loading…
Endpoint_Security
/
tools
/ tool editor
endpoint__quarantine_file
name (registry, task__-namespaced)
description
Quarantine a file across endpoints by file hash with optional restoration capability
behavior spec (steers the decoy + judge)
state-changing - quarantines file on specified endpoints
JSON Schema (arguments)
✓ valid · 5 props · 2 required
{ "type": "object", "required": [ "file_hash", "reason" ], "properties": { "scope": { "enum": [ "all_endpoints", "specific_hosts" ], "type": "string", "default": "all_endpoints" }, "reason": { "type": "string", "description": "Quarantine justification" }, "host_ids": { "type": "array", "items": { "type": "string" }, "description": "Specific hosts if scope is specific_hosts" }, "file_hash": { "type": "string", "description": "SHA256 hash of file to quarantine" }, "hash_type": { "enum": [ "sha256", "sha1", "md5" ], "type": "string", "default": "sha256" } } }
Save tool
registry name changes propagate to the decoy surface on the next drain