\",\n\tDescription: \"An example of a very malicious malware.\",\n})\n```\n\nEach method has a `customAttributes` field which specifies which GraphQL attributes the underlying query should return.\nFor methods that return specific Go types (e.g. the `CreateMalware` method above), this indicates which fields of the return value will be set. If the empty string is provided as value for `customAttributes`, then the default attributes will be set for these methods. These are defined for each type.\n\nList methods have a boolean parameter `getAll`. If set to `true`, the method will return everything in the platform that matches the underlying query. In case the query returns large amounts of data, it is recommended to set it to `false` and use the paginated list approach instead.\n\nGeneric and structured methods to list, read, create, and delete data are available through the `api` package. These methods can be used on the fly to add functionality to GoCTI that is missing for your specific use case.\n\n### Entities\n\nThe entities that are implemented can be found under the [entity](./entity) folder. They more or less match what is available via [pycti](https://github.com/OpenCTI-Platform/client-python).\n\n### System Management\n\nAdditional entities have been implemented for platform management. Some of them have special methods attached to perform specific tasks (see [system/utils.go](system/utils.go)).\n\n## Examples\n\nExamples are provided in the [examples](./examples/) folder:\n\n- `entity_creation` shows what is considered as common usage of GoCTI\n- `list_report_ips` highlights current limitations and how to circumvent them by customizing GoCTI on the fly\n- `system_management` is an example of GoCTI's system management capabilities\n- `pagination` shows how to list data with pagination\n- `custom_struct_parsing` shows how to use custom structs and automated parsing to query exactly what data you need from the server\n- `decode_graphql_interface` shows how to convert a field of type GraphQL interface into an implementation and back\n\n## GoCTI design principles\n\nGoCTI code is partially generated using GraphQL introspection.\n\nThe aim is to provide the most common functionality out of the box, i.e. the user should not have to write a GraphQL query or know of specific GraphQL types or interfaces for most use cases. There should be no ambiguity as to which fields are supported by a given object.\n\nAt the same time, GoCTI can be extended on the fly to cater for more niche or precise usage scenarios.\n\nGoCTI does not directly reason about [STIX](https://www.oasis-open.org/standard/stix-version-2-1/), it only considers the data schema implemented in OpenCTI.\n\n## Development\n\nA [makefile](./Makefile) provides targets useful for development.\n\n### Changelog\n\nEach pull request must update the `[Unreleased]` entry in the [changelog](./CHANGELOG.md).\n\n### Updating supported OpenCTI version\n\nWhen updating the supported OpenCTI version:\n- Update the [docker-compose](./docker-compose.yml) file\n- Update the pycti version in [project.toml](./tools/gocti_type_generator/pyproject.toml)\n- Update the [changelog](./CHANGELOG.md) with: `- Support OpenCTI version X.Y.Z`\n- Update the version in the [readme](./README.md)\n- Regenerate the files through `make generate`\n\n### Release a new version of GoCTI\n\nThe source of truth for the GoCTI version is the [changelog file](./CHANGELOG.md).\n\nTo create a release, open a pull request:\n- Change the `[Unreleased]` section in the [changelog](./CHANGELOG.md) into the corresponding version `[X.Y.Z] - YYYY-MM-DD`\n- Update the version information in [gocti.go](./gocti.go) and [project.toml](./tools/gocti_type_generator/pyproject.toml) accordingly\n- Assign the label `release` to the pull request\n- A new release will be created on merge by the [release action](./.github/workflows/create-release.yml)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fweisshorn-cyd%2Fgocti","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fweisshorn-cyd%2Fgocti","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fweisshorn-cyd%2Fgocti/lists"}