loading…
Active_Directory_Security
/
tools
/ tool editor
active__audit_admin_activities
name (registry, task__-namespaced)
description
Review administrative actions performed by privileged accounts including object modifications and policy changes
behavior spec (steers the decoy + judge)
read-only
JSON Schema (arguments)
✓ valid · 5 props · 0 required
{ "type": "object", "required": [], "properties": { "time_range": { "enum": [ "last_hour", "last_24h", "last_7d", "last_30d" ], "type": "string" }, "activity_types": { "type": "array", "items": { "enum": [ "user_creation", "user_modification", "group_modification", "gpo_changes", "schema_changes", "trust_changes", "delegation_changes" ], "type": "string" } }, "admin_accounts": { "type": "array", "items": { "type": "string" } }, "target_objects": { "type": "array", "items": { "type": "string" } }, "organizational_units": { "type": "array", "items": { "type": "string" } } } }
Save tool
registry name changes propagate to the decoy surface on the next drain