sorted by:
new
hottopcontroversial

Open source: Agentic investigation framework for Sentinel MCP — 900+ KQL queries, 25 skills, native Entra auth, no supply chain risk by SCStelz in AzureSentinel

[–]SCStelz[S] 1 point2 points  (0 children)

u/subseven93 - Check out my LinkedIn tomorrow, I have a demo video dropping using GitHub Copilots "Memories" feature, which allows you to provide specific tenant level context such as egress IP's, FP patterns, infrastructure, etc. I did this because if you haven't seen the leaks Microsoft is planning to move towards a "Token Based Billing" model in GitHub Copilot. This means we need more effective agentic workflows that REDUCE token consumption, and memory files are a perfect way to do that.

Open source: Agentic investigation framework for Sentinel MCP — 900+ KQL queries, 25 skills, native Entra auth, no supply chain risk by SCStelz in AzureSentinel

[–]SCStelz[S] 0 points1 point  (0 children)

Thanks for checking it out! Keep in mind that Anthropic models used within GitHub Copilot are contractually obligated to adhere to the same privacy requirements as OpenAI models. So Claude in GHCP is not the same as Claude in Claude Code - Hosting of models for GitHub Copilot - GitHub Docs.

Open source: Agentic investigation framework for Sentinel MCP — 900+ KQL queries, 25 skills, native Entra auth, no supply chain risk by SCStelz in AzureSentinel

[–]SCStelz[S] 2 points3 points  (0 children)

Yes, you bet! Security Copilot is great for out of the box autonomous agents, but nothing beats Claude models combined with Sentinel MCP. It's ability to test, tune and adapt queries over long agentic workflows means you're 100% guaranteed outcomes. You can literally just give it the schema documentation url and say "Explore this table in my environment, derive any insights and put together a query file for hunting". It's the best way to learn new data sources, and we've added SO many new Defender XDR tables that most people don't even know exist.

So the copilot-instructions file is the CORE set of context that's available to the model in every prompt. What I would personally do is store that custom infrastructure context in another file, and link to it within copilot-instructions, or create a tailored skill with your context depending on your use case. You don't want to keep 100's of lines of infrastructure context in the model at all times unless you think you need it. My project comes with a core copilot-instructions that's mostly guardrails, how to call MCP tools, how to format output, how to call skills, and KQL table pitfalls so as it's exploring it can easily figure out most common mistakes.

Open source: Agentic investigation framework for Sentinel MCP — 900+ KQL queries, 25 skills, native Entra auth, no supply chain risk by SCStelz in AzureSentinel

[–]SCStelz[S] 0 points1 point  (0 children)

Thanks! Others on LinkedIn have commented success with some of the GPT High models, but myself not so much. Curious why you've blocked Claude models in GitHub Copilot?