loading…
Identity_Threat_Detection
/
tools
/ tool editor
identity__list_compromised_accounts
name (registry, task__-namespaced)
description
Get accounts flagged as compromised or at high risk with filtering by compromise type, detection time, and remediation status
behavior spec (steers the decoy + judge)
read-only - returns list of compromised account records
JSON Schema (arguments)
✓ valid · 5 props · 0 required
{ "type": "object", "required": [], "properties": { "limit": { "type": "integer", "default": 100, "maximum": 1000 }, "detected_since": { "type": "string", "format": "date-time" }, "risk_score_min": { "type": "integer", "maximum": 100, "minimum": 0 }, "compromise_type": { "type": "array", "items": { "enum": [ "credential_theft", "session_hijacking", "privilege_abuse", "brute_force", "impossible_travel" ], "type": "string" } }, "remediation_status": { "type": "array", "items": { "enum": [ "none", "password_reset", "account_disabled", "mfa_enforced", "monitored" ], "type": "string" } } } }
Save tool
registry name changes propagate to the decoy surface on the next drain