misp_attach_galaxy_cluster

Instructions

Implementation Reference

• src/tools/galaxies.ts:184-220 (handler)

  Registers the 'misp_attach_galaxy_cluster' MCP tool handler with Zod schema validation for targetType (event or attribute), targetId, and galaxyClusterId, calling client.attachGalaxyCluster.

  // Attach galaxy cluster to event
  server.tool(
    "misp_attach_galaxy_cluster",
    "Attach a galaxy cluster (MITRE ATT&CK technique, threat actor, etc.) to an event or attribute",
    {
      targetType: z
        .enum(["event", "attribute"])
        .describe("Attach to an event or attribute"),
      targetId: z.string().describe("Event ID or attribute ID"),
      galaxyClusterId: z
        .string()
        .describe("Galaxy cluster ID to attach"),
    },
    async ({ targetType, targetId, galaxyClusterId }) => {
      try {
        await client.attachGalaxyCluster(targetType, targetId, galaxyClusterId);
        return {
          content: [
            {
              type: "text",
              text: `Galaxy cluster ${galaxyClusterId} attached to ${targetType} ${targetId}.`,
            },
          ],
        };
      } catch (err) {
        return {
          content: [
            {
              type: "text",
              text: `Error attaching galaxy cluster: ${err instanceof Error ? err.message : String(err)}`,
            },
          ],
          isError: true,
        };
      }
    }
  );

• src/tools/galaxies.ts:188-196 (schema)

  Zod schema defining input parameters: targetType (enum event/attribute), targetId (string), galaxyClusterId (string).

  {
    targetType: z
      .enum(["event", "attribute"])
      .describe("Attach to an event or attribute"),
    targetId: z.string().describe("Event ID or attribute ID"),
    galaxyClusterId: z
      .string()
      .describe("Galaxy cluster ID to attach"),
  },

• src/tools/galaxies.ts:184-220 (registration)

  Registration of the tool via server.tool() inside registerGalaxyTools(), which is called from src/index.ts line 39.

  // Attach galaxy cluster to event
  server.tool(
    "misp_attach_galaxy_cluster",
    "Attach a galaxy cluster (MITRE ATT&CK technique, threat actor, etc.) to an event or attribute",
    {
      targetType: z
        .enum(["event", "attribute"])
        .describe("Attach to an event or attribute"),
      targetId: z.string().describe("Event ID or attribute ID"),
      galaxyClusterId: z
        .string()
        .describe("Galaxy cluster ID to attach"),
    },
    async ({ targetType, targetId, galaxyClusterId }) => {
      try {
        await client.attachGalaxyCluster(targetType, targetId, galaxyClusterId);
        return {
          content: [
            {
              type: "text",
              text: `Galaxy cluster ${galaxyClusterId} attached to ${targetType} ${targetId}.`,
            },
          ],
        };
      } catch (err) {
        return {
          content: [
            {
              type: "text",
              text: `Error attaching galaxy cluster: ${err instanceof Error ? err.message : String(err)}`,
            },
          ],
          isError: true,
        };
      }
    }
  );

• src/client.ts:582-595 (helper)

  Client helper method that sends a POST request to /galaxies/attachCluster/{targetId}/{targetType} with the galaxy cluster ID in the body.

  async attachGalaxyCluster(
    targetType: "event" | "attribute",
    targetId: string,
    galaxyClusterId: string
  ): Promise<unknown> {
    if (!ID_PATTERN.test(galaxyClusterId)) {
      throw new Error(`Invalid galaxyClusterId: ${JSON.stringify(galaxyClusterId)}`);
    }
    return this.request(
      "POST",
      `/galaxies/attachCluster/${encodeId(targetId, "targetId")}/${targetType}`,
      { Galaxy: { target_id: galaxyClusterId } }
    );
  }

• src/index.ts:39-39 (registration)

  Top-level registration call in the main entry point that wires up the galaxy tools including misp_attach_galaxy_cluster.

  registerGalaxyTools(server, client);