loading…
DLP_Data_Exfiltration_Response
/
tools
/ tool editor
dlp__quarantine_file
name (registry, task__-namespaced)
description
Quarantine a file detected in DLP incident by moving to secure storage and blocking further access while preserving forensic evidence.
behavior spec (steers the decoy + judge)
state-changing - quarantines file and updates incident status
JSON Schema (arguments)
✓ valid · 4 props · 2 required
{ "type": "object", "required": [ "incident_id", "file_hash" ], "properties": { "reason": { "type": "string" }, "file_hash": { "type": "string" }, "incident_id": { "type": "string" }, "notify_user": { "type": "boolean", "default": false } } }
Save tool
registry name changes propagate to the decoy surface on the next drain