loading…
Insider_Risk_Investigation
/
tools
/ tool editor
insider__add_evidence
name (registry, task__-namespaced)
description
Add digital evidence artifact to investigation case with chain of custody metadata and evidence classification
behavior spec (steers the decoy + judge)
state-changing
JSON Schema (arguments)
✓ valid · 8 props · 4 required
{ "type": "object", "required": [ "case_id", "evidence_type", "description", "collected_by" ], "properties": { "case_id": { "type": "string" }, "hash_md5": { "type": "string" }, "file_path": { "type": "string" }, "description": { "type": "string" }, "hash_sha256": { "type": "string" }, "collected_by": { "type": "string" }, "evidence_type": { "enum": [ "email", "file", "log_entry", "screenshot", "network_capture", "usb_activity" ], "type": "string" }, "source_system": { "type": "string" } } }
Save tool
registry name changes propagate to the decoy surface on the next drain