Alfonso Greenbrook

Adding custom API plugin for Trellix Detection on Demand API

5

This is an API custom plugin for the Trellix Detection on Demand API. Includes links to Trellix (FireEye) documentation.

MDE custom plugins

2

Two new plugins that summarise SmartScreen and PnP events using the Defender for Endpoint tables.

Two plugins that use the CloudAppEvents table to provide insights about user activity and files detected by ATP.

IOC Query Builder and ASR Custom Plugins

3

Two custom plugins: 1. GPT - IOC query builder (just KQL for now, but scope to extend to other SIEM query languages). 2. KQL - Summary of ASR rules based...

Parser tools

1

x3 data parsing tools: - User Agent Parser - URL Parser - File Path Parser

MDTI Promptbooks

1

x2 plugins that utilise the Microsoft Threat Intelligence plugin - Domain Name Investigation - IP Address Investigation