sentinel-hunt-workbench

Plugin sentinel-hunt-workbench from marketplace cops-security-marketplace in sodejm/copilot-operation-plugin-for-security. Commands read from the repo's manifest — 10 days ago.

Skills (6)

• adapt-sentinel-hunt

  Use for requests such as \"move this hunt to Defender or Sentinel.\" Adapt a defensive hunt between Microsoft hunting surfaces while preserving evidence semantics and reporting incompatibilities.

• author-sentinel-kql

  Use for requests such as \"write a Sentinel query from my hunt plan.\" Author typed, bounded KQL for one declared Microsoft hunting surface from an approved defensive hunt contract.

• plan-sentinel-hunt

  Use for requests such as \"help me plan a threat hunt.\" Plan an authorized Microsoft Sentinel threat hunt as an observable, falsifiable, surface-specific investigation before writing KQL.

• review-sentinel-hunt

  Use for requests such as \"review the logic of this hunt.\" Perform a skeptical analyst and security review of a Sentinel hunt for ambiguity, evidence loss, overclaim, and unsafe operational guidance.

• test-sentinel-hunt

  Use for requests such as \"test this hunt with sample events.\" Stress-test an offline Sentinel hunt with curated, generated, mutation, metamorphic, scale-boundary, and hostile-content cases.

• validate-sentinel-hunt

  Use for requests such as \"check this hunt for missing or invalid fields.\" Run deterministic contract, schema, scope, compatibility, and safety validation for an offline Sentinel hunt artifact.

Subagents (1)

• sentinel-hunt-workbench

  Route authorized defensive Sentinel hunt planning, KQL authoring, adaptation, validation, testing, and review through the canonical offline workbench skills.

Similar plugins