MDA Custom Plugins #126
MDA Custom Plugins #126
Conversation
Version 0.1
Verison 0.2
|
@alfonso-greenbrook provide sample prompts to use with this Custom plugin showcasing the different skills |
There was a problem hiding this comment.
@alfonso-greenbrook provide Sample prompts in the readme file on how to use the skills associated with the plugin
|
@KwachSean Have added example prompts to both readme.md and .yaml files. |
There was a problem hiding this comment.
Here are the summarized changes:
Added new plugin files for MDA Advanced Threat Protection (ATP) Detection:
MDA_Advanced_Threat_Protection_Detection.yaml: Contains definitions and KQL skills for querying MDA tables for ATP events.
readme.md: Provides instructions and descriptions for the MDA ATP Detection plugin.
Added new plugin files for MDA Cloud App Events:
MDA_Cloud_Apps_Events.yaml: Contains definitions and KQL skills for querying MDA CloudAppEvents tables for various cloud app activities.
Readme.md: Provides instructions and descriptions for the MDA Cloud App Events plugin.
Minor correction:
Fixed a typo in the DisplayName for the skill GetExchangeOnlineActivityForUser in MDA_Cloud_Apps_Events.yaml.
These changes add new functionality for SOC analysts to get insights and investigate events related to Advanced Threat Protection and cloud app activities using custom KQL plugins.
Two plugins that use the CloudAppEvents table to provide insights about user activity and files detected by ATP.