loading…
Threat_Hunting
/
tools
/ tool editor
threat__execute_hunt
name (registry, task__-namespaced)
description
Execute a threat hunting query using KQL, SPL, or SQL against security data lakes including SIEM logs, EDR telemetry, and network flows
behavior spec (steers the decoy + judge)
read-only - returns query results with metadata about data sources and execution time
JSON Schema (arguments)
✓ valid · 7 props · 3 required
{ "type": "object", "required": [ "query", "query_language", "data_sources" ], "properties": { "query": { "type": "string" }, "end_time": { "type": "string", "format": "date-time" }, "start_time": { "type": "string", "format": "date-time" }, "time_range": { "enum": [ "last_hour", "last_24h", "last_7d", "last_30d", "custom" ], "type": "string" }, "max_results": { "type": "integer", "default": 1000, "maximum": 10000, "minimum": 1 }, "data_sources": { "type": "array", "items": { "enum": [ "siem", "edr", "network", "dns", "proxy", "email" ], "type": "string" } }, "query_language": { "enum": [ "kql", "spl", "sql" ], "type": "string" } } }
Save tool
registry name changes propagate to the decoy surface on the next drain