diff --git a/Logic Apps/Copilot-Sentinel_investigation-DynamicSev/azuredeploy.json b/Logic Apps/Copilot-Sentinel_investigation-DynamicSev/azuredeploy.json index aba533c..8fd5b13 100644 --- a/Logic Apps/Copilot-Sentinel_investigation-DynamicSev/azuredeploy.json +++ b/Logic Apps/Copilot-Sentinel_investigation-DynamicSev/azuredeploy.json @@ -94,7 +94,7 @@ "type": "ApiConnection", "inputs": { "body": { - "PromptContent": "/SummarizeText Explain why you selected this classifiction. Format as bullet points?", + "PromptContent": "/SummarizeText Explain why you selected this classification. Format as bullet points.", "SessionId": "@body('classify_incident')?['sessionId']" }, "host": { @@ -199,7 +199,7 @@ "type": "ApiConnection", "inputs": { "body": { - "PromptContent": "/GetReputationsByIpAddresses What are the reputation score for the IPv4 addresses on that incident?", + "PromptContent": "/GetReputationsByIpAddresses What are the reputation scores for the IPv4 addresses on that incident?", "SessionId": "@body('GetIncidentEntities')?['sessionId']" }, "host": { @@ -1800,7 +1800,7 @@ "type": "ApiConnection", "inputs": { "body": { - "PromptContent": "Derive a set of tags (5 tags) to describe this incident. the Tags will be used to group other incidents, include a tag for \"Security Copilot Triaged\", only respond with the category, write it as single line with comma between Tags to tags, and dont add bullet points.", + "PromptContent": "Derive a set of tags (5 tags) to describe this incident. the Tags will be used to group other incidents, include a tag for \"Security Copilot Triaged\", only respond with the category, write it as single line with comma between Tags to tags, and don't add bullet points.", "SessionId": "@body('Explain_classify')?['sessionId']" }, "host": { diff --git a/Logic Apps/SecurityCopilot-SOCshift-reporting-transfer/azuredeploy.json b/Logic Apps/SecurityCopilot-SOCshift-reporting-transfer/azuredeploy.json index 9b84214..f666ac0 100644 --- a/Logic Apps/SecurityCopilot-SOCshift-reporting-transfer/azuredeploy.json +++ b/Logic Apps/SecurityCopilot-SOCshift-reporting-transfer/azuredeploy.json @@ -66,7 +66,7 @@ "type": "ApiConnection", "inputs": { "body": { - "PromptContent": "count the number of incidents you menationed above, , this will be used in an automation workflow that only accepts a single string. Provide the incident count in a response with no text before or after", + "PromptContent": "Count the number of incidents you mentioned above, this will be used in an automation workflow that only accepts a single string. Provide the incident count in a response with no text before or after", "SessionId": "@body('Run_Copilot_for_Security_prompt')?['sessionId']" }, "host": { @@ -195,7 +195,7 @@ "type": "ApiConnection", "inputs": { "body": { - "PromptContent": "im a soc analyst leader and our SOC is in the phase for changing a shift, can you summarize all the defender incident that opened in the last 24 hr and they are in status in progress, from the above response only take the incident number, this will be used in an automation workflow that only accepts a single string. Provide the incident number in a response with no text before or after" + "PromptContent": "I'm a SOC analyst leader and our SOC is in the phase for changing a shift, can you summarize all the defender incident that opened in the last 24 hr and if they are in status in progress, from the above response only take the incident number, this will be used in an automation workflow that only accepts a single string. Provide the incident number in a response with no text before or after" }, "host": { "connection": { diff --git a/Plugins/Community Based Plugins/Browserling/Browserling.yaml b/Plugins/Community Based Plugins/Browserling/Browserling.yaml new file mode 100644 index 0000000..feae051 --- /dev/null +++ b/Plugins/Community Based Plugins/Browserling/Browserling.yaml @@ -0,0 +1,27 @@ +Descriptor: + Name: Detonate With Browserling + DisplayName: Detonate With Browserling + Description: Skills for detonating With Browserling + +SkillGroups: + - Format: GPT + Skills: + - Name: Detonate With Browserling + DisplayName: Detonate With Browserling + Description: Detonate With Browserling + Inputs: + - Name: text + Description: The url to be detonated + Required: true + Settings: + ModelName: gpt-4-32k-v0613 + Template: |- + To detonate a URL means to append the domain to https://www.browserling.com/browse/win10/chrome116/ + + Some examples of detonating URLs: + + 1. https://example.com --> https://www.browserling.com/browse/win10/chrome116/example.com + 2. http://google.com --> https://www.browserling.com/browse/win10/chrome116/google.com + + Detonate any URLs in the following text and return the new text: + {{text}} diff --git a/Plugins/Community Based Plugins/Browserling/Readme.md b/Plugins/Community Based Plugins/Browserling/Readme.md new file mode 100644 index 0000000..0edd5b9 --- /dev/null +++ b/Plugins/Community Based Plugins/Browserling/Readme.md @@ -0,0 +1,31 @@ +### Browserling Custom Plugin + +This plugin can rewrite URLs ready to be detonated in browserling for a seamless interactive detonation experience. URLs do not need to be un-defanged when used in Browserling which keeps the user experience safer. + +### Prerequistes +* [Copilot for Security Enabled](https://learn.microsoft.com/en-us/security-copilot/get-started-security-copilot#onboarding-to-microsoft-security-copilot) +* [Access to upload custom plugins](https://learn.microsoft.com/en-us/security-copilot/manage-plugins?tabs=securitycopilotplugin#managing-custom-plugins) + +### Instructions +#### Upload the Custom Plugin + +1. Obtain the file [Browserling.yaml](https://github.com/Azure/Copilot-For-Security/blob/main/Plugins/Community%20Based%20Plugins/Browserling/Browserling.yaml) from this directory. +2. [Upload the custom plugin](https://learn.microsoft.com/en-us/security-copilot/manage-plugins?tabs=securitycopilotplugin#add-custom-plugins) and verify it's activated. + + +### Plugin Utilization +* Can you please help me detonate amsi[.]fail? +* Can you safely Detonate office365com[.]zip for me? + +![image](https://github.com/jkerai1/Copilot-For-Security/assets/55988027/3f0e6d4e-ee42-4134-bd80-b414a4287842) + +![image](https://github.com/jkerai1/Copilot-For-Security/assets/55988027/bc59e7ac-c407-40c1-9183-5d6b35b3cb58) + +URL navigates to: + +![image](https://github.com/jkerai1/Copilot-For-Security/assets/55988027/8a0f39b8-74f1-4364-ba0a-53e4f03453a0) + + +## Plugin Guidance + +It is strongly advised to work with defanged URLs (i.e. containing [.]) where possible to reduce chance of accidental detonation.