loading…
SOC Operations
/
tools
/ tool editor
soc__enrich_artifact
name (registry, task__-namespaced)
description
Enrich security artifact with threat intelligence, reputation scores, and contextual information
behavior spec (steers the decoy + judge)
read-only
variant surfaces (generated)
snake·terse:
soc_enrich_artifact
camel·verbose:
socEnrichArtifact
dotted·terse:
soc.enrich_artifact
verbfirst·verbose:
EnrichArtifact
JSON Schema (arguments)
✓ valid · 3 props · 2 required
{ "type": "object", "required": [ "artifact_value", "artifact_type" ], "properties": { "artifact_type": { "enum": [ "ip", "domain", "url", "hash", "email" ], "type": "string" }, "artifact_value": { "type": "string", "description": "Artifact to enrich like IP, domain, hash" }, "enrichment_sources": { "type": "array", "items": { "enum": [ "virustotal", "passivetotal", "shodan", "threatcrowd", "internal_intel" ], "type": "string" }, "default": [ "virustotal", "internal_intel" ] } } }
Save tool
registry name changes propagate to the decoy surface on the next drain