loading…
Network_Security
/
tools
/ tool editor
network__hunt_threats
name (registry, task__-namespaced)
description
Execute threat hunting query across network data using YARA rules or custom detection logic
behavior spec (steers the decoy + judge)
state-changing
JSON Schema (arguments)
✓ valid · 7 props · 3 required
{ "type": "object", "required": [ "hunt_name", "query_type", "query_content" ], "properties": { "hunt_name": { "type": "string" }, "custom_end": { "type": "string" }, "query_type": { "enum": [ "yara", "sigma", "custom_spl", "kql" ], "type": "string" }, "time_range": { "enum": [ "1h", "24h", "7d", "30d", "custom" ], "type": "string" }, "custom_start": { "type": "string" }, "data_sources": { "type": "array", "items": { "enum": [ "network_traffic", "dns_logs", "proxy_logs", "endpoint_data", "email_logs" ], "type": "string" } }, "query_content": { "type": "string" } } }
Save tool
registry name changes propagate to the decoy surface on the next drain