cloud__create_security_case

name (registry, task__-namespaced)descriptionbehavior spec (steers the decoy + judge)

JSON Schema (arguments)✓ valid · 7 props · 4 required

{
  "type": "object",
  "required": [
    "case_title",
    "case_type",
    "severity",
    "description"
  ],
  "properties": {
    "tags": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "severity": {
      "enum": [
        "critical",
        "high",
        "medium",
        "low"
      ],
      "type": "string"
    },
    "case_type": {
      "enum": [
        "incident_response",
        "threat_hunting",
        "compliance_violation",
        "insider_threat",
        "data_breach"
      ],
      "type": "string"
    },
    "case_title": {
      "type": "string"
    },
    "assignee_id": {
      "type": "string"
    },
    "description": {
      "type": "string"
    },
    "initial_evidence": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "type": {
            "enum": [
              "alert",
              "log_entry",
              "artifact",
              "ioc"
            ],
            "type": "string"
          },
          "description": {
            "type": "string"
          },
          "reference_id": {
            "type": "string"
          }
        }
      }
    }
  }
}

registry name changes propagate to the decoy surface on the next drain