diff --git a/.gitignore b/.gitignore index 8a30d258..1a02111a 100644 --- a/.gitignore +++ b/.gitignore @@ -396,3 +396,4 @@ FodyWeavers.xsd # JetBrains Rider *.sln.iml +.DS_Store diff --git a/Images/BackToTopIcon.png b/Images/BackToTopIcon.png new file mode 100644 index 00000000..8fb0455f Binary files /dev/null and b/Images/BackToTopIcon.png differ diff --git a/Sample Prompts/Readme.md b/Sample Prompts/Readme.md index ce7c1624..daca079d 100644 --- a/Sample Prompts/Readme.md +++ b/Sample Prompts/Readme.md @@ -1,8 +1,49 @@ ![Copilot for Security Overview](https://github.com/KwachSean/Copilot-For-Security/blob/main/Copilot%20for%20Security.png) -## Sample prompts +# Sample prompts Library +Welcome to our page of sample prompts! Here, we offer a variety of examples to demonstrate how prompts can be used to achieve different security tasks. Our examples showcase how specific prompts can be utilized to perform a range of tasks. This is a collaborative page where people can learn from the examples and contribute their own. -# Entra +We have organized our examples into the following categories: + + + +- [Sample prompts Library](#sample-prompts-library) + - [EASM](#easm) + - [Entra](#entra) + - [Intune](#intune) + - [Defender \& Sentinel](#defender--sentinel) + - [Threat Intelligence](#threat-intelligence) + - [Vulnerabilities](#vulnerabilities) + - [Purview](#purview) + + +## EASM + +Microsoft Defender External Attack Surface Management (EASM): +- Show me the attack surface summary for +- How many domains are expired in the organization's attack surface? +- How many SSL certificates are expired in the attack surface? +- Are there any vulnerabilities impacting the host ? +- Provide the CVSS scores for the CVE IDs on the asset +- What are the mitigation steps for the CVE ? +- Show me the intel profile for +- Show me any associated indicators for the above actor. +- What are some of the domain indicators for this actor. +- Get me the reputations for hostname "service-logins.com" +- What are some of the web components for the ip address mentioned above? +- Get the most recent whois record for +- Summarize threat intelligence articles related to the actor mentioned above. +- Are there any threat intelligence articles that reference the IOCs that were found? +- Show me the profiles of any threat actors referenced. +- Are any of these CVEs impacting my internet-facing assets? +- Is my environment vulnerable to any of the CVEs from the list above? +- Is my environment vulnerable to CVE [CVEID]? +- Check my cloud assets for vulnerabilities related to +- Create a report for this copilot session and include sections for: An Overview of MDEASM, The Summary of the Attack Surface for , List of Expired Domains and whois info, The list of Common Names from Expired SSL Certificates, Describe the Vulnerabilities on the Host with CVSS scores, Detailed Steps for Mitigating Vulnerabilities on + + +## Entra + - Whoami - What is the status of the user account for ? Is it locked out? - What login attempts exist for the user on December 31st? (Created KQL) @@ -18,7 +59,8 @@ reasons. - List the groups I am part of - List the groups is part of -# Intune +## Intune + - Which devices are used by user - Tell me about this device. - Identify Weak hosts. @@ -41,7 +83,8 @@ policy? - Tell me about the app policy that isn't compliant. Why would this device not have the policy applied and why is it in a state of non-compliance? -# Defender & Sentinel +## Defender & Sentinel + - Provide me a summary of Defender incident - Tell me more about Sentinel incident - Extract the entities associated with the incident. @@ -75,7 +118,8 @@ Typhoon>? - show me MITRE TTPs from M365D incidents in the last month. - What is the MITRE TTP number for account manipulation? -# Threat Intelligence +## Threat Intelligence + - Summarize recent threat intelligence. - What threat actors have been active lately? - How should I harden my environment to prevent these attacks? @@ -104,7 +148,8 @@ methodologies. - Show relevant TTPs. - Show a relevant list of indicators. -# Vulnerabilities +## Vulnerabilities + - Summarize the latest Vulnerabilities from the last week. - Summarize vulnerability. - What vulnerabilities have been exploited recently by threat actors? @@ -113,7 +158,9 @@ methodologies. - Does [CveId] have known exploitations? - Is my environment vulnerable to CVE [CVEID]? -# Purview + +## Purview + - Show me the top 5 DLP alerts that I should prioritize today? - Can you summarize purview alert ? - Can you summarize the risk associated with user: involved in this alert? @@ -125,3 +172,6 @@ methodologies. - What are the data risks related to this alert? - For the files related to the alert, show me all activities done in the last 7 days? - Can you get me the status of labeling on these files + + +[![alt text](../Images/BackToTopIcon.png)](#sample-prompts-library)