Detection_Engineering / tools / tool editor

detection__create_hunt

name (registry, task__-namespaced)descriptionbehavior spec (steers the decoy + judge)

JSON Schema (arguments)✓ valid · 6 props · 3 required

{
  "type": "object",
  "required": [
    "name",
    "hypothesis",
    "queries"
  ],
  "properties": {
    "name": {
      "type": "string"
    },
    "queries": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "query"
        ],
        "properties": {
          "query": {
            "type": "string"
          },
          "query_type": {
            "enum": [
              "spl",
              "kql",
              "sigma"
            ],
            "type": "string"
          },
          "data_source": {
            "type": "string"
          }
        }
      }
    },
    "priority": {
      "enum": [
        "critical",
        "high",
        "medium",
        "low"
      ],
      "type": "string"
    },
    "hypothesis": {
      "type": "string"
    },
    "assigned_to": {
      "type": "string"
    },
    "mitre_techniques": {
      "type": "array",
      "items": {
        "type": "string",
        "pattern": "^T[0-9]{4}(\\.[0-9]{3})?$"
      }
    }
  }
}

registry name changes propagate to the decoy surface on the next drain