Events
Take the Microsoft Learn Challenge
Nov 19, 11 PM - Jan 10, 11 PM
Ignite Edition - Build skills in Microsoft Security Copilot and earn a digital badge by January 10!
Register nowThis browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Important
Some information in this article relates to a prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide a systematic response facility to computer security threats and incidents. CIRCL Hash Lookup integration enables you to validate suspicious files in the form of hashes, either MD5, SHA-1, or SHA-256, in Security Copilot. You can use this plugin to get information about a file and verify whether it's allowlisted or blocklisted by trusted security platforms.
Note
This article contains information about third-party plugins. This is provided to help complete integration scenarios. However, Microsoft does not provide troubleshooting support for third-party plugins. Contact the third-party vendor for support.
You don't have to sign up for an account to use CIRCL Hash Lookup. You also don't need an API key. You'll need to take the following steps before using the plugin.
Sign in to Microsoft Security Copilot.
Access Manage Plugins by selecting the Plugin button from the prompt bar.
Verify that CIRCL Hash Lookup is turned on.
Try one or more of the capabilities listed in the following table:
Capability | Example prompts |
---|---|
lookupMD5HashCIRCL This endpoint allows you to lookup information on CIRCL about a specific MD5 hash Required input: hash |
- lookup this MD5 hash using CIRCL - lookup information on this MD5 hash using CIRCL |
lookupSHA1HashCIRCL This endpoint allows you to lookup information on CIRCL about a specific SHA-1 hash Required input: hash |
- lookup this SHA-1 hash using CIRCL - lookup information on this SHA-1 hash using CIRCL |
lookupSHA256HashCIRCL This endpoint allows you to lookup information on CIRCL about a specific SHA-256 hash Required input: hash |
- lookup this SHA-256 hash using CIRCL - lookup information on this SHA-256 hash using CIRCL Alternatively, you can type the name of a specific capability, like lookupMD5HashCIRCL in the prompt bar, instead of using one of the example prompts. |
If you get errors, such as Couldn't complete your request, or An unknown error occurred, make sure the plugin is turned on. If the issue persists, sign out of Security Copilot, and then sign back in.
If prompts are not invoking the correct capabilities, or prompts are invoking some other capability set, you might have custom plugins or other plugins that have similar functionality as the capability set you want to use. For example, if you're using multiple sources that provide hash information like CIRCL, there might be conflicts. You can either use the product name CIRCL
in your prompts, or type the name of a specific capability, like lookupMD5HashCIRCL
instead.
To provide feedback, contact CIRCL.
Non-Microsoft plugins for Microsoft Security Copilot
Events
Take the Microsoft Learn Challenge
Nov 19, 11 PM - Jan 10, 11 PM
Ignite Edition - Build skills in Microsoft Security Copilot and earn a digital badge by January 10!
Register now