cloud__query_security_logs

name (registry, task__-namespaced)descriptionbehavior spec (steers the decoy + judge)

JSON Schema (arguments)✓ valid · 6 props · 2 required

{
  "type": "object",
  "required": [
    "kql_query",
    "time_range"
  ],
  "properties": {
    "limit": {
      "type": "integer",
      "default": 1000,
      "maximum": 10000,
      "minimum": 1
    },
    "region": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "kql_query": {
      "type": "string"
    },
    "account_id": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "time_range": {
      "type": "object",
      "required": [
        "start",
        "end"
      ],
      "properties": {
        "end": {
          "type": "string",
          "format": "date-time"
        },
        "start": {
          "type": "string",
          "format": "date-time"
        }
      }
    },
    "log_sources": {
      "type": "array",
      "items": {
        "enum": [
          "cloudtrail",
          "vpc_flow",
          "guardduty",
          "security_hub",
          "config",
          "cloudwatch"
        ],
        "type": "string"
      }
    }
  }
}

registry name changes propagate to the decoy surface on the next drain