Add Cribl Detect plugin to Published Plugins

[Kamilo Amir (amiracle)]

Summary

Adds a new read-only Microsoft Security Copilot plugin for Cribl Detect
under Plugins/Published Plugins/CriblDetect/.

The plugin lets Security Copilot:

• List and look up Cribl detection rules by severity, status, data source,
  or MITRE ATT&CK technique.
• Query alerts and findings with time-window, severity, status, assignee,
  rule, and entity filters.
• Retrieve notable events (correlated incidents) with risk score, timeline,
  and contributing alert ids.
• Inspect ingest data sources, worker groups, and routing pipelines to
  confirm detection coverage.

Files added

• CriblDetect_manifest.yaml — plugin manifest (Descriptor + SkillGroups).
• CriblDetect_OpenAPI.yaml — OpenAPI 3.0.1 spec with 9 operations.
• readme.md — install, configuration, skills & prompts, FAQ.
• SamplePrompts.md — triage, coverage, and chained-skill prompt examples.
• CHANGELOG.md — version history (follows Keep-a-Changelog).

Auth

• SupportedAuthTypes: [APIKey]
• Authorization.Type: APIKey, header Authorization: Bearer <token>.
• Per-tenant base URL supplied via the CriblBaseUrl plugin setting and
  wired into the API skills via EndpointUrlSettingName.

Scope

The plugin is strictly read-only — none of the nine skills create, modify,
or delete Cribl resources. Recommended token role is a least-privilege
service account with read access on Detections, Alerts, Notables, Sources,
and Pipelines.

Test plan

• Upload CriblDetect_manifest.yaml as a custom plugin in a Security
  Copilot workspace.
• Enter a valid Cribl Base URL and bearer token when prompted.
• Run List enabled Cribl detections tagged with MITRE T1059.001.
• Run List Cribl notables with risk score >= 70 from the past 48 hours.
• Confirm 401/403/404/429 responses render the expected error cards.

🤖 Generated with Claude Code