Copilot for Security: Chaining Plugins with Use

The power of Use is...uh...powerful

I’ve talked before Copilot for Security and the Power of Use, but that discussion was in relation to how to direct Copilot for Security to use specific plugins for efficiency purposes.

There’s also another reason why the word ‘use’ is powerful in prompting. In the case of Copilot for Security, if you know the specific plugin that you want to use, you can direct Copilot for Security to use it explicitly.

You can perform this in the standalone experience through single-use prompts, but as a best practice, consider using ‘use’ throughout your Promptbooks.

The following is an example of a Promptbook I created that summarizes an Incident, then uses the MDTI plugin to identify any known threats based on the Incident’s details, then uses the IP-API custom plugin to capture IP address details, and then follows up using the WHOIS custom plugin to supply domain information if it exists.

You can get the steps for this Promptbook here: https://github.com/rod-trent/Copilot-for-Security/blob/main/Prompts/Promptbooks/Power_of_Use.md

---

[Want to discuss this further? Hit me up on Twitter or LinkedIn]

[Subscribe to the RSS feed for this blog]

[ Subscribe to the Bi-weekly Copilot for Security Newsletter]

[Subscribe to the Weekly Microsoft Sentinel Newsletter]

[Subscribe to the Weekly Microsoft Defender Newsletter]

[Subscribe to the Weekly Azure OpenAI Newsletter]

[Learn KQL with the Must Learn KQL series and book]

[Learn AI Security with the Must Learn AI Security series and book]