Skip to content

Commit

Permalink
Merge pull request #141 from mariocuomo/main
Browse files Browse the repository at this point in the history
Moving from Copilot For Security to Security Copilot
  • Loading branch information
KwachSean authored Nov 18, 2024
2 parents 565ae92 + c3d43af commit cdfd9bb
Show file tree
Hide file tree
Showing 52 changed files with 208 additions and 208 deletions.
14 changes: 7 additions & 7 deletions Customer Guides/Nl2KQL Guide/Readme.md
Original file line number Diff line number Diff line change
@@ -1,21 +1,21 @@
![Security CoPilot Logo](https://github.com/Azure/Copilot-For-Security/blob/main/Images/ic_fluent_copilot_64_64%402x.png)
# Microsoft Copilot For Security
# Microsoft Security Copilot
## Featured Capability: Generate Hunting Queries

### Introduction
**Advanced Hunting in Copilot For Security **
Copilot For Security is now enabled with purpose-built skills that leverage the generative AI capabilities of GPT-4 to reason over a natural-language prompt and generate a KQL query capable of retrieving data from Advanced Hunting tables in Microsoft Defender and top data tables in Microsoft Sentinel. See the full list of supported tables in [Appendix](#appendix).
**Advanced Hunting in Security Copilot **
Security Copilot is now enabled with purpose-built skills that leverage the generative AI capabilities of GPT-4 to reason over a natural-language prompt and generate a KQL query capable of retrieving data from Advanced Hunting tables in Microsoft Defender and top data tables in Microsoft Sentinel. See the full list of supported tables in [Appendix](#appendix).
This new functionality replaces an earlier implementation with a vastly improved algorithm and access to the latest Azure OpenAI models. Research is underway that would extend the functionality to additional data tables in Sentinel.

### Getting Started
**Prerequisites**
1. Access to Microsoft Copilot For Security
2. Access to Defender Advanced Hunting and Microsoft Sentinel with the same credentials used to access Copilot For Security .
1. Access to Microsoft Security Copilot
2. Access to Defender Advanced Hunting and Microsoft Sentinel with the same credentials used to access Security Copilot .
3. Access to the necessary features and licenses in Defender and Sentinel to activate all supported tables.

**Activating the Skillset**
- Enable “Natural language to Defender 365 KQL” and “Natural language to Sentinel KQL” in the admin console under “My connections”.
- The NL2KQL skills can be automatically selected by Copilot For Security based on your prompt.
- The NL2KQL skills can be automatically selected by Security Copilot based on your prompt.
- In the prompt box, type “/kql” to select the skill explicitly before entering a prompt.

### Use Case Scenarios
Expand All @@ -40,7 +40,7 @@ You can also ask questions such as:
1. Be unambiguous: try to ask questions with a clear subject.
2. Ask one question at a time: ask for a single task/type of information at a time when possible.
3. Be specific: if you know anything about the data you are looking for, help provide that information in your question.
4. Use other skills: You can use Copilot For Security 's other skills to help gather information that might provide useful context while writing hunting queries.
4. Use other skills: You can use Security Copilot 's other skills to help gather information that might provide useful context while writing hunting queries.

**Example guidelines:**
| Ambiguous | Good | Explanation |
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
![Security CoPilot Logo](https://github.com/Azure/Copilot-For-Security/blob/main/Images/ic_fluent_copilot_64_64%402x.png)

