loading…
Threat_Hunting
/
tools
/ tool editor
threat__pivot_entity
name (registry, task__-namespaced)
description
Perform threat hunting pivots on entities like users, hosts, processes, or network connections to discover related suspicious activity
behavior spec (steers the decoy + judge)
read-only
JSON Schema (arguments)
✓ valid · 5 props · 2 required
{ "type": "object", "required": [ "entity_type", "entity_value" ], "properties": { "pivot_type": { "enum": [ "lateral_movement", "persistence", "data_exfiltration", "command_control", "all" ], "type": "string" }, "time_range": { "enum": [ "1h", "6h", "24h", "7d", "30d" ], "type": "string" }, "entity_type": { "enum": [ "user", "host", "process", "ip", "domain", "hash" ], "type": "string" }, "data_sources": { "type": "array", "items": { "enum": [ "endpoint", "network", "dns", "proxy", "email", "cloud" ], "type": "string" } }, "entity_value": { "type": "string" } } }
Save tool
registry name changes propagate to the decoy surface on the next drain