Active_Directory_Identity_Defense / tools / tool editor

active__list_security_alerts

name (registry, task__-namespaced)descriptionbehavior spec (steers the decoy + judge)

JSON Schema (arguments)✓ valid · 7 props · 0 required

{
  "type": "object",
  "required": [],
  "properties": {
    "limit": {
      "type": "integer",
      "maximum": 1000,
      "minimum": 1
    },
    "offset": {
      "type": "integer",
      "minimum": 0
    },
    "status": {
      "enum": [
        "open",
        "investigating",
        "resolved",
        "false_positive"
      ],
      "type": "string"
    },
    "severity": {
      "type": "array",
      "items": {
        "enum": [
          "critical",
          "high",
          "medium",
          "low",
          "informational"
        ],
        "type": "string"
      }
    },
    "alert_types": {
      "type": "array",
      "items": {
        "enum": [
          "suspicious_logon",
          "privilege_escalation",
          "lateral_movement",
          "credential_theft",
          "account_manipulation",
          "kerberoasting",
          "dcsync"
        ],
        "type": "string"
      }
    },
    "affected_user": {
      "type": "string"
    },
    "affected_computer": {
      "type": "string"
    }
  }
}

registry name changes propagate to the decoy surface on the next drain