loading…
Securityteam_SOC
/
tools
/ tool editor
securityteam__query_threat_intel
name (registry, task__-namespaced)
description
Search threat intelligence feeds for IOCs, TTPs, and threat actor information with confidence scoring
behavior spec (steers the decoy + judge)
read-only
variant surfaces (generated)
snake·terse:
securityteam_query_threat_intel
verbfirst·verbose:
QueryThreatIntel
camel·verbose:
securityteamQueryThreatIntel
dotted·terse:
securityteam.query_threat_intel
JSON Schema (arguments)
✓ valid · 5 props · 0 required
{ "type": "object", "required": [], "properties": { "ioc_type": { "enum": [ "ip", "domain", "url", "hash_md5", "hash_sha1", "hash_sha256", "email" ], "type": "string" }, "ioc_value": { "type": "string", "description": "IP, domain, hash, or other indicator" }, "feed_sources": { "type": "array", "items": { "type": "string" } }, "threat_actor": { "type": "string" }, "confidence_min": { "type": "integer", "maximum": 100, "minimum": 0 } } }
Save tool
registry name changes propagate to the decoy surface on the next drain