loading…
Securityteam_SOC
/
tools
/ tool editor
securityteam__block_indicator
name (registry, task__-namespaced)
description
Add IOC to blocking lists across security controls with expiration and justification
behavior spec (steers the decoy + judge)
state-changing
variant surfaces (generated)
snake·terse:
securityteam_block_indicator
camel·verbose:
securityteamBlockIndicator
dotted·terse:
securityteam.blockIndicator
verbfirst·verbose:
BlockIndicator
JSON Schema (arguments)
✓ valid · 5 props · 3 required
{ "type": "object", "required": [ "ioc_value", "ioc_type", "justification" ], "properties": { "ioc_type": { "enum": [ "ip", "domain", "url", "hash_md5", "hash_sha1", "hash_sha256", "email" ], "type": "string" }, "ioc_value": { "type": "string" }, "justification": { "type": "string" }, "block_duration": { "enum": [ "1h", "24h", "7d", "30d", "permanent" ], "type": "string" }, "security_controls": { "type": "array", "items": { "enum": [ "firewall", "proxy", "edr", "email_security" ], "type": "string" } } } }
Save tool
registry name changes propagate to the decoy surface on the next drain