Data Model Reference¶

Complete reference of all data models used by the MySecutec CLI, mapped to their Go struct definitions in internal/models/.

Core Models¶

Asset (`internal/models/asset.go`)¶

{
  "id": "uuid-string",
  "type": "domain",
  "name": "example.com",
  "version": "1.0",
  "note": "User note",
  "public_facing": true,
  "business_value": 5,
  "identifying_properties": { "key": "value" },
  "tech_solutions": [{ "name": "Scanner", "version": "1.0" }],
  "threat_summaries": {
    "total": 12,
    "critical": 1,
    "high": 3,
    "medium": 5,
    "low": 2,
    "info": 1
  },
  "created_at": "2025-01-15T10:30:00Z",
  "updated_at": "2025-06-20T14:22:00Z",
  "deleted": false,
  "deleted_at": null
}

Go Field	JSON Field	Type	Description
`ID`	`id`	string	UUID identifier
`Type`	`type`	string	Asset type (domain, hardware, ip, operating_system, person, service, software, subdomain, tenant, web_entity)
`Name`	`name`	string	Display name
`Version`	`version`	*string	Version string
`Note`	`note`	*string	User-provided note
`PublicFacing`	`public_facing`	bool	Public-facing flag
`BusinessValue`	`business_value`	int	Business value (0-5)
`IdentifyingProperties`	`identifying_properties`	map[string]any	Key-value properties
`TechSolutions`	`tech_solutions`	[]TechSolution	Associated tech solutions
`ThreatSummaries`	`threat_summaries`	*ThreatSummary	Aggregated threat counts
`CreatedAt`	`created_at`	FlexTime	Creation timestamp
`UpdatedAt`	`updated_at`	FlexTime	Update timestamp
`Deleted`	`deleted`	bool	Soft-delete flag
`DeletedAt`	`deleted_at`	*FlexTime	Deletion timestamp

AssetPatch¶

Go Field	JSON Field	Type	Description
`Note`	`note`	*string	Updated note
`PublicFacing`	`public_facing`	*bool	Updated public-facing
`BusinessValue`	`business_value`	*int	Updated business value

TechSolution¶

Go Field	JSON Field	Type	Description
`Name`	`name`	string	Solution name
`Version`	`version`	string	Solution version

ThreatSummary¶

Go Field	JSON Field	Type	Description
`Total`	`total`	int	Total threat count
`Critical`	`critical`	int	Critical threats
`High`	`high`	int	High threats
`Medium`	`medium`	int	Medium threats
`Low`	`low`	int	Low threats
`Info`	`info`	int	Info threats

Threat (`internal/models/threat.go`)¶

{
  "id": "uuid-string",
  "name": "CVE-2024-1234",
  "description": "Full description...",
  "note": null,
  "external_id": "CVE-2024-1234",
  "cvss_score": 9.8,
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "critical",
  "cvss_category": { "code": "critical", "label": "Critical" },
  "days_to_remediate": 15,
  "risk_priority_score": 95.5,
  "status": "unsolved",
  "system_status": "unsolved",
  "user_status": null,
  "unsolved_annotation_note": null,
  "first_seen_at": "2025-03-01T12:00:00Z",
  "status_updated_at": "2025-03-01T12:00:00Z",
  "created_at": "2025-03-01T12:00:00Z",
  "updated_at": "2025-03-01T12:00:00Z",
  "asset_id": "asset-uuid",
  "asset": { "id": "asset-uuid", "name": "example.com", "type": "domain" },
  "tech_solution": {
    "tech_solution_slug": "asm-scanner",
    "license_module_slug": "asm",
    "source_data": {}
  },
  "data": {}
}

Go Field	JSON Field	Type	Description
`ID`	`id`	string	UUID identifier
`Name`	`name`	string	Threat name
`Description`	`description`	string	Full description
`Note`	`note`	*string	User note
`ExternalID`	`external_id`	string	External reference
`CVSSScore`	`cvss_score`	*float64	CVSS score (0-10)
`CVSSVector`	`cvss_vector`	*string	CVSS vector string
`Severity`	`severity`	*string	Severity level
`CVSSCategory`	`cvss_category`	*CVSSCategory	Category object
`DaysToRemediate`	`days_to_remediate`	int	Days to remediate
`RiskPriorityScore`	`risk_priority_score`	float64	Risk priority score
`Status`	`status`	string	Combined status
`SystemStatus`	`system_status`	string	System status
`UserStatus`	`user_status`	*string	User status
`UnsolvedAnnotationNote`	`unsolved_annotation_note`	*string	Annotation
`FirstSeenAt`	`first_seen_at`	*FlexTime	First detection
`StatusUpdatedAt`	`status_updated_at`	*FlexTime	Last status change
`CreatedAt`	`created_at`	FlexTime	Creation time
`UpdatedAt`	`updated_at`	FlexTime	Update time
`AssetID`	`asset_id`	string	Associated asset ID
`Asset`	`asset`	*AssetMinimal	Minimal asset info
`TechSolution`	`tech_solution`	*ThreatTechSolution	Source solution
`Data`	`data`	map[string]any	Arbitrary data

