copilot-operation-plugin-for-security - Universal offline-first cybersecurity plugin catal

项目说明

COPS — Copilot Operations Plugins for Security

<p align="center">
<img src="docs/assets/cops-logo.png" alt="COPS shield and copilot visor logo" width="260">
</p>

<p align="center">
<a href=" src=" alt="Documentation Site"></a>
<img src=" alt="Python 3.11+">
<a href="LICENSE"><img src=" alt="License"></a>
<img src=" alt="Offline First">
<a href="docs/CO.md"><img src=" alt="MITRE ATT&CK v18.0"></a>
<img src=" alt="Uni Portability">
</p>

Welcome to COPS (Copilot Operations Plugins for Security)! COPS is an open-source, uni catalog of defensi plugins, 18 specialist agent profiles, and deterministic offline tools.

Whether your team works in GitHub Copilot, Claude Code, or Codex / ChatGPT, COPS provides production-grade cybersecurity capabilities without ecosystem lock-in. E is designed offline-first: you can explore tools, run demos, and detection logic directly from your local terminal using standard Python—no cloud credentials, assistant installations, or li connections required.

📖 Visit the complete COPS Documentation Website for interacti, playbooks, and reference architectures.

---

Fi Quickstart

All you need is Python 3.11 or newer. These commands use only the Python standard library and make zero external network calls:

What these commands do for you

---

A Security Plugins (13 Packages)

Each package lives in its own self-contained directory under plugins/<category>/<plugin-id>/ and includes a complete practitioner playbook:

| Security Plugin | Category | Maturity | What it solves | Try it out |
| :--- | :--- | :---: | :--- | :--- |
| Security Logging Advisor | Logging & Telemetry | <span class="badge badge-stable">Stable</span> | Audits codebases for security logging gaps, flags sensitive data leaks, and prioritizes C. | python3 -m cops demo security-logging-advisor |
| Telemetry Proof Pack | Logging & Telemetry | <span class="badge badge-beta">Beta</span> | end-to-end telemetry routes and pipeline health from Cribl Stream to Splunk and Sentinel. | python3 -m cops check telemetry-proof-pack |
| SOC In Workbench | Detection & Hunting | <span class="badge badge-beta">Beta</span> | Guides alert triage using competing hypotheses, question ranking, and e dependency graphs. | python3 -m cops demo soc-in |
| Sentinel Hunt Workbench | Detection & Hunting | <span class="badge badge-beta">Beta</span> | Authors, adapts, and stress-tests 12 defensi Sentinel and Defender KQL threat hunts offline. | python3 -m cops demo sentinel-hunt-workbench |
| Attack Path Workbench | Detection & Hunting | <span class="badge badge-experimental">Experimental</span> | Traces multi-hop cloud lateral mo paths from local exports to crown jewels and finds choke points. | python3 -m cops demo attack-path-workbench |
| Detection Quality Workbench | Detection & Hunting | <span class="badge badge-beta">Beta</span> | detection syntax, regressions, and quality metrics across Microsoft Sentinel KQL and Splunk SPL. | python3 -m cops check detection-quality-workbench |
| Threat Intelligence Enrichment | Detection & Hunting | <span class="badge badge-experimental">Experimental</span> | Enriches network, host, and hash indicators with pro threat intelligence metadata. | python3 -m cops check threat-intelligence-enrichment |
| Entra Identity Workbench | Identity & Access | <span class="badge badge-beta">Beta</span> | E Entra ID role assignments, service principals, consent grants, and credential exposures. | python3 -m cops check entra-identity-workbench |
| Exposure Triage Workbench | Management | <span class="badge badge-beta">Beta</span> | Prioritizes triage by correlating ad CVEs, SBOM components, and call graph reachability. | python3 -m cops check exposure-triage-workbench |
| Patch Security Review | Management | <span class="badge badge-beta">Beta</span> | Analyzes code patches and pull request diffs for dangerous patterns, authorization flaws, and regression risks. | python3 -m cops check patch-security-review |
| Attack Surface Planner | Offensi | <span class="badge badge-experimental">Experimental</span> | Translates authorized rules of engagement into bounded, passi plans from local export manifests. | python3 -m cops demo attack-surface-planner |
| Foundry Agent Harness | Offensi | <span class="badge badge-beta">Beta</span> | E AI agent behavior, prompt injection resistance, and safety boundaries in a simulated sandbox. | python3 -m cops check foundry-agent-harness |
| Incident Response Sandbox | Incident Response | <span class="badge badge-beta">Beta</span> | Rehearses containment workflows, calculates blast radius, and generates cryptographic execution receipts. | python3 -m cops check incident-response-sandbox |

For in-depth guidance on choosing the right plugin for your operational scenario, see the When to Use Each Plugin Guide.

---

18 Specialist Cybersecurity Agent Profiles & Dynamic Routing

COPS centralizes 18 specialist cybersecurity agent profiles in agents/ across offensi, forensics, identity, and go disciplines. The deterministic zero-token router dynamically matches incoming tasks to the best specialist profile:

For high-risk operations (e.g. penetration testing, red team emulation, acti, or cloud pri escalation), COPS automatically activates Triad Orchestration (Primary Specialist + Domain Skeptic + E Auditor) with mandatory interacti authorization. Read the Specialist Agents Guide for architecture details.

---

MITRE ATT&CK & Attack Flow Co

COPS capability logic, queries, and in workflows are formally mapped to the MITRE ATT&CK Enterprise Matrix (pinned v18.0) and MITRE Attack Flow:

---

How Uni Portability Works

Different AI assistants expect different file structures, manifests, and skill formats. COPS removes that headache through automated, drift-free synchronization:

1. One Source of Truth: The central in in catalog/plugins.json defines all package metadata, , and categories.
2. Standardized Packages: Each plugin maintains its core Agent Plugins v1.0.0 manifest (plugin.json), host manifests (.claude-plugin/, .codex-plugin/), and reusable skills.
3. Automated Host Marketplaces: Running python3 -m cops generate automatically creates and synchronizes configuration files for:
- GitHub Copilot: .github/plugin/marketplace.json
- Claude Code: .claude-plugin/marketplace.json
- Codex / ChatGPT: .agents/plugins/marketplace.json
4. Guaranteed Consistency: Our test gates that host indexes ne out of sync with the catalog.

Learn more in the Portability Architecture and Repository Layout guides.

---

Contributor Setup

If you want to contribute new plugins, skills, or core features:

*(On Windows PowerShell, run .\.ven\Activate.ps1 to activate your en).*

Before creating new plugins or modifying contracts, please review:

---

E & Safety Principles

In security engineering, confidence comes from :

---

License & Attribution

Plugin execution cost analysis

Contributors can use plugin-run-cost to measure explicitly assigned COPS runs, estimate input scaling, and compare API, local-tool and employee costs. It runs locally with synthetic examples, preser charges, and distinguishes API-equi estimates from actual bills.

项目信息

开发语言：Python

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Universal offline-first cybersecurity plugin catalog & 18 specialist AI agent profiles for GitHub Copilot, Claude Code, and Codex. Offline demos, MITRE ATT&CK v18.0, and deterministic verification.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。