Identity_Threat_Detection / tools / tool editor

identity__list_risk_events

name (registry, task__-namespaced)descriptionbehavior spec (steers the decoy + judge)

JSON Schema (arguments)✓ valid · 7 props · 0 required

{
  "type": "object",
  "required": [],
  "properties": {
    "limit": {
      "type": "integer",
      "default": 50,
      "maximum": 500,
      "minimum": 1
    },
    "status": {
      "enum": [
        "new",
        "investigating",
        "resolved",
        "false_positive"
      ],
      "type": "string"
    },
    "sort_by": {
      "enum": [
        "timestamp",
        "risk_score",
        "user_id"
      ],
      "type": "string",
      "default": "timestamp"
    },
    "user_id": {
      "type": "string"
    },
    "event_type": {
      "enum": [
        "impossible_travel",
        "credential_stuffing",
        "privilege_escalation",
        "suspicious_login",
        "account_takeover"
      ],
      "type": "string"
    },
    "risk_level": {
      "enum": [
        "low",
        "medium",
        "high",
        "critical"
      ],
      "type": "string"
    },
    "time_range": {
      "enum": [
        "1h",
        "24h",
        "7d",
        "30d"
      ],
      "type": "string"
    }
  }
}

registry name changes propagate to the decoy surface on the next drain