Learn how to customize and optimize Copilot for Security with the custom Data Security plugin

This is a step-by-step guide on how to use the tailored Copilot for Security pack for Microsoft Data Security and how it can help your organization understand cybersecurity risks so that you can achieve more. We focus on information and organizational context to reflect the real impact/value of cyber investments and incidents. We are working on adding this to our basic toolset as well and will update when ready.

Prerequisites

Licensing requirements for Microsoft Purview Information Protection vary depending on the scenarios and features you use. To understand licensing requirements and options for Microsoft Purview Information Protection, see: Information Protection In the section Microsoft 365 Guidance for Security and Compliance and related Download PDF Functional level licensing requirements. Also requires a license for Microsoft Copilot for Security. Learn more here.
Consider setting up Azure AI Search to collect policy documents and include them in your processes.

Step-by-step guide walkthrough

This guide provides high-level steps to get started using the new tooling, starting with adding a custom plugin.

Go to securitycopilot.microsoft.com
Download the DataSecurityAnalyst.yml file. here.
Select the plugin icon in the left corner.

John Nordstrom_0-1713791147737.png

Select the upload plugin in Custom Upload.

John Nordstrom_1-1713791147745.png

Select the Copilot for Security plugin and upload the DataSecurityAnalyst.yml file.

John Nordstrom_2-1713791147749.png

Clicking sound add
You can now see the plugin in Customize.

John Nordstrom_3-1713791147750.png

The custom package contains the following prompts:

You can find this by typing /DLP in DLP.

John Nordstrom_4-1713791147758.png

You can find this by entering sensitivity in the Sensitivity section.

John Nordstrom_5-1713791147767.png

Let’s try this out with the Copilot for Security feature.

Anomaly Detection Sample

DLP Anomaly checks data from the last 30 days and checks for possible anomalies at 30m intervals. Time series decomposition model.

John Nordstrom_0-1713794451225.png

For the sensitivity content above, we are using a slightly different model due to the amount of data. It is based on: Difference pattern This is a function that compares weeks 3 and 4 with weeks 1 and 2.

John Nordstrom_1-1713794620074.png

Compromised accounts may be able to access sensitive information.

This example checks for reported notifications about users with sensitive information.

John Nordstrom_2-1713794838205.png

Who accessed sensitive emails and where did they access them?

Allows your organization to identify who opened a message by entering a message subject or message ID. This applies to internal recipients only.

John Nordstrom_3-1713794932861.png

You can also ask the plugin to list sensitive emails accessed from specific networks or emails affected by specific CVEs.

John Nordstrom_10-1713791147801.png

This document was accessed from an account that may have been compromised.

This plugin allows you to check if a compromised account has accessed a specific document.

John Nordstrom_11-1713791147806.png

Proximity to CVE or ISP/IP tags

This is a sample to give you an idea of how much sensitive information is exposed in CVE. Depending on your ISP, you may be able to pivot this.

John Nordstrom_0-1713795319975.png

Adjust the Exchange DLP policy sample.

To adjust Exchange, Teams, SharePoint, Endpoint, or OCR rules and policies, please contact Copilot for Security for suggestions.

Unlabeled work scope

How many of your departments have unlabeled operations? Are there any departments that stand out?

In this context, you can also use Copilot for Security to deliver recommendations and highlight the benefits of sensitivity labels.

Applications that access sensitive content.

What applications were used to access sensitive content? This plugin supports requesting the applications used to access sensitive content. This can be a fairly long list of applications, and you can filter out common applications by adding filters to your code.

If you want to know more about what type of content a particular application is accessing:

What type of network connection was made by this application?

Or what if you want to verify SHA256 because you’re concerned about the process used?

Hosts with Internet access access sensitive content

Another threat vector is that some devices are connected to the Internet and are processing sensitive content. Be sure to check the processing of confidential and other sensitive information.