threat__enrich_with_osint

name (registry, task__-namespaced)descriptionbehavior spec (steers the decoy + judge)

JSON Schema (arguments)✓ valid · 4 props · 1 required

{
  "type": "object",
  "required": [
    "indicators"
  ],
  "properties": {
    "indicators": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "type",
          "value"
        ],
        "properties": {
          "type": {
            "enum": [
              "ip",
              "domain",
              "hash",
              "url",
              "email"
            ],
            "type": "string"
          },
          "value": {
            "type": "string"
          }
        }
      }
    },
    "osint_sources": {
      "type": "array",
      "items": {
        "enum": [
          "virustotal",
          "urlvoid",
          "abuseipdb",
          "shodan",
          "passivetotal",
          "hybrid_analysis"
        ],
        "type": "string"
      }
    },
    "include_historical": {
      "type": "boolean",
      "default": false
    },
    "confidence_threshold": {
      "type": "integer",
      "default": 50,
      "maximum": 100,
      "minimum": 0
    }
  }
}

registry name changes propagate to the decoy surface on the next drain