[shrutiailani]

Plugin submission for Microsoft Security Exposure Management. This is version 1, more skills to be added in subsequent versions.

[anashadidi-msft]

Plugin submission for Microsoft Security Exposure Management.

This is version 1 with 2 basic skills; more skills to be added subsequently.

[shrutiailani]

@microsoft-github-policy-service agree company="Microsoft"

[Copilot]

Pull Request Overview

This PR introduces a new Microsoft Security Exposure Management plugin for Security Copilot that enables querying exposed devices through natural language. The plugin provides two main capabilities for SOC engineers to investigate security exposures.

• Adds KQL-based skills for querying device exposure data
• Implements cloud platform filtering and user-based device queries
• Enables exposure level filtering (High, Medium, Low) across different scenarios

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

The query ends abruptly without projecting the final result columns. Add a | project UPN, DeviceName, DeviceId, ExposureLevel, CloudPlatforms, OSPlatform, OSArchitecture statement after the join to return the expected columns mentioned in the DescriptionForModel.

Suggested change

	) on DeviceName
	| project UPN, DeviceName, DeviceId, ExposureLevel, CloudPlatforms, OSPlatform, OSArchitecture

[Sean Kwach Wasonga (KwachSean)]

Summary of changes:

A new plugin YAML file was added: Plugins/Community Based Plugins/Microsoft Security Exposure Management/Microsoft Security Exposure Management.yaml.
This file introduces a descriptor for "Microsoft Exposure Management" with a description outlining its integration with Security Copilot to surface exposure insights and attack paths for SOC engineers.
Two main KQL-based skills are defined:
GetExposedDevicesByCloudPlatform: Retrieves exposed devices filtered by cloud platform (Azure, AWS, GCP) and exposure level (High, Medium, Low), with example prompts and KQL template.
GetExposedDevicesByUser: Retrieves exposed devices associated with a specific user (UPN), optionally filtered by exposure level, with example prompts and KQL template.
Both skills include detailed input requirements, settings, and example user prompts.
Appending approval: APPROVED ✅ — The changes are clear, well-documented, and introduce valuable functionality for integrating Microsoft Security Exposure Management with Security Copilot.