Edit

Share via


SGNL

Important

Some information in this article relates to a prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

SGNL provides a dynamic access platform that provides a foundation for Zero Standing Privilege (ZSP) initiatives to protect against threats to user sessions and credentials. You can use the SGNL Access Intelligence plugin with Microsoft Security Copilot to understand and identify fine-grained access decisions and trends across your organization.

Note

This article contains information about third-party plugins. This is provided to help complete integration scenarios. However, Microsoft does not provide troubleshooting support for third-party plugins. Contact the third-party vendor for support.

Know before you begin

Integration with Security Copilot requires your SGNL tenant ID and ID token. Make sure your SGNL account has sufficient permissions to read the SGNL Access Decision Logs. You'll need to take the following steps before using the plugin.

  1. Sign in to Microsoft Security Copilot.

  2. Access Manage Plugins by selecting the Plugin button from the prompt bar.

  3. Next to SGNL, select Set up.

  4. Paste your SGNL tenant ID in the Username field, and your ID token in the password field. Then select Save.

Sample SGNL prompts

After the SGNL plugin is configured, you can use it to summarize logs and identify who accesses sensitive assets. The following table lists some capabilities and example prompts you can try:

Capability Example prompt
Summarize SGNL logs Summarize the logs from SGNL for today
Identify principals who accessed sensitive assets Which principals have accessed sensitive assets today
Identify who accessed a specific asset Which users have accessed <Asset>
Summarize a user's access for a specific time period Tell me about <user> access over the last 7 days

Troubleshoot the SGNL plugin

Errors occur

If you encounter errors occur, such as: Couldn't complete your request, or An unknown error occurred, make sure the plugin is turned on. If the issue persists, sign out of Security Copilot, and then sign back in.

Prompts aren't invoking the correct capabilities

If prompts aren't invoking the correct capabilities, or prompts are invoking some other capability set, you might have custom plugins or other plugins that have similar functionality as the capability set you want to use.

Provide feedback

To provide feedback, contact SGNL.

See also

Non-Microsoft plugins for Microsoft Security Copilot

Manage plugins in Microsoft Security Copilot