threat__create_detection_rule

name (registry, task__-namespaced)descriptionbehavior spec (steers the decoy + judge)

JSON Schema (arguments)✓ valid · 10 props · 4 required

{
  "type": "object",
  "required": [
    "rule_name",
    "query",
    "query_language",
    "severity"
  ],
  "properties": {
    "query": {
      "type": "string"
    },
    "enabled": {
      "type": "boolean",
      "default": false
    },
    "hunt_id": {
      "type": "string"
    },
    "severity": {
      "enum": [
        "critical",
        "high",
        "medium",
        "low",
        "informational"
      ],
      "type": "string"
    },
    "rule_name": {
      "type": "string"
    },
    "description": {
      "type": "string"
    },
    "data_sources": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "query_language": {
      "enum": [
        "kql",
        "spl",
        "sql",
        "sigma"
      ],
      "type": "string"
    },
    "mitre_techniques": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "false_positive_rate": {
      "enum": [
        "low",
        "medium",
        "high"
      ],
      "type": "string"
    }
  }
}

registry name changes propagate to the decoy surface on the next drain