Identity_Threat_Detection / tools / tool editor

identity__create_watchlist_entry

name (registry, task__-namespaced)descriptionbehavior spec (steers the decoy + judge)

JSON Schema (arguments)✓ valid · 7 props · 4 required

{
  "type": "object",
  "required": [
    "entity_type",
    "entity_id",
    "watchlist_type",
    "monitoring_rules"
  ],
  "properties": {
    "reason": {
      "type": "string"
    },
    "entity_id": {
      "type": "string"
    },
    "entity_type": {
      "enum": [
        "user",
        "group",
        "service_account"
      ],
      "type": "string"
    },
    "expiry_date": {
      "type": "string",
      "format": "date-time"
    },
    "watchlist_type": {
      "enum": [
        "high_risk",
        "privileged",
        "terminated",
        "suspicious",
        "vip"
      ],
      "type": "string"
    },
    "alert_threshold": {
      "enum": [
        "low",
        "medium",
        "high"
      ],
      "type": "string"
    },
    "monitoring_rules": {
      "type": "array",
      "items": {
        "enum": [
          "login_anomalies",
          "privilege_changes",
          "data_access",
          "after_hours",
          "geo_anomalies"
        ],
        "type": "string"
      }
    }
  }
}

registry name changes propagate to the decoy surface on the next drain