Insider_Risk_Investigation / tools / tool editor

insider__run_behavioral_hunt

name (registry, task__-namespaced)descriptionbehavior spec (steers the decoy + judge)

JSON Schema (arguments)✓ valid · 7 props · 2 required

{
  "type": "object",
  "required": [
    "hunt_type",
    "time_window"
  ],
  "properties": {
    "hunt_type": {
      "enum": [
        "data_hoarding",
        "off_hours_access",
        "privilege_escalation",
        "lateral_movement",
        "exfiltration_patterns",
        "custom"
      ],
      "type": "string"
    },
    "user_list": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "department": {
      "type": "string"
    },
    "hunt_query": {
      "type": "string",
      "description": "Custom behavioral analytics query"
    },
    "time_window": {
      "enum": [
        "1d",
        "7d",
        "30d",
        "90d"
      ],
      "type": "string"
    },
    "target_population": {
      "enum": [
        "all_users",
        "high_risk_users",
        "department",
        "custom_list"
      ],
      "type": "string"
    },
    "confidence_threshold": {
      "type": "number",
      "default": 0.7,
      "maximum": 1,
      "minimum": 0
    }
  }
}

registry name changes propagate to the decoy surface on the next drain