From f48da95f70f88c3936a51a4335f2f8a71c94bdec Mon Sep 17 00:00:00 2001 From: Peggy Pinelo Merchan Date: Thu, 22 Feb 2024 20:09:52 +0100 Subject: [PATCH 1/7] Create Test.peggy --- Sample Prompts/Test.peggy | 1 + 1 file changed, 1 insertion(+) create mode 100644 Sample Prompts/Test.peggy diff --git a/Sample Prompts/Test.peggy b/Sample Prompts/Test.peggy new file mode 100644 index 00000000..8318c86b --- /dev/null +++ b/Sample Prompts/Test.peggy @@ -0,0 +1 @@ +Test \ No newline at end of file From b1a769708f9350dc1fa92e38f7efd7857e3b4b57 Mon Sep 17 00:00:00 2001 From: Peggy Pinelo Merchan Date: Thu, 22 Feb 2024 20:12:36 +0100 Subject: [PATCH 2/7] Update Readme.md --- Sample Prompts/Readme.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Sample Prompts/Readme.md b/Sample Prompts/Readme.md index ce7c1624..e8c2fe37 100644 --- a/Sample Prompts/Readme.md +++ b/Sample Prompts/Readme.md @@ -2,6 +2,8 @@ ## Sample prompts +[[_TOC_]] + # Entra - Whoami - What is the status of the user account for ? Is it locked out? From 25d290907efbcf0717c37222f2b8515c1046f5b6 Mon Sep 17 00:00:00 2001 From: Peggy Pinelo Merchan <29891642+ppm78@users.noreply.github.com> Date: Thu, 22 Feb 2024 20:40:07 +0100 Subject: [PATCH 3/7] Delete Test.peggy --- Sample Prompts/Test.peggy | 1 - 1 file changed, 1 deletion(-) delete mode 100644 Sample Prompts/Test.peggy diff --git a/Sample Prompts/Test.peggy b/Sample Prompts/Test.peggy deleted file mode 100644 index 8318c86b..00000000 --- a/Sample Prompts/Test.peggy +++ /dev/null @@ -1 +0,0 @@ -Test \ No newline at end of file From 5462b990e1f3311eb8bd149c20ff3e73821e4e45 Mon Sep 17 00:00:00 2001 From: Peggy Pinelo Merchan <29891642+ppm78@users.noreply.github.com> Date: Thu, 22 Feb 2024 20:40:54 +0100 Subject: [PATCH 4/7] Update Readme.md Added table of contents and EASM. --- Sample Prompts/Readme.md | 40 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 39 insertions(+), 1 deletion(-) diff --git a/Sample Prompts/Readme.md b/Sample Prompts/Readme.md index e8c2fe37..c11a434f 100644 --- a/Sample Prompts/Readme.md +++ b/Sample Prompts/Readme.md @@ -2,9 +2,42 @@ ## Sample prompts -[[_TOC_]] +## Table of Contents +- [EASM](#EASM) +- [Entra](#Entra) +- [Intune](#Intune) +- [Defender & Sentinel](#Defender_and_Sentinel) +- [Threat Intelligence](#Threat_Intelligence) +- [Vulnerabilities](#Vulnerabilities) +- [Purview](#Purview) + + +# EASM +Microsoft Defender External Attack Surface Management (EASM): +- Show me the attack surface summary for +- How many domains are expired in the organization's attack surface? +- How many SSL certificates are expired in the attack surface? +- Are there any vulnerabilities impacting the host ? +- Provide the CVSS scores for the CVE IDs on the asset +- What are the mitigation steps for the CVE ? +- Show me the intel profile for +- Show me any associated indicators for the above actor. +- What are some of the domain indicators for this actor. +- Get me the reputations for hostname "service-logins.com" +- What are some of the web components for the ip address mentioned above? +- Get the most