Microsoft Security Copilot Plugins

Documentation : https://learn.microsoft.com/en-us/security-copilot/plugin_overview

The Microsoft Security Copilot connector now supports custom plugins, boosting its third-party integration and automation capabilities. This document highlights custom plugin functionality, emphasizing bridging the gap for 3rd party connections to Copilot, enabling automation from the Standalone portal, and querying custom tables in KQL.

Microsoft Security Copilot Plugin Features

Custom Plugin Features

Feature	Description
Flexible Integration	Seamlessly integrate third-party tools and services with Security Copilot to enhance security operations.
Tailored Automation	Create custom automation workflows tailored to your organization's unique security processes and requirements.
Enhanced Data Querying	Query custom tables in KQL (Kusto Query Language) to retrieve specific security data relevant to your investigations.

Security Copilot Plugin Folders

Please note: We have three folders:

1. Published Plugins- These are Microsoft certified Custom plugins for Microsoft Security Copilot.
2. Community Based Plugins - These are Plugins created and contibuted by the Microsoft Security Copilot Community.
3. MSFT Plugin Samples - These are samples of Custom Plugins that will act as a guide you and give you the ability to create a custom plugin for Security Copilot. The samples are API, GPT, and KQL samples.

Should you be interested in participating in a workshop designed to instruct on the creation of custom plugins, you are welcome to access our Technical workshops

Microsoft Tech Community blog posts

1. How to build a Security Copilot API Plugin – Part 1
2. How to build a Security Copilot API Plugin – Part 2
3. Using Microsoft Graph as a Microsoft Security Copilot Plugin with Delegated Access