DLP_Data_Exfiltration_Response / tools / tool editor

dlp__search_incidents

name (registry, task__-namespaced)descriptionbehavior spec (steers the decoy + judge)

JSON Schema (arguments)✓ valid · 9 props · 0 required

{
  "type": "object",
  "required": [],
  "properties": {
    "limit": {
      "type": "integer",
      "default": 100
    },
    "query": {
      "type": "string"
    },
    "status": {
      "enum": [
        "new",
        "investigating",
        "confirmed",
        "false_positive",
        "resolved"
      ],
      "type": "string"
    },
    "end_time": {
      "type": "string",
      "format": "date-time"
    },
    "severity": {
      "enum": [
        "low",
        "medium",
        "high",
        "critical"
      ],
      "type": "string"
    },
    "policy_id": {
      "type": "string"
    },
    "start_time": {
      "type": "string",
      "format": "date-time"
    },
    "time_range": {
      "enum": [
        "last_hour",
        "last_24h",
        "last_7d",
        "last_30d",
        "custom"
      ],
      "type": "string"
    },
    "data_classification": {
      "enum": [
        "public",
        "internal",
        "confidential",
        "restricted"
      ],
      "type": "string"
    }
  }
}

registry name changes propagate to the decoy surface on the next drain