Add dual-signal containment gate community plugin

[Ahmed Hassan (AAH20)]

Summary

Adds a Community Based Plugin so Microsoft Security Copilot does not treat SnortML / GID 411 / EVE-high as a classic IDS signature true positive and recommend ungated contain.

Hard rule: ML confidence ≠ signature true positive.

Folder: Plugins/Community Based Plugins/DualSignalContainmentGate/

Skills

Skill	Format	Behavior
Classify dual-signal disposition	GPT	Returns ml_only / signature / corroborated / unknown. Must not recommend block IP / isolate on ml_only or unknown.
List SnortML ML-only events	KQL	CommonSecurityLog Cisco Firepower/FTD matching GID 411 / SnortML
List signature-high events	KQL	Classic high-priority classifications excluding GID 411

Unknown and ML-only fail closed (escalate / HITL). Signature and corroborated may recommend gated HITL contain only — never ungated BlockIP/SOAR block ip.

GID 411 plus a leftover classification string is still ML-only.

Why this is contribution-first

Agents now sit in front of Sentinel incidents. Dual-signal analytics (#14925) and BlockIP playbooks (#14926) are not enough if Copilot still tells the analyst to contain on ML-only. This plugin is the agentic Gate/Prove sibling of those PRs and of Splunk SOAR dual_signal_containment_gate.

Compounds

• Sentinel analytics: Add dual-signal Firepower analytic rules and Gate/Prove BlockIP (SnortML != signature TP) Azure-Sentinel#14925
• Sentinel BlockIP Gate/Prove: Deny auto BlockIP on ML-only Firepower incidents (Gate/Prove) Azure-Sentinel#14926
• Splunk SOAR: Add dual_signal_containment_gate custom function phantomcyber/playbooks#239
• ESCU: feat: SnortML GID411 and signature+EVE dual-signal CSF detections splunk/security_content#4221
• EvidenceForge: feat: labeled dual-signal SnortML+signature and Splunk-notable triage corpus Cisco-Talos/EvidenceForge#389

Optional production Gate/Prove consumer (paid Continuous Trust, not unpaid R&D): https://github.com/AAH20/aegis-decision-fabric · https://a2zsoc.com/consultation

Test plan

• YAML parses; no tab characters; DisplayName ≤ 40 characters
• Upload plugin in Security Copilot; GPT skill classifies a GID 411 title as ml_only and does not recommend contain
• Same skill on attempted-admin / non-411 as signature with gated HITL only
• Empty text → unknown / fail closed
• KQL skills against a Firepower CEF workspace (optional; GPT skill works without it)
• CLA signed if the bot asks (personal CLA already agreed on Azure-Sentinel PRs)

Made with Cursor