loading…
SOC Operations
/
tools
/ tool editor
soc__hunt_indicators
name (registry, task__-namespaced)
description
Search for indicators of compromise across endpoints, network logs, and threat intelligence feeds
behavior spec (steers the decoy + judge)
read-only
variant surfaces (generated)
snake·terse:
soc_hunt_indicators
camel·verbose:
socHuntIndicators
dotted·terse:
soc.huntIndicators
verbfirst·verbose:
HuntIndicators
JSON Schema (arguments)
✓ valid · 4 props · 2 required
{ "type": "object", "required": [ "ioc_value", "ioc_type" ], "properties": { "ioc_type": { "enum": [ "ip", "domain", "url", "hash_md5", "hash_sha1", "hash_sha256", "email" ], "type": "string" }, "ioc_value": { "type": "string", "description": "IOC value like IP, domain, hash" }, "data_sources": { "type": "array", "items": { "enum": [ "endpoints", "network", "email", "web_proxy", "dns" ], "type": "string" } }, "lookback_hours": { "type": "integer", "default": 24, "description": "Hours to search backwards" } } }
Save tool
registry name changes propagate to the decoy surface on the next drain