Identity_Threat_Detection / tools / tool editor

identity__hunt_indicators

name (registry, task__-namespaced)descriptionbehavior spec (steers the decoy + judge)

JSON Schema (arguments)✓ valid · 6 props · 2 required

{
  "type": "object",
  "required": [
    "hunt_name",
    "indicators"
  ],
  "properties": {
    "end_time": {
      "type": "string",
      "format": "date-time"
    },
    "hunt_name": {
      "type": "string"
    },
    "indicators": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "type": {
            "enum": [
              "ip",
              "user_agent",
              "geolocation",
              "device_id",
              "application"
            ],
            "type": "string"
          },
          "value": {
            "type": "string"
          },
          "operator": {
            "enum": [
              "equals",
              "contains",
              "regex",
              "not_equals"
            ],
            "type": "string"
          }
        }
      }
    },
    "start_time": {
      "type": "string",
      "format": "date-time"
    },
    "time_range": {
      "enum": [
        "1h",
        "24h",
        "7d",
        "30d",
        "custom"
      ],
      "type": "string"
    },
    "data_sources": {
      "type": "array",
      "items": {
        "enum": [
          "azure_ad",
          "okta",
          "active_directory",
          "aws_iam",
          "google_workspace"
        ],
        "type": "string"
      }
    }
  }
}

registry name changes propagate to the decoy surface on the next drain