Edit

Share via


CIRCL Hash Lookup

Important

Some information in this article relates to a prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide a systematic response facility to computer security threats and incidents. CIRCL Hash Lookup integration enables you to validate suspicious files in the form of hashes, either MD5, SHA-1, or SHA-256, in Security Copilot. You can use this plugin to get information about a file and verify whether it's allowlisted or blocklisted by trusted security platforms.

Note

This article contains information about third-party plugins. This is provided to help complete integration scenarios. However, Microsoft does not provide troubleshooting support for third-party plugins. Contact the third-party vendor for support.

Know before you begin

You don't have to sign up for an account to use CIRCL Hash Lookup. You also don't need an API key. You'll need to take the following steps before using the plugin.

  1. Sign in to Microsoft Security Copilot.

  2. Access Manage Plugins by selecting the Plugin button from the prompt bar.

  3. Verify that CIRCL Hash Lookup is turned on.

Sample CIRCL Hash Lookup prompts

Try one or more of the capabilities listed in the following table:

Capability Example prompts
lookupMD5HashCIRCL
This endpoint allows you to lookup information on CIRCL about a specific MD5 hash

Required input: hash
- lookup this MD5 hash using CIRCL

- lookup information on this MD5 hash using CIRCL
lookupSHA1HashCIRCL
This endpoint allows you to lookup information on CIRCL about a specific SHA-1 hash

Required input: hash
- lookup this SHA-1 hash using CIRCL

- lookup information on this SHA-1 hash using CIRCL
lookupSHA256HashCIRCL
This endpoint allows you to lookup information on CIRCL about a specific SHA-256 hash

Required input: hash
- lookup this SHA-256 hash using CIRCL

- lookup information on this SHA-256 hash using CIRCL

Alternatively, you can type the name of a specific capability, like lookupMD5HashCIRCL in the prompt bar, instead of using one of the example prompts.

Troubleshoot the CIRCL Hash Lookup plugin

Errors occur

If you get errors, such as Couldn't complete your request, or An unknown error occurred, make sure the plugin is turned on. If the issue persists, sign out of Security Copilot, and then sign back in.

Prompts aren't invoking the correct capabilities

If prompts are not invoking the correct capabilities, or prompts are invoking some other capability set, you might have custom plugins or other plugins that have similar functionality as the capability set you want to use. For example, if you're using multiple sources that provide hash information like CIRCL, there might be conflicts. You can either use the product name CIRCL in your prompts, or type the name of a specific capability, like lookupMD5HashCIRCL instead.

Provide feedback

To provide feedback, contact CIRCL.

See also

Non-Microsoft plugins for Microsoft Security Copilot

Manage plugins in Microsoft Security Copilot

circl.lu