# Prompting Tips with Microsoft Copilot for Security
# Prompting Tips with Microsoft Security Copilot

| Best Practice | Description |
|-------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
Expand All @@ -11,7 +11,7 @@
| **Be Positive and Respectful** | Use positive instructions instead of negative ones. Be respectful and appropriate for the workplace and avoid any biased, inappropriate, or violent content. Use the singular "they" pronoun to refer to people and avoid guessing their gender, roles, or feelings. |
| **Treat Copilot as your Compadre** | Address Copilot as "you" instead of "model" or "assistant". |
| **Treat new Copilot sessions as if they are a Stranger** | Sessions currently cannot reference other sessions. Meaning, if you ask a question in relation to an answer provided in a previous session, your new Copilot struggle will likely struggle to address without enough context. Please be mindful of this working with Copilot. |
| **Make Copilot do the Heavy Lifting when it comes to summarizing your sessions** | Concluding your session, leverage Copilot for Security to summarize the prompts’ responses for whatever audience you choose. |
| **Make Copilot do the Heavy Lifting when it comes to summarizing your sessions** | Concluding your session, leverage Security Copilot to summarize the prompts’ responses for whatever audience you choose. |
| **Bridge your KQL knowledge gap with NL2KQL skills and KQL custom plugins** | Use the natural language to KQL (NL2KQL) plugin to hunt for information in your data sources using plain English. Junior KQL users will appreciate our KQL custom plugins to execute common KQL queries via natural language. |
| **Automate wherever possible** | Use promptbooks and custom promptbooks to automate common security workflows, which require iterative responses to collate and summarize the information you seek. |
| **It's okay to experiment. In fact, it’s encouraged!** | We’re venturing unchartered territory as a market with Security LLMs. Don’t be afraid to experiment with different ways of framing your prompts and evaluate the results based on your needs and expectations. You may be pleasantly surprised to find new things you never thought possible. Share your learnings with us in the comments of our blog. |
Expand Down
14 changes: 7 additions & 7 deletions Customer Guides/Readme.md
Original file line number Diff line number Diff line change
@@ -1,19 +1,19 @@
![Security CoPilot Logo](https://github.com/Azure/Copilot-For-Security/blob/main/Images/ic_fluent_copilot_64_64%402x.png)
# Microsoft Copilot for Security - Customer Guide
Welcome to the Microsoft Copilot for Security Customer Guide! This document serves as your comprehensive resource for leveraging specific skill sets, querying sample prompts, managing identities, and addressing various security scenarios within Microsoft Copilot for Security. Whether you're new to the platform or looking to deepen your understanding, this guide will equip you with the knowledge and tools needed to maximize the effectiveness of CMicrosoft Copilot for Security
# Microsoft Security Copilot - Customer Guide
Welcome to the Microsoft Security Copilot Customer Guide! This document serves as your comprehensive resource for leveraging specific skill sets, querying sample prompts, managing identities, and addressing various security scenarios within Microsoft Security Copilot. Whether you're new to the platform or looking to deepen your understanding, this guide will equip you with the knowledge and tools needed to maximize the effectiveness of Microsoft Security Copilot.

# Introduction
Microsoft Copilot for Security is a powerful platform designed to empower security professionals with advanced capabilities for threat detection, incident response, and security operations. By harnessing the latest advancements in artificial intelligence and machine learning, Microsoft Copilot for Security enables organizations to proactively defend against cyber threats, streamline security workflows, and protect critical assets.
Microsoft Security Copilot is a powerful platform designed to empower security professionals with advanced capabilities for threat detection, incident response, and security operations. By harnessing the latest advancements in artificial intelligence and machine learning, Microsoft Security Copilot enables organizations to proactively defend against cyber threats, streamline security workflows, and protect critical assets.

# Key Features
# 1. Specific Skill Sets
Microsoft Copilot for Security offers a diverse range of skill sets tailored to address specific security challenges and scenarios. These skill sets are designed to provide actionable insights, automate repetitive tasks, and enhance overall security posture.
Microsoft Security Copilot offers a diverse range of skill sets tailored to address specific security challenges and scenarios. These skill sets are designed to provide actionable insights, automate repetitive tasks, and enhance overall security posture.

# 2. Sample Prompts
To effectively utilize Microsoft Copilot for Security's capabilities, it's essential to understand how to formulate queries and prompts that yield relevant insights. Sample prompts cover a variety of security topics.
To effectively utilize Microsoft Security Copilot's capabilities, it's essential to understand how to formulate queries and prompts that yield relevant insights. Sample prompts cover a variety of security topics.

# 3. Identity Management
Managing identities and access controls is critical for maintaining security and compliance within an organization. Microsoft Copilot for Security provides robust identity management features, allowing you to authenticate users, authorize access, and monitor user activity.
Managing identities and access controls is critical for maintaining security and compliance within an organization. Microsoft Security Copilot provides robust identity management features, allowing you to authenticate users, authorize access, and monitor user activity.

