sources/agent/greynoise/request.go (1)

3-9: Add JSON tags (+omitempty) to ensure correct GNQL serialization

Without tags, marshaling will emit Go field names. Recommend explicit JSON keys and omitting empty fields.

Apply:

 type Request struct {
-	Query      string // GNQL query string (required)
-	Size       int    // Number of results per page (1-10000, defaults to 10000)
-	Scroll     string // Scroll token for pagination
-	Quick      bool   // Quick=true returns only IP and classification/trust level
-	ExcludeRaw bool   // Optional: request without heavy raw_data
+	Query      string `json:"query"`                   // GNQL query string (required)
+	Size       int    `json:"size,omitempty"`          // Number of results per page (1-10000, defaults to 10000)
+	Scroll     string `json:"scroll,omitempty"`        // Scroll token for pagination
+	Quick      bool   `json:"quick,omitempty"`         // Quick=true returns only IP and classification/trust level
+	ExcludeRaw bool   `json:"exclude_raw,omitempty"`   // Optional: request without heavy raw_data
 }

If GNQL expects different keys (e.g., exclude vs exclude_raw), please adjust accordingly.

sources/agent/greynoise/response.go (1)

24-25: Make heavy/optional substructures pointers with omitempty

Reduces allocations and output churn when ExcludeRaw is used or when business context is absent.

 type GNQLItem struct {
 	IP                          string                      `json:"ip"`
-	InternetScannerIntelligence InternetScannerIntelligence `json:"internet_scanner_intelligence"`
-	BusinessServiceIntelligence BusinessServiceIntelligence `json:"business_service_intelligence"`
+	InternetScannerIntelligence InternetScannerIntelligence  `json:"internet_scanner_intelligence"`
+	BusinessServiceIntelligence *BusinessServiceIntelligence `json:"business_service_intelligence,omitempty"`
 }
@@
-	Tags     Tags     `json:"tags"`
-	RawData  RawData  `json:"raw_data"`
+	Tags     Tags     `json:"tags"`
+	RawData  *RawData `json:"raw_data,omitempty"`

Also applies to: 44-47

sources/agent/greynoise/greynoise.go (2)

136-154: Non-2xx handling here is unreachable due to Session.Do

Session.Do already errors on any non-200, so this block never runs; wrap the Session.Do error to add GNQL guidance and drop the redundant check.

Apply this diff:

 resp, err := session.Do(req, agent.Name())
-if err != nil {
-    return nil, err
-}
+if err != nil {
+    // Provide clearer hint for auth/plan errors while preserving rate limiter usage
+    if resp != nil && (resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden || resp.StatusCode == http.StatusNotFound) {
+        b, _ := io.ReadAll(resp.Body)
+        msg := strings.TrimSpace(string(b))
+        return nil, fmt.Errorf("GreyNoise GNQL request failed: status=%d. Your API key may not include GNQL access (Enterprise key required). body=%s", resp.StatusCode, msg)
+    }
+    return nil, err
+}
 defer resp.Body.Close()
-
-if resp.StatusCode < 200 || resp.StatusCode > 299 {
-    b, _ := io.ReadAll(resp.Body)
-    msg := strings.TrimSpace(string(b))
-
-    if resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden || resp.StatusCode == http.StatusNotFound {
-        return nil, fmt.Errorf(
-            "GreyNoise GNQL request failed: status=%d. Your API key may not include GNQL access (Enterprise key required). body=%s",
-            resp.StatusCode, msg,
-        )
-    }
-
-    return nil, fmt.Errorf("greynoise GNQL request failed: status=%d body=%s", resp.StatusCode, msg)
-}

---

162-169: Use project logger for debug output

Prefer gologger.Debug() over fmt.Fprintf(os.Stderr, ...) for consistent observability and easy silencing in non-debug runs.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

sources/agent/greynoise/request.go (1)

3-8: Add GoDoc and basic validation for Request.

• Exported type lacks a GoDoc comment.
• Enforce size bounds (1–10000) and normalize defaults to avoid server-side 400s.

Apply:

 package greynoise

+// Request contains GNQL request parameters.
 type Request struct {
 	Query      string // GNQL query string (required)
 	Size       int    // Number of results per page (1-10000, defaults to 10000)
 	Scroll     string // Scroll token for pagination
 	ExcludeRaw bool   // Optional: request without heavy raw_data
 }
+
+// Normalize clamps fields to API-accepted ranges and fills defaults.
+func (r *Request) Normalize() {
+	if r.Size <= 0 || r.Size > 10000 {
+		r.Size = 10000
+	}
+}

sources/agent/greynoise/response.go (2)

27-35: Optional: parse timestamps into time.Time with custom layout.

GN timestamps are string-encoded; typed parsing helps downstream filtering/sorting.

Example helper:

type GNTime struct{ time.Time }

const gnLayout = "2006-01-02 15:04:05"

func (t *GNTime) UnmarshalJSON(b []byte) error {
	var s string
	if err := json.Unmarshal(b, &s); err != nil { return err }
	tt, err := time.ParseInLocation(gnLayout, s, time.UTC)
	if err != nil { return err }
	t.Time = tt
	return nil
}

Then use GNTime for FirstSeen, LastSeen, LastSeenTS, LastUpdated.

Also applies to: 137-147

---

27-47: Guard against nulls in fields that are sometimes unknown.

If API returns null for fields like Actor, VPNService, Classification, Datacenter, etc., unmarshalling into non-pointer primitives will fail. Consider pointers for nullable fields.

Would you like a quick pass converting known-nullable fields to pointers based on sample responses?

Also applies to: 49-75

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

sources/agent/greynoise/request.go (2)

3-8: Add url tags for query encoding (or confirm your encoder).

Prevents accidental Query=...&Size=... casing if a url-tag encoder is used.

Apply one of the following:

Option A — add url tags (keep JSON tags):

 type Request struct {
-    Query      string `json:"query"`
-    Size       int    `json:"size,omitempty"`
-    Scroll     string `json:"scroll,omitempty"`
-    ExcludeRaw bool   `json:"exclude_raw,omitempty"`
+    Query      string `json:"query" url:"query"`
+    Size       int    `json:"size,omitempty" url:"size,omitempty"`
+    Scroll     string `json:"scroll,omitempty" url:"scroll,omitempty"`
+    ExcludeRaw bool   `json:"exclude_raw,omitempty" url:"exclude_raw,omitempty"`
 }

Option B — if ExcludeRaw only toggles the endpoint (/v3/gnql/metadata) and should not be sent on the wire, don’t tag it:

 type Request struct {
-    Query      string `json:"query"`
-    Size       int    `json:"size,omitempty"`
-    Scroll     string `json:"scroll,omitempty"`
-    ExcludeRaw bool   `json:"exclude_raw,omitempty"`
+    Query      string `json:"query" url:"query"`
+    Size       int    `json:"size,omitempty" url:"size,omitempty"`
+    Scroll     string `json:"scroll,omitempty" url:"scroll,omitempty"`
+    ExcludeRaw bool
 }

---

3-3: Add a Go doc comment for the exported type.

Tiny lint/readability win.

-package greynoise
+package greynoise
+
+// Request holds GNQL parameters. ExcludeRaw toggles /v3/gnql/metadata (no raw data).

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro