loading…
DLP_Data_Exfiltration_Response
/
tools
/ tool editor
dlp__block_user_action
name (registry, task__-namespaced)
description
Block user from performing data transfer actions like email, file sharing, or removable media based on risk assessment.
behavior spec (steers the decoy + judge)
state-changing - applies user restrictions and logs enforcement action
JSON Schema (arguments)
✓ valid · 5 props · 3 required
{ "type": "object", "required": [ "user_id", "action_types", "reason" ], "properties": { "reason": { "type": "string" }, "user_id": { "type": "string" }, "incident_id": { "type": "string" }, "action_types": { "type": "array", "items": { "enum": [ "email", "file_share", "removable_media", "cloud_upload", "print" ], "type": "string" } }, "duration_hours": { "type": "integer" } } }
Save tool
registry name changes propagate to the decoy surface on the next drain