# 4. Scenarios
Microsoft Copilot for Security for Security can be applied to a wide range of security scenarios, including but not limited to threat hunting, incident response, and compliance monitoring.
Microsoft Security Copilot can be applied to a wide range of security scenarios, including but not limited to threat hunting, incident response, and compliance monitoring.
12 changes: 6 additions & 6 deletions Logic Apps/Readme.md
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
![Copilot for Security Overview](https://github.com/Azure/Copilot-For-Security/blob/main/Images/ic_fluent_copilot_64_64%402x.png)
# Microsoft Copilot for Security Logic Apps
![Security Copilot Overview](https://github.com/Azure/Copilot-For-Security/blob/main/Images/ic_fluent_copilot_64_64%402x.png)
# Microsoft Security Copilot Logic Apps
Documentation : https://learn.microsoft.com/en-us/copilot/security/connector-logicapp

The Microsoft Copilot for Security Logic Apps connector allows you to call into Microsoft Copilot for Security from a Logic Apps workflow. This document provides an introduction to the new connector actions you can leverage as well as sample use cases you can deploy to automate investigations such as on Sentinel incidents, email phishing, and others.
The Microsoft Security Copilot Logic Apps connector allows you to call into Microsoft Security Copilot from a Logic Apps workflow. This document provides an introduction to the new connector actions you can leverage as well as sample use cases you can deploy to automate investigations such as on Sentinel incidents, email phishing, and others.

The first iteration of the Logic Apps connector exposes two actions:

- Evaluate Prompt - Given a natural language prompt, this action will invoke a new evaluation within Microsoft Copilot for Security and return the output to your logic app workflow. The user can provide an optional sessionId, which will include relevant session context for the evaluation performed. If the sessionId is omitted, the action will create a new session.
- Evaluate Prompt - Given a natural language prompt, this action will invoke a new evaluation within Microsoft Security Copilot and return the output to your logic app workflow. The user can provide an optional sessionId, which will include relevant session context for the evaluation performed. If the sessionId is omitted, the action will create a new session.

- Evaluate Direct Skill - Given a natural language prompt, a skill name, and the skill required inputs, invoke a new evaluation and return its output. Use this action when you know the exact Microsoft Copilot for Security skill that is required for the task. This action also allows the option to provide a sessionId.
- Evaluate Direct Skill - Given a natural language prompt, a skill name, and the skill required inputs, invoke a new evaluation and return its output. Use this action when you know the exact Microsoft Security Copilot skill that is required for the task. This action also allows the option to provide a sessionId.

Both the "Evaluate Prompt" and "Evaluate Direct Skill" actions allow the user to set an optional sessionId to execute the evaluation within the context of an existing session. If omitted, a new session will be created for the investigation.

Expand All @@ -23,7 +23,7 @@ Here you will find an array of differnt playbooks aligned with CyberSec scenario
- Compliance automation: Automated processes help ensure adherence to cybersecurity regulations and standards, reducing compliance risks.
- Resource optimization: By automating routine tasks, cybersecurity professionals can focus on strategic initiatives and proactive threat hunting.

**Disclaimer**: Please be aware that the logic apps provided are examples intended for use with Copilot for Security. Users are encouraged to customize these samples to meet their specific requirements. These should serve as guidelines and inspiration for creating tailored logic apps for ones own use
**Disclaimer**: Please be aware that the logic apps provided are examples intended for use with Security Copilot. Users are encouraged to customize these samples to meet their specific requirements. These should serve as guidelines and inspiration for creating tailored logic apps for ones own use

**Technical Disclaimer: Logic Apps, SCU Usage, and Best Practices**

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ Select Next and confirm that the System assigned check box is checked.
<br />

<br />Now that the account is created, we need to give it permissions to make the SCU change.
<br />In another browser tab, locate your Copilot for Security Resource and select Access Control (IAM).
<br />In another browser tab, locate your Security Copilot Resource and select Access Control (IAM).
<br />Select the +Add button and choose Add role assignment.
<br />
![Image4](https://github.com/anfisher1967/Copilot-For-Security/blob/main/Images/Azure%20Automation%20Images/_IAM.png)
Expand Down
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
![Copilot for Security Overview](https://github.com/Azure/Copilot-For-Security/blob/main/Images/ic_fluent_copilot_64_64%402x.png)
# Microsoft Copilot for Security Custom Plugins - Send Copilot Output to Email
![Security Copilot Overview](https://github.com/Azure/Copilot-For-Security/blob/main/Images/ic_fluent_copilot_64_64%402x.png)
# Microsoft Security Copilot Custom Plugins - Send Copilot Output to Email

