Edit

Share via

CIRCL Hash Lookup

  • Article

Important

Some information in this article relates to a prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide a systematic response facility to computer security threats and incidents. CIRCL Hash Lookup integration enables you to validate suspicious files in the form of hashes, either MD5, SHA-1, or SHA-256, in Copilot for Security. You can use this plugin to get information about a file and verify whether it's allowlisted or blocklisted by trusted security platforms.

Note

This article contains information about third-party plugins. This is provided to help complete integration scenarios. However, Microsoft does not provide troubleshooting support for third-party plugins. Contact the third-party vendor for support.

Know before you begin

You don't have to sign up for an account to use CIRCL Hash Lookup. You also don't need an API key. You'll need to take the following steps before using the plugin.

  1. Sign in to Microsoft Copilot for Security.

  2. Access Manage Plugins by selecting the Plugin button from the prompt bar.

  3. Verify that CIRCL Hash Lookup is turned on.

  4. Try one or more of the capabilities listed in the following table:

    Capability Example prompts
    lookupMD5HashCIRCL
    This endpoint allows you to lookup information on CIRCL about a specific MD5 hash

    Required input: hash    		 - lookup this MD5 hash using CIRCL

    - lookup information on this MD5 hash using CIRCL
    lookupSHA1HashCIRCL
    This endpoint allows you to lookup information on CIRCL about a specific SHA-1 hash

    Required input: hash    		 - lookup this SHA-1 hash using CIRCL

    - lookup information on this SHA-1 hash using CIRCL
    lookupSHA256HashCIRCL
    This endpoint allows you to lookup information on CIRCL about a specific SHA-256 hash

    Required input: hash    		 - lookup this SHA-256 hash using CIRCL

    - lookup information on this SHA-256 hash using CIRCL

    Alternate, you can type the name of a specific capability, like lookupMD5HashCIRCL in the prompt bar, instead of using one of the example prompts.

Troubleshoot the CIRCL Hash Lookup plugin

Errors occur

If you get errors, such as Couldn't complete your request, or An unknown error occurred, make sure the plugin is turned on. If the issue persists, sign out of Copilot for Security, and then sign back in.

Prompts aren't invoking the correct capabilities

If prompts are not invoking the correct capabilities, or prompts are invoking some other capability set, you might have custom plugins or other plugins that have similar functionality as the capability set you want to use. For example, if you're using multiple sources that provide hash information like CIRCL, there might be conflicts. To prioritize and target CIRCL, try disabling other custom plugins. Or, you can either use the product name CIRCL in your prompts, or type the name of a specific capability, like lookupMD5HashCIRCL instead.

Provide feedback

To provide feedback, contact CIRCL.

See also

Other plugins for Microsoft Copilot for Security

Manage plugins in Microsoft Copilot for Security

circl.lu