Manage plugins in Microsoft Security Copilot

By Ashwin Venugopal -

 







About

Security Copilot has many preinstalled plugins available for Microsoft security services and other commonly used services as well as websites. However, custom plugins can also be added. 

Manage Plugins

There are two ways to configure the plugins on a list:

  • Turn Plugins On or Off- Copilot uses active Microsoft plugins to access security-related data on behalf of authentication. However, if a plugin needs its own authentication configuration, it does so itself rather than on one's behalf. The four plugin categories of plugin sources are Microsoft, Non-Microsoft, Websites, and Customs. Decide which plugins to use. Service toggles can be turned on or off to use Security Copilot as a data source. 

  1. Choose the Security Copilot sources icon.
  2. Select the desired plugin by turning the toggle on or off. Inaccessible custom plugins won't appear, whereas, preinstalled inaccessible plugins will indicate they are Restricted.

  • Personalize Plugin Settings- Personalize Security Copilot plugin experiences by configuring the plugin setting. For instance, a user can customize the settings to specify the workspace if they would like the Microsoft Sentinel plugin to use a specific workspace they have set as the default. Currently, personalization settings are available for Microsoft Sentinel and Microsoft Defender External Attack Surface Management. 

  1. Choose Security Copilot sources icon.
  2. Now go for the gear icon.
  3. Provide settings details and then save

Manage Custom Plugins

Before custom plugins can be accessed, their owners must set the permissions. Owners are the only ones who can add and control their own custom plugins by default. Additionally, owners have the ability to designate who in their organization can add and oversee custom plugins. Owner-added plugins can be made accessible to everyone in the company or just to them. 

All Security Copilot users can access, turn on, and use plugins that owners have added as well as made available everyone in the company. However, the plugin can only be altered by the owners.

Options For Managing Plugins

To manage plugins as an owner:
  1. Select the Home menu icon.
  2. In Preferences, navigate to the Plugin settings section.
  3. Select who can add and manage their own custom plugins. Choose Owners Only or Contributors and Owners. 
  4. Select who can add and manage custom plugins for everyone in the organization.
  5. Select to manage preinstalled plugin availability and restrict access. 
This is an immediate change impacting all users of Security Copilot. Please exercise caution and notify other users prior to impact. 

Add Custom Plugins

Adding Custom Plugins extends the capability of Security Copilot.
  1. Select the Security Copilot sources icon.
  2. In Manage Plugins, scroll down to the Custom section.
  3. Choose Add Plugin.
  4. From the drop-down options, specify if you want to make the plugin available to just yourself or anyone in the organization. Then choose between adding a Security Copilot Plugin or an Open AI Plugin.
  5. According to the desired plugin to be added, select Security Copilot plugin and then click to either upload a file or as a link. 
  6. After the successful addition of the plugin, it might need to be set up which can also be done later. 
  7. Provide appropriate values for the settings fields, then choose Setup. 

Update Custom Plugin Information

If it is required to make changes to an added plugin:
  1. Click the Security Copilot plugin icon.
  2. In the Custom section, go for gear icon beside the plugin needed to be updated.
  3. Choose Edit file and make appropriate updates. 
  4. Select Save and Confirm to proceed. 

Delete Added Plugins

To delete the custom plugins:
  1. Choose the Security Copilot plugin icon.
  2. In Custom section, go for the gear icon beside the plugin required to be deleted.
  3. Select Delete and confirm to proceed.

Conclusion

Here, we learned how to manage preinstalled as well as custom-made plugins in Microsoft Security Copilot. 



















































Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different...
Read more

Deployment (Part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Azure Resources Microsoft Sentinel needs following resources to be created: Subscription (if a dedicated subscription(s) will be used) Resource group(s) Log Analytics workspace(s) Automation rules/playbook Alert rules Workbooks Microsoft Sentinel offers hundreds of alert rules, workbooks, and automation playbook templates along with hunting scripts. The templates can be used to activate/deploy schedule alerts, create customized dashboards, create automation playbooks and perform threat-hunting activities. Generally, once deployed, the resources created have to be adjusted to match the existing environment, configure local credentials, etc. Methods of deployment: Manual- Administrator can manually configures the Microsoft Sentinel resources with the help of Azure portal. Any manual process has the inherent risks of human operator error, lack of compliance with potential change control procedures, and u...
Read more

Deployment (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 3, please click  here Microsoft Sentinel Content Hub Content in Microsoft Sentinel includes any of the following types: Data connectors offer log ingestion from different sources into Microsoft Sentinel. Parsers give log formatting/transformation into ASIM formats, supporting usage across various Microsoft Sentinel content types and scenarios. Workbooks provide monitoring, visualization, and interactively with data in Microsoft Sentinel, highlighting meaningful insights for users.  Analytics rules give alerts that point to relevant SOC actions via incidents.  Hunting Queries are used by SOC teams to proactively hunt for threats in Microsoft Sentinel. Notebooks help SOC teams in using advanced hunting features in Jupyter and Azure Notebooks. Watchlists support the ingestion of specific data for enhanced threat detection and reduced alert fatigue.  Playbooks and Azure Logic Apps Custom Connectors provide featu...
Read more