# Send Copilot Output to Email Plugin

## Overview

The "Send Copilot Output to Email" plugin is designed to seamlessly integrate with Microsoft Copilot for Security. Its primary purpose is to take an output generated by Copilot and send it to a designated email address. This plugin enhances the flexibility of Copilot by allowing users to receive important security alerts and notifications directly in their email inbox.
The "Send Copilot Output to Email" plugin is designed to seamlessly integrate with Microsoft Security Copilot. Its primary purpose is to take an output generated by Copilot and send it to a designated email address. This plugin enhances the flexibility of Copilot by allowing users to receive important security alerts and notifications directly in their email inbox.

## Solution Components

Expand Down
8 changes: 4 additions & 4 deletions Plugins/Community Based Plugins/Copilot Logins/Readme.md
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
# Copilot for Security Plugin: Copilot for Security Portal Logins
# Security Copilot Plugin: Security Copilot Portal Logins

### **This plugin enables you to track how many logins there have been to the Copilot for Security standalone experience and who did it.**
### **This plugin enables you to track how many logins there have been to the Security Copilot standalone experience and who did it.**

### Pre-requisites

- [Copilot for Security Enabled](https://learn.microsoft.com/en-us/security-copilot/get-started-security-copilot#onboarding-to-microsoft-security-copilot)
- [Security Copilot Enabled](https://learn.microsoft.com/en-us/security-copilot/get-started-security-copilot#onboarding-to-microsoft-security-copilot)
- [Access to upload custom plugins](https://learn.microsoft.com/en-us/security-copilot/manage-plugins?tabs=securitycopilotplugin#managing-custom-plugins)
- [Microsoft Sentinel Workspace](https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard) created.
- Parameters for KQL Plugin - Microsoft Sentinel Workspace Name, Subscription ID, Resource Group Name and Entra Tenant ID
Expand All @@ -17,4 +17,4 @@
2. Modify the yaml file to specify your specific Entra TentantId, SubscriptionId, ResourceGroupName and WorkspaceName for your Sentinel instance.
3. Upload the custom plugin

For more information, see: [Copilot for Security Plugin: Copilot for Security Portal Logins](https://rodtrent.substack.com/p/copilot-for-security-plugin-copilot)
For more information, see: [Security Copilot Plugin: Security Copilot Portal Logins](https://rodtrent.substack.com/p/copilot-for-security-plugin-copilot)
6 changes: 3 additions & 3 deletions Plugins/Community Based Plugins/Country Info/Readme.md
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
# Copilot for Security Plugin: Country Info
# Security Copilot Plugin: Country Info

### **This plugin retrieves Country information using a publicly available database.**

### Pre-requisites

- [Copilot for Security Enabled](https://learn.microsoft.com/en-us/security-copilot/get-started-security-copilot#onboarding-to-microsoft-security-copilot)
- [Security Copilot Enabled](https://learn.microsoft.com/en-us/security-copilot/get-started-security-copilot#onboarding-to-microsoft-security-copilot)
- [Access to upload custom plugins](https://learn.microsoft.com/en-us/security-copilot/manage-plugins?tabs=securitycopilotplugin#managing-custom-plugins)
- [Microsoft Sentinel Workspace](https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard) created.
- Parameters for KQL Plugin - Microsoft Sentinel Workspace Name, Subscription ID, Resource Group Name and Entra Tenant ID
Expand All @@ -17,4 +17,4 @@
2. Modify the yaml file to specify your specific Entra TentantId, SubscriptionId, ResourceGroupName and WorkspaceName for your Sentinel instance.
3. Upload the custom plugin

For more information, see: [Copilot for Security Plugin: Country Info](https://rodtrent.substack.com/p/copilot-for-security-plugin-country)
For more information, see: [Security Copilot Plugin: Country Info](https://rodtrent.substack.com/p/copilot-for-security-plugin-country)
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Perform a search within a list of results from a process search. For example, se

**How to Use the Custom Plugin**

1. Add the custom plugin in Microsoft Copilot for Security
1. Add the custom plugin in Microsoft Security Copilot

![Echo1](https://github.com/Azure/Copilot-For-Security/blob/main/Images/Logicapp%20images/Echo1.jpg)

Expand Down
Loading

0 comments on commit cdfd9bb

Please sign in to comment.