misp_search_galaxy_clusters

Instructions

Implementation Reference

• src/tools/galaxies.ts:123-182 (handler)

  The tool handler for 'misp_search_galaxy_clusters' implementing the search logic. Defines the handler function that receives search and optional galaxyType, calls client.searchGalaxyClusters(), formats results, and returns them.

  // Search galaxy clusters
  server.tool(
    "misp_search_galaxy_clusters",
    "Search galaxy clusters by keyword (find specific MITRE ATT&CK techniques, threat actors, malware, etc.)",
    {
      search: z
        .string()
        .describe(
          "Search term (e.g., 'phishing', 'APT28', 'ransomware', 'T1566')"
        ),
      galaxyType: z
        .string()
        .optional()
        .describe(
          "Limit to a specific galaxy type (e.g., mitre-attack-pattern, mitre-intrusion-set)"
        ),
    },
    async ({ search, galaxyType }) => {
      try {
        const results = await client.searchGalaxyClusters(search, galaxyType);
  
        if (results.length === 0) {
          return {
            content: [
              {
                type: "text",
                text: `No galaxy clusters found matching "${search}".`,
              },
            ],
          };
        }
  
        const summary = results.map((c) => ({
          id: c.id,
          galaxy_id: c.galaxy_id,
          value: c.value,
          description:
            c.description && c.description.length > 200
              ? c.description.slice(0, 200) + "..."
              : c.description,
          tag_name: c.tag_name,
          type: c.type,
        }));
  
        return {
          content: [{ type: "text", text: JSON.stringify(summary, null, 2) }],
        };
      } catch (err) {
        return {
          content: [
            {
              type: "text",
              text: `Error searching galaxy clusters: ${err instanceof Error ? err.message : String(err)}`,
            },
          ],
          isError: true,
        };
      }
    }
  );

• src/tools/galaxies.ts:127-139 (schema)

  Input schema for the tool: 'search' (required string) and 'galaxyType' (optional string) parameters with descriptions.

  {
    search: z
      .string()
      .describe(
        "Search term (e.g., 'phishing', 'APT28', 'ransomware', 'T1566')"
      ),
    galaxyType: z
      .string()
      .optional()
      .describe(
        "Limit to a specific galaxy type (e.g., mitre-attack-pattern, mitre-intrusion-set)"
      ),
  },

• src/tools/galaxies.ts:124-182 (registration)

  Tool registration via server.tool() with name 'misp_search_galaxy_clusters', description, input schema, and handler. The registration is part of the registerGalaxyTools() function called from index.ts.

  server.tool(
    "misp_search_galaxy_clusters",
    "Search galaxy clusters by keyword (find specific MITRE ATT&CK techniques, threat actors, malware, etc.)",
    {
      search: z
        .string()
        .describe(
          "Search term (e.g., 'phishing', 'APT28', 'ransomware', 'T1566')"
        ),
      galaxyType: z
        .string()
        .optional()
        .describe(
          "Limit to a specific galaxy type (e.g., mitre-attack-pattern, mitre-intrusion-set)"
        ),
    },
    async ({ search, galaxyType }) => {
      try {
        const results = await client.searchGalaxyClusters(search, galaxyType);
  
        if (results.length === 0) {
          return {
            content: [
              {
                type: "text",
                text: `No galaxy clusters found matching "${search}".`,
              },
            ],
          };
        }
  
        const summary = results.map((c) => ({
          id: c.id,
          galaxy_id: c.galaxy_id,
          value: c.value,
          description:
            c.description && c.description.length > 200
              ? c.description.slice(0, 200) + "..."
              : c.description,
          tag_name: c.tag_name,
          type: c.type,
        }));
  
        return {
          content: [{ type: "text", text: JSON.stringify(summary, null, 2) }],
        };
      } catch (err) {
        return {
          content: [
            {
              type: "text",
              text: `Error searching galaxy clusters: ${err instanceof Error ? err.message : String(err)}`,
            },
          ],
          isError: true,
        };
      }
    }
  );

• src/client.ts:567-580 (helper)

  The MispClient.searchGalaxyClusters() helper method that makes the actual HTTP POST request to /galaxy_clusters/restSearch with searchall and optional context parameters, returning parsed MispGalaxyCluster objects.

  async searchGalaxyClusters(
    search: string,
    galaxyType?: string
  ): Promise<MispGalaxyCluster[]> {
    const body: Record<string, unknown> = {
      searchall: search,
    };
    if (galaxyType) body.context = galaxyType;
  
    const data = await this.request<
      Array<{ GalaxyCluster: MispGalaxyCluster }>
    >("POST", "/galaxy_clusters/restSearch", body);
    return (data || []).map((c) => c.GalaxyCluster);
  }

• src/types.ts:109-117 (helper)

  The MispGalaxyCluster interface type definition used by the tool, containing fields: id, uuid, type, value, tag_name, description, galaxy_id.

  export interface MispGalaxyCluster {
    id: string;
    uuid: string;
    type: string;
    value: string;
    tag_name: string;
    description: string;
    galaxy_id: string;
  }