Skip to content

Commit f2224b6

Browse files
KwachSeanKwachSean
authored
Merge pull request #208 from shrutiailani/main
Create Microsoft Security Exposure Management.yaml
2 parents 0cf2b96 + 5e54024 commit f2224b6

1 file changed

Lines changed: 99 additions & 0 deletions

File tree

‎Plugins/Community Based Plugins/Microsoft Security Exposure Management/Microsoft Security Exposure Management.yaml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
Descriptor:
2+
Name: Microsoft Exposure Management
3+
DisplayName: Microsoft Exposure Management
4+
Description: >
5+
This KQL plugin integrates capabilities of Microsoft Security Exposure Management (MSEM) with Security Copilot to show exposed devices.
6+
MSEM provides situational awareness, while Security Copilot (SCP) offers quick and consistent retrieval capabilities.
7+
Together, MSEM and SCP empower SOC Engineers with a natural-language front door into exposure insights and attack paths.
8+
This combination also enables the inclusion of MSEM content and reasoning over this content in Security Copilot prompts, prompt books, and automation scenarios that leverage Security Copilot.
9+
The two skills of the plugin correspond to the following use cases -
10+
1) Obtain exposure of an asset hosted on a particular cloud platform by your organization.
11+
2) Obtain exposure of an asset belonging to a specific user.
12+
In each of the above use cases, you can also specify the exposure level for which you want to extract the data.
13+
14+
SupportedAuthTypes:
15+
- None
16+
17+
#####################################################################################
18+
# SkillGroups can be a single type (KQL, GPT, API) or contain a mix
19+
#####################################################################################
20+
21+
SkillGroups:
22+
- Format: KQL
23+
24+
Skills:
25+
- Name: GetExposedDevicesByCloudPlatform
26+
DisplayName: Get exposed Devices by Cloud Platform and exposure level.
27+
Description: For a specific cloud platform (aka "Azure" or "GCP" or "AWS") or a list of cloud platform of the device separated by commas, semi-colons, or using the word 'or', get a list of devices
28+
based on the exposure level specified by the user (aka "Low" or "Medium" or "High") or a list of exposures separated by commas.
29+
DescriptionForModel: For a specific cloud platform of the device (aka "Azure" or "GCP" or "AWS") or a list of cloud platform of the device separated by commas, get a list of devices based on the exposure level specified by the user (aka "Low" or "Medium" or "High") or a list of exposures separated by commas. The results will be returned as a response to the query containing multiple entries, the user needs to be shown the below details from the response about each device DeviceName, DeviceId, ExposureLevel, CloudPlatforms, OSPlatform, OSArchitecture.
30+
VERY IMPORTANT - Never truncate the list of devices retrieved by launching the KQL query related to this skill. Also if the user wants to search on premises then the value for CloudPlatforms should be blank in the query
31+
32+
ExamplePrompts:
33+
- Get all the devices exposed on Azure platform
34+
- Get all the devices exposed on AWS platform
35+
- Get all the devices exposed on GCP platform
36+
- Get all the devices with exposure level High on Azure platform
37+
- Get all the devices with exposure level Medium on Azure platform
38+
- Get all the devices with exposure level Low on Azure platform
39+
- Get all the devices with exposure level High on AWS platform
40+
- Get all the devices with exposure level Medium on AWS platform
41+
- Get all the devices with exposure level Low on AWS platform
42+
- Get all the devices with exposure level High on GCP platform
43+
- Get all the devices with exposure level Medium on GCP platform
44+
- Get all the devices with exposure level Low on GCP platform
45+
46+
Inputs:
47+
- Name: inputExposureLevel
48+
Description: Provide the exposure level you want to consider - e.g. High, Medium, Low (only one level)
49+
Required: true
50+
- Name: inputCloudPlatforms
51+
Description: Provide the cloud platform of the device you want to consider - e.g. Azure or GCP or AWS
52+
Required: false
53+
54+
Settings:
55+
Target: Defender
56+
Template: |-
57+
let userExposureLevel='{{inputExposureLevel}}';
58+
let userCloudPlatform='{{inputCloudPlatforms}}';
59+
DeviceInfo
60+
| where ExposureLevel == userExposureLevel
61+
| where
62+
(CloudPlatforms != '' and (CloudPlatforms contains userCloudPlatform or isempty(userCloudPlatform)))
63+
| project DeviceName, DeviceId, ExposureLevel, CloudPlatforms, OSPlatform, OSArchitecture, TimeGenerated
64+
65+
- Name: GetExposedDevicesByUser
66+
DisplayName: Get exposed devices by UPN and optionally exposure level
67+
Description: For a specific user UPN (aka "user" or "UPN") or a list of users separated by commas, get a list of devices
68+
based on the exposure level specified by the user (aka "Low" or "Medium" or "High") or a list of exposures separated by commas.
69+
DescriptionForModel: For a specific user UPN (aka "user" or "UPN") or a list of users separated by commas, get a list of devices
70+
based on the exposure level specified by the user (aka "Low" or "Medium" or "High") or a list of exposures separated by commas.
71+
The results will be returned as a response to the query containing multiple entries, the user needs to be shown the below details from the response about each device UPN, DeviceName, DeviceId, ExposureLevel, CloudPlatforms, OSPlatform, OSArchitecture.
72+
VERY IMPORTANT - Never truncate the list of devices retrieved by launching the KQL query related to this skill. Also if the user wants to search on premises then the value for CloudPlatforms should be blank in the query.
73+
74+
ExamplePrompts:
75+
- Get all the devices with exposure level High belonging to user john.doe@contoso.com
76+
- Get all the devices with exposure level Medium belonging to user john.doe@contoso.com
77+
- Get all the devices with exposure level Low belonging to user john.doe@contoso.com
78+
79+
Inputs:
80+
- Name: inputExposureLevel
81+
Description: Provide the exposure level you want to consider - e.g. High, Medium, Low
82+
Required: false
83+
- Name: inputUPN
84+
Description: Provide the user primary name (UPN)
85+
Required: true
86+
Settings:
87+
Target: Defender
88+
Template: |-
89+
let userExposureLevel='{{inputExposureLevel}}';
90+
let userUPN='{{inputUPN}}';
91+
IntuneDevices
92+
| where UPN == userUPN
93+
| project DeviceName = tolower(DeviceName)
94+
| join kind=inner (
95+
DeviceInfo
96+
| where ExposureLevel == userExposureLevel or isempty(userExposureLevel)
97+
| project DeviceName = tolower(DeviceName), DeviceId,ExposureLevel, CloudPlatforms, OSPlatform, OSArchitecture, TimeGenerated
98+
) on DeviceName
99+

0 commit comments

Comments
 (0)