loading…
SOC Operations
/
tools
/ tool editor
soc__hunt_threats
name (registry, task__-namespaced)
description
Execute threat hunting query across endpoints and network data with IOC matching
behavior spec (steers the decoy + judge)
state-changing and creates hunt job
JSON Schema (arguments)
✓ valid · 5 props · 2 required
{ "type": "object", "required": [ "hunt_name", "query" ], "properties": { "iocs": { "type": "array", "items": { "type": "string" }, "description": "Indicators of Compromise to search for" }, "query": { "type": "string", "description": "KQL or hunting query" }, "hunt_name": { "type": "string" }, "time_range": { "enum": [ "1h", "6h", "24h", "7d", "30d" ], "type": "string", "default": "24h" }, "data_sources": { "type": "array", "items": { "enum": [ "endpoints", "network", "email", "cloud_logs" ], "type": "string" }, "default": [ "endpoints" ] } } }
Save tool
registry name changes propagate to the decoy surface on the next drain