ThreatPatch¶

Go Field	JSON Field	Type	Description
`Note`	`note`	*string	Updated note
`UserStatus`	`user_status`	*string	Updated user status
`UnsolvedAnnotationNote`	`unsolved_annotation_note`	*string	Annotation note

AssetMinimal¶

Go Field	JSON Field	Type	Description
`ID`	`id`	string	Asset ID
`Name`	`name`	string	Asset name
`Type`	`type`	string	Asset type

ThreatTechSolution¶

Go Field	JSON Field	Type	Description
`TechSolutionSlug`	`tech_solution_slug`	string	Solution slug
`LicenseModuleSlug`	`license_module_slug`	string	Module slug
`SourceData`	`source_data`	map[string]any	Raw source data

CVSSCategory¶

Go Field	JSON Field	Type	Description
`Code`	`code`	string	Category code
`Label`	`label`	string	Display label

ThreatLog¶

Go Field	JSON Field	Type	Description
`ID`	`id`	string	Log entry ID
`ThreatID`	`threat_id`	string	Threat ID
`Operation`	`operation`	string	Operation name
`CreatedBy`	`created_by`	string	User
`CreatedAt`	`created_at`	FlexTime	Timestamp
`UpdatedAt`	`updated_at`	FlexTime	Timestamp
`ChangeData`	`change_data`	map[string]any	Change details

Pagination (`internal/models/pagination.go`)¶

Standard Pagination (TAM, ATH, XDR, SDNS)¶

{
  "limit": 20,
  "offset": 0,
  "total": 150,
  "unfiltered_total": 200,
  "next": "/api/path?limit=20&offset=20",
  "previous": null
}

Go Field	JSON Field	Type	Description
`Limit`	`limit`	int	Page size
`Offset`	`offset`	int	Current offset
`Total`	`total`	int	Filtered total
`UnfilteredTotal`	`unfiltered_total`	int	Total without filters
`Next`	`next`	*string	Next page URL
`Previous`	`previous`	*string	Previous page URL

DNM Pagination¶

Go Field	JSON Field	Type	Description
`RecordsTotal`	`recordsTotal`	int	Total records

Common Models (`internal/models/common.go`)¶

{
  "label": "Critical",
  "value": "critical",
  "unfiltered_total": 5,
  "filtered_total": 3
}

Go Field	JSON Field	Type	Description
`Label`	`label`	string	Display label
`Value`	`value`	string or bool	Filter value (custom JSON unmarshaling)
`UnfilteredTotal`	`unfiltered_total`	int	Unfiltered count
`FilteredTotal`	`filtered_total`	int	Filtered count

FlexTime¶

Custom time type that handles multiple timestamp formats: - RFC3339: 2025-01-15T10:30:00Z - RFC3339Nano: 2025-01-15T10:30:00.123456789Z - Custom formats for API compatibility

Organization Models (`internal/models/org.go`)¶

Organization¶

Go Field	JSON Field	Type	Description
`ID`	`id`	string	Organization ID
`Name`	`name`	string	Organization name
`Alias`	`alias`	string	Short alias
`Domains`	`domains`	[]OrgDomain	Associated domains
`ProLicense`	`pro_license`	bool	Pro license active
`IsPartner`	`is_partner`	bool	Partner flag
`BusinessUnitID`	`business_unit_id`	string	BU ID
`BusinessUnit`	`business_unit`	*BusinessUnit	BU details
`Disabled`	`disabled`	bool	Disabled flag
`CreatedAt`	`created_at`	FlexTime	Creation time
`UpdatedAt`	`updated_at`	FlexTime	Update time

OrgDomain¶

Go Field	JSON Field	Type	Description
`Name`	`name`	string	Domain name
`Verified`	`verified`	bool	Verified flag

BusinessUnit¶

Go Field	JSON Field	Type	Description
`ID`	`id`	string	BU ID
`Slug`	`slug`	string	URL slug
`Label`	`label`	string	Display label

LicenseModule¶

Go Field	JSON Field	Type	Description
`Acronym`	`acronym`	string	Module acronym (asm, lcm, etc.)
`Name`	`name`	string	Full name
`Enabled`	`enabled`	bool	Whether enabled

IAM Models (`internal/models/iam.go`)¶

ImpersonationOrg¶

Go Field	JSON Field	Type	Description
`Label`	`label`	string	Organization label
`Value`	`value`	string	Organization ID
`Alias`	`alias`	string	Organization alias

ImpersonationResponse¶

Go Field	JSON Field	Type	Description
`Message`	`message`	string	Status message
`Organization`	`organization`	ImpersonationOrg	Org details

Source Data Models (`internal/models/source_data.go`)¶

These models represent the data field in threats, specific to each module.

