loading…
Identity_Threat_Detection
/
tools
/ tool editor
identity__get_timeline
name (registry, task__-namespaced)
description
Get chronological timeline of identity events for specific user showing authentication, authorization, and risk events
behavior spec (steers the decoy + judge)
read-only
JSON Schema (arguments)
✓ valid · 6 props · 3 required
{ "type": "object", "required": [ "user_id", "start_time", "end_time" ], "properties": { "limit": { "type": "integer", "default": 100, "maximum": 1000, "minimum": 1 }, "user_id": { "type": "string" }, "end_time": { "type": "string", "format": "date-time" }, "start_time": { "type": "string", "format": "date-time" }, "event_types": { "type": "array", "items": { "enum": [ "login", "logout", "password_change", "mfa_enrollment", "privilege_change", "risk_event", "policy_violation" ], "type": "string" } }, "include_context": { "type": "boolean", "default": true } } }
Save tool
registry name changes propagate to the decoy surface on the next drain