loading…
Network_Security
/
tools
/ tool editor
network__hunt_indicators
name (registry, task__-namespaced)
description
Execute threat hunt using IOCs, YARA rules, or custom hunt queries across endpoints and network data
behavior spec (steers the decoy + judge)
read-only - executes hunt and returns matching artifacts and hosts
JSON Schema (arguments)
✓ valid · 7 props · 1 required
{ "type": "object", "required": [ "hunt_type" ], "properties": { "query": { "type": "string" }, "hunt_type": { "enum": [ "ioc", "yara", "custom", "sigma" ], "type": "string" }, "custom_end": { "type": "string", "format": "date-time" }, "indicators": { "type": "array", "items": { "type": "string" } }, "time_range": { "enum": [ "1h", "6h", "24h", "7d", "30d", "custom" ], "type": "string" }, "custom_start": { "type": "string", "format": "date-time" }, "target_scope": { "type": "array", "items": { "enum": [ "endpoints", "network", "email", "cloud" ], "type": "string" } } } }
Save tool
registry name changes propagate to the decoy surface on the next drain