loading…
Network_Security
/
tools
/ tool editor
network__hunt_threats
name (registry, task__-namespaced)
description
Execute threat hunting query across network logs and endpoints using KQL, returns potential threats and hunt results
behavior spec (steers the decoy + judge)
read-only
JSON Schema (arguments)
✓ valid · 5 props · 1 required
{ "type": "object", "required": [ "kql" ], "properties": { "kql": { "type": "string", "description": "Kusto Query Language hunting query" }, "timespan": { "enum": [ "1h", "4h", "24h", "7d", "30d" ], "type": "string" }, "hunt_name": { "type": "string" }, "save_hunt": { "type": "boolean", "default": false }, "data_sources": { "type": "array", "items": { "enum": [ "network_logs", "endpoint_logs", "dns_logs", "proxy_logs", "firewall_logs" ], "type": "string" } } } }
Save tool
registry name changes propagate to the decoy surface on the next drain