Censys

This plugin allows Security Copilot users to enrich investigations using threat intelligence from the Censys Platform. Currently the following functionalities are supported:

• Generating and executing Censys queries using natural language
• Searching the Censys Global Index
• Aggregating search results by specific fields
• Retrieving detailed information about IP addresses
• Looking up certificate information by SHA256 hash
• Getting web property information by domain and port

Prerequisites

• Access to a Censys Platform account
• A Personal Access Token (PAT) from Censys
• Your Censys Organization ID

Know before you begin

Integration with Security Copilot works with a combination of a Personal Access Token (PAT) and Organization ID. You need to take the following steps before using the plugin.

Authentication Setup

1. Sign in to your Censys Account.

2. Navigate to the Personal Access Tokens tab and select Create New Token.

3. Give your token a descriptive name (for example, "Security Copilot Token") and select Create.

4. Locate your Organization ID from the Censys Platform URL (appears as ?org=ORG_ID).

5. Combine your PAT and Organization ID with a colon separator: PAT:ORG_ID

Plugin Configuration

1. When you're asked to set up authentication, enter the combined PAT and Organization ID in the following format:

PAT:ORG_ID

2. Select Save to complete setup.

Available Skills

The Censys Plugin for Microsoft Security Copilot exposes the following skills:

• Query Generation
  • Creating Censys queries from natural language
  • Converting user intent into CenQL syntax
• Global Index Search
  • Executing queries against the Censys database
  • Retrieving and formatting search results
• Data Aggregation
  • Aggregating results by specified fields
  • Generating statistical summaries
• Asset Information
  • IP address lookups
  • Certificate information retrieval
  • Web property analysis

With the Censys plugin for Microsoft Security Copilot, you can invoke interactions with Censys in the context of a natural conversation. Here's an example:

1. A user can ask about specific IP addresses or domains of interest
2. The user can then use follow-up prompts such as "What other assets are associated with this IP?"
3. The user can further investigate by asking for aggregated data about similar assets or certificates

Example Prompts

Microsoft Security Copilot maintains context between queries, allowing for natural conversation flows. For example, after looking up an IP address, you can ask follow-up questions about related certificates or web properties without needing to specify the IP again.

Troubleshoot the Censys plugin

Errors occur

If you encounter errors, such as Couldn't complete your request, or An unknown error occurred, check:

1. Ensure the plugin is turned on
2. Verify your PAT and Organization ID are correctly formatted
3. Check that your PAT hasn't expired
4. Confirm you have sufficient API credits in your Censys account
5. If issues persist, sign out of Security Copilot and sign back in

Prompts aren't invoking the correct capabilities

If prompts aren't invoking the correct capabilities, or prompts are invoking some other capability set:

• Ensure you're using supported prompt formats
• Try using direct skill invocation with "/"
• Check if other plugins might be intercepting similar queries

Provide feedback

To provide feedback, contact the Censys team.

See also

Other plugins for Microsoft Security Copilot

Manage plugins in Microsoft Security Copilot