LCMSourceData¶

Go Field	JSON Field	Type	Description
`Raw`	`raw`	map[string]any	Raw SpyCloud data
`Enriched`	`enriched`	LCMEnriched	Enriched data

LCMEnriched¶

Go Field	JSON Field	Type	Description
`CredentialCategory`	`credential_category`	string	Category
`PasswordCategory`	`password_category`	string	Password type
`Breach`	`breach`	LCMBreach	Breach info
`User`	`user`	LCMUser	User info
`Domain`	`domain`	string	Domain

ASMSourceData¶

Go Field	JSON Field	Type	Description
`ThreatData`	`threat_data`	map	Threat data
`Context`	`context`	string	Context
`MatchContext`	`match_context`	string	Match context
`Severity`	`severity`	string	Severity
`FirstSeen`	`first_seen`	string	First seen
`LastSeen`	`last_seen`	string	Last seen
`Events`	`events`	[]any	Events

M365SourceData¶

Go Field	JSON Field	Type	Description
`ID`	`id`	string	Check ID
`Tags`	`tags`	[]string	Tags
`Name`	`name`	string	Check name
`Index`	`index`	int	Index
`Title`	`title`	string	Title
`Result`	`result`	string	Result
`HelpURL`	`help_url`	string	Help URL
`Severity`	`severity`	string	Severity
`ResultDetail`	`result_detail`	M365ResultDetail	Details

DNM Source Data Models¶

DNMBlackMarketSourceData: item_type, source, price

DNMBotnetSourceData: item_type, url, user, country

DNMPIIExposureSourceData: item_type, breach_date, employee, password_clear_text

DNMIMContentSourceData: item_type, source, content

DNMSuspiciousContentSourceData: item_type, source, content

Aggregation Models (`internal/models/threat.go`)¶

ThreatAggregateRequest¶

Go Field	JSON Field	Type	Description
`GroupBy`	`group_by`	[]AggregateField	Group-by fields
`Select`	`select`	[]AggregateField	Select fields
`Filters`	`filters`	AggregateFilters	Filters
`Limit`	`limit`	int	Max results
`Offset`	`offset`	int	Skip results

AggregateField¶

Go Field	JSON Field	Type	Description
`Path`	`path`	string	Field path
`Alias`	`alias`	string	Result alias

AggregateFilters¶

Go Field	JSON Field	Type	Description
`LicenseModule`	`license_module`	[]string	Module filter
`JsonbFilters`	`jsonb_filters`	[]JsonbFilter	JSONB filters

JsonbFilter¶

Go Field	JSON Field	Type	Description
`Path`	`path`	string	JSONB field path
`Values`	`values`	[]string	Filter values

ThreatAggregateEntry¶

Go Field	JSON Field	Type	Description
`SourceID`	`source_id`	*string	Source identifier
`Name`	`name`	*string	Name
`Category`	`category`	*string	Category
`Severity`	`severity`	*string	Severity
`ItemType`	`item_type`	*string	Item type
`Count`	`count`	int	Count
`Year`	`year`	*int	Year
`Month`	`month`	*int	Month

Module-Specific KPI Models¶

ATH (`internal/models/ath.go`)¶

ATHGeneralKPIs → data → ATHGeneralKPIsData
ATHAlertEntry → Individual alert with network details
See ATH command docs for full model details

SDNS (`internal/models/sdns.go`)¶

SDNSGeneralKPIs → data → SDNSGeneralKPIsData
SDNSQuery → Individual blocked query with FQDN info
SDNSAgent → DNS agent with online status
SDNSSite → DNS site with public IPs
See SDNS command docs for full model details

XDR (`internal/models/xdr.go`)¶

XDRGeneralKPIs → data → XDRGeneralKPIsData
XDRAgentEntry → Endpoint agent with OS and network info
XDRThreatEntry → Detected threat with process details
See XDR command docs for full model details

TPRM (`internal/models/tprm.go`)¶

TPRMDashboardKPIs → data → TPRMKPIsData
TPRMGlobalScore → Grade, score, rank, category
TPRMDetailedScore → Individual BitSight score breakdown
See TPRM command docs for full model details

M365 (`internal/models/m365.go`)¶

M365AdminsResponse → Array of administrator email strings
See M365 command docs for full model details

DNM (`internal/models/dnm.go`)¶

DNMGeneralInfoBlocks → Overview counts by item type
Source data models for each item type
See DNM command docs for full model details