briandelmsft / STAT-Function

Azure Function for the Microsoft Sentinel Triage AssistanT (STAT)
https://aka.ms/mstat
MIT License
8 stars 1 forks source link

Copilot Plug-in integration #78

Open piaudonn opened 3 weeks ago

piaudonn commented 3 weeks ago

Call STAT from Copilot to enrich an incident and visualize the end results in copilot in natural language.

Prompt example: Use STAT to enrich the incident 123 and comment the incident. It would run stat against the incident provided or in the context if an incident is already in the session. Like the base module + all modules that don't need custom inputs. Return the data in a format that Copilot then use in natural language output. Perhaps having a default calculation for the Calculate Score module. Perhaps having the same logic as for the "tag" feature request and return only the data that would be of interest.

It would be integrated in a module. Called directly from Copilot, no logic app involved.