recent whois record for +- Summarize threat intelligence articles related to the actor mentioned above. +- Are there any threat intelligence articles that reference the IOCs that were found? +- Show me the profiles of any threat actors referenced. +- Are any of these CVEs impacting my internet-facing assets? +- Is my environment vulnerable to any of the CVEs from the list above? +- Is my environment vulnerable to CVE [CVEID]? +- Check my cloud assets for vulnerabilities related to +- Create a report for this copilot session and include sections for: An Overview of MDEASM, The Summary of the Attack Surface for , List of Expired Domains and whois info, The list of Common Names from Expired SSL Certificates, Describe the Vulnerabilities on the Host with CVSS scores, Detailed Steps for Mitigating Vulnerabilities on + # Entra + - Whoami - What is the status of the user account for ? Is it locked out? - What login attempts exist for the user on December 31st? (Created KQL) @@ -21,6 +54,7 @@ reasons. - List the groups is part of # Intune + - Which devices are used by user - Tell me about this device. - Identify Weak hosts. @@ -44,6 +78,7 @@ policy? applied and why is it in a state of non-compliance? # Defender & Sentinel + - Provide me a summary of Defender incident - Tell me more about Sentinel incident - Extract the entities associated with the incident. @@ -78,6 +113,7 @@ Typhoon>? - What is the MITRE TTP number for account manipulation? # Threat Intelligence + - Summarize recent threat intelligence. - What threat actors have been active lately? - How should I harden my environment to prevent these attacks? @@ -107,6 +143,7 @@ methodologies. - Show a relevant list of indicators. # Vulnerabilities + - Summarize the latest Vulnerabilities from the last week. - Summarize vulnerability. - What vulnerabilities have been exploited recently by threat actors? @@ -116,6 +153,7 @@ methodologies. - Is my environment vulnerable to CVE [CVEID]? # Purview + - Show me the top 5 DLP alerts that I should prioritize today? - Can you summarize purview alert ? - Can you summarize the risk associated with user: involved in this alert? From 16effeae5a6d2d71687c0d208f14273eaece7d2a Mon Sep 17 00:00:00 2001 From: Peggy Pinelo Merchan <29891642+ppm78@users.noreply.github.com> Date: Thu, 22 Feb 2024 21:01:18 +0100 Subject: [PATCH 5/7] Update Readme.md typo --- Sample Prompts/Readme.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Sample Prompts/Readme.md b/Sample Prompts/Readme.md index c11a434f..65533bb8 100644 --- a/Sample Prompts/Readme.md +++ b/Sample Prompts/Readme.md @@ -153,7 +153,7 @@ methodologies. - Is my environment vulnerable to CVE [CVEID]? # Purview - + - Show me the top 5 DLP alerts that I should prioritize today? - Can you summarize purview alert ? - Can you summarize the risk associated with user: involved in this alert? From 65ab0196e86366577560abf023aacd83a36014ef Mon Sep 17 00:00:00 2001 From: Peggy Pinelo Merchan <29891642+ppm78@users.noreply.github.com> Date: Thu, 22 Feb 2024 22:19:12 +0100 Subject: [PATCH 6/7] Update Readme.md --- Sample Prompts/Readme.md | 42 +++++++++++++++++++++++++--------------- 1 file changed, 26 insertions(+), 16 deletions(-) diff --git a/Sample Prompts/Readme.md b/Sample Prompts/Readme.md index 65533bb8..66194b59 100644 --- a/Sample Prompts/Readme.md +++ b/Sample Prompts/Readme.md @@ -1,18 +1,24 @@ ![Copilot for Security Overview](https://github.com/KwachSean/Copilot-For-Security/blob/main/Copilot%20for%20Security.png) -## Sample prompts +# Sample prompts Library +Welcome to our page of sample prompts! Here, we offer a variety of examples to demonstrate how prompts can be used to achieve different security tasks. Our examples showcase how specific prompts can be utilized to perform a range of tasks. This is a collaborative page where people can learn from the examples and contribute their own. -## Table of Contents -- [EASM](#EASM) -- [Entra](#Entra) -- [Intune](#Intune) -- [Defender & Sentinel](#Defender_and_Sentinel) -- [Threat Intelligence](#Threat_Intelligence) -- [Vulnerabilities](#Vulnerabilities) -- [Purview](#Purview) +We have organized our examples into the following categories: -# EASM + +- [Sample prompts Library](#sample-prompts-library) + - [EASM](#easm) + - [Entra](#entra) + - [Intune](#intune) + - [Defender \& Sentinel](#defender--sentinel) + - [Threat Intelligence](#threat-intelligence) + - [Vulnerabilities](#vulnerabilities) + - [Purview](#purview) + + +## EASM + Microsoft Defender External Attack Surface Management (EASM): - Show me the attack surface summary for - How many domains are expired in the organization's attack surface? @@ -36,7 +42,7 @@ Microsoft Defender External Attack Surface Management (EASM): - Create a report for this copilot session and include sections for: An Overview of MDEASM, The Summary of the Attack Surface for , List of Expired Domains and whois info, The list of Common Names from Expired SSL Certificates, Describe the Vulnerabilities on the Host with CVSS scores, Detailed Steps for Mitigating Vulnerabilities on -# Entra +## Entra - Whoami - What is the status of the user account for ? Is it locked out? @@ -53,7 +59,7 @@ reasons. - List the groups I am part of - List the groups is part of -# Intune +## Intune - Which devices are used by user - Tell me about this device. @@ -77,7 +83,7 @@ policy? - Tell me about the app policy that isn't compliant. Why would this device not have the policy applied and why is it in a state of non-compliance? -# Defender & Sentinel +## Defender & Sentinel - Provide me a summary of Defender incident - Tell me more about Sentinel incident @@ -112,7 +118,7 @@ Typhoon>? - show me MITRE TTPs from M365D incidents in the last month. - What is the MITRE TTP number for account manipulation? -# Threat Intelligence +## Threat Intelligence - Summarize recent threat intelligence. - What threat actors have been active lately? @@ -142,7 +148,7 @@ methodologies. - Show relevant TTPs. - Show a relevant list of indicators. -# Vulnerabilities +## Vulnerabilities - Summarize the latest Vulnerabilities from the last week. - Summarize vulnerability. @@ -152,7 +158,7 @@ methodologies. - Does [CveId] have known exploitations? - Is my environment vulnerable to CVE [CVEID]? -# Purview +## Purview - Show me the top 5 DLP alerts that I should prioritize today? - Can you summarize purview alert ? @@ -165,3 +171,7 @@ methodologies. - What are the data risks related to this alert? - For the files related to the alert, show me all activities done in the last 7 days? - Can you get me the status of labeling on these files + +[Up][def] + +[def]: # \ No newline at end of file From 275f354338d639cf4e40338a3fca16de6bf290df Mon Sep 17 00:00:00 2001 From: Peggy Pinelo Merchan <29891642+ppm78@users.noreply.github.com> Date: Thu, 22 Feb 2024 22:44:20 +0100 Subject: [PATCH 7/7] update update --- .gitignore | 1 + Images/BackToTopIcon.png | Bin 0 -> 2083 bytes Sample Prompts/Readme.md | 4 ++-- 3 files changed, 3 insertions(+), 2 deletions(-) create mode 100644 Images/BackToTopIcon.png diff --git a/.gitignore b/.gitignore index 8a30d258..1a02111a 100644 --- a/.gitignore +++ b/.gitignore @@ -396,3 +396,4 @@ FodyWeavers.xsd # JetBrains Rider *.sln.iml +.DS_Store diff --git a/Images/BackToTopIcon.png b/Images/BackToTopIcon.png new file mode 100644 index 0000000000000000000000000000000000000000..8fb0455f139c04b8915446ec3fe13b22648b496f GIT binary patch literal 2083 zcmeAS@N?(olHy`uVBq!ia0vp^>LAR)1|)kH2buyYmUKs7M+SzC{oH>NS%G|oWRD45bDP46hOx7_4S6Fo+k-*%fF5lxRtf@J#ddWzYh$IT% zsd^Q;1t47vHWgMtW^QUpqC!P(PF}H9g{=};g%ywu64qBz04piUwpEJo4N!2-FG^J~ z(=*UBP_pAvP*AWbN=dT{a&d!d2l8x{GD=Dctn~HE%ggo3jrH=2()A53EiLs8jP#9+ zbb%^#i!1X=5-W7`ij^UTz|3(;Elw`VEGWs$&r<-Io0ybeT4JlD1hNPYAnq*5Ohed| zR}A$Q(1ZFQ8GS=N1AT1TQY$iXXamVWw1NEvvCal$m{nv@YH@x}DacuNmS#3!8&Cuh z?t^GRs1MD{EU`0!YC#i5*A;<~M_7X_h_1oEC^HopkYINiLhV2nLsAd&omD_)MQToj zOJ;6rUNP7&<~I6RCD1iG=jY@X1s5bHr`iGS0c$}LLRSs8CK8u5ND@$uHu|8rMv8k# z!UBr|Qpy}(3%8!4a zd-HCM$<4dlI^{1k-km#lZsq;-dEc{z5?24!=kd@~So-n(!K(*an5Io$S?mN%O+I^Y+f~=NK(!GmqcVR`Stw-i_Oa$}%htyBA9TkoX;*aH#UP(7bCZVoP22 zZD_f3-E-;x^$aP;iY(toSN=8 zI4J3_UW$3IY<`C~`M0_Fz^2R3TvJ0&a+}RWa&ISbHnL&Or4@Ok6Kh{ z-Qru7?|aY1o>}H1uvCiOIpp5UsH_Jo&j=~lCuZM&yFPMjRLe!H<;87D#rM>**@UC! zUAi#QcFm{x?|#o`KOEEj?rh28naQ){%Wu9nl2kd7I{TvBW;3ZdA0}t^OmM92V=MoE zS)lBl`sMoUSNal6mv_HjC1&Q%ekuBO@f?qzkIXD9#ryX1T(4p+|FN~IFLnCItp$#? z{gyhbENAa1P4DYAOIOn5PcBN5Kef8S(emVC5i_rwf0o-$^?1(v?QFucS+k^SUi^H+ zx6ZPbRn+T6uhdnsQ^7TNR?d)Y@@u|w>b}v5z2*f8yLLZIf3WB20tf%VFP~>c&3qxo zuGcD(9CRSWJ-sq8_>%wowJMhm%|3OTZ|aJc%U`!h6wGazP%u4v=bS~ww;T`LWITW6 z=-$~;Hw`k3`E1s?6ossPdTN3|GS3db-jGRQ;TZvQRK?O5gEjoDm$$zEcQU%rFWoXu zdxBa#U%E@_HO_P5svVsBCIuZhy=U7gkygz=+YAdPiFp1GknHMut74KC>}O)(rB-!3 zM)S{|<=56l^RLg^s``8GayOTJY4>JfHfxj9rilTm8KUbQ@;)33e7$qor|TWb(Iz_r z%x4;`ka~DS&8lj0&h!)8#OC~KTr|D%k`lr}FXd;kHEz0@uIUxa8{;w;Wo;vrgu9!dl-; f*G`Ku*QP!&moaYc)68qG1yy~Xu6{1-oD!M - Show me the top 5 DLP alerts that I should prioritize today? @@ -172,6 +173,5 @@ methodologies. - For the files related to the alert, show me all activities done in the last 7 days? - Can you get me the status of labeling on these files -[Up][def] -[def]: # \ No newline at end of file +[![alt text](../Images/BackToTopIcon.png)](#sample-prompts-library)