plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "legion-security",
  "version": "1.0.0",
  "description": "Read Legion Security workflow, session, and usage data.",
  "author": {
    "name": "Legion Security",
    "url": "https://legionsecurity.ai"
  },
  "homepage": "https://legionsecurity.ai",
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "Legion Security",
        "shortDescription": "Read Legion security data",
        "longDescription": "Connect your Legion Security account to search and review workflow sessions, browse workflows and use cases, view action usage, and search Legion Security documentation. The plugin is read-only and only returns data your Legion role can already see. Each user is routed to their organization's region automatically.",
        "developerName": "Legion Security",
        "category": "Security",
        "capabilities": [
          "Read"
        ],
        "websiteURL": "https://legionsecurity.ai",
        "supportURL": "https://www.legionsecurity.ai/contact",
        "termsOfServiceURL": "https://www.legionsecurity.ai/privacy",
        "privacyPolicyURL": "https://www.legionsecurity.ai/privacy",
        "logo": "./assets/logo.svg",
        "composerIcon": "./assets/logo.svg",
        "defaultPrompt": [
          "Show me the 10 most recent Legion workflow sessions.",
          "Which Legion sessions have failed, and at which step?",
          "How many Legion actions did we use per month this year?"
        ]
      },
      "review": {
        "test_cases": {
          "positive": [
            {
              "description": "Lists the most recent workflow sessions",
              "prompt": "Show me the 10 most recent Legion workflow sessions.",
              "tools_triggered": "search_sessions",
              "expected_behavior": "Lists the 10 newest sessions with workflow, use case, status, and start time (e.g. Unfamiliar Sign-In, Certificate Expiry, Malware (MDE))."
            },
            {
              "description": "Finds failed sessions and the failing step",
              "prompt": "Which Legion sessions have failed, and at which step?",
              "tools_triggered": "search_sessions, get_session",
              "expected_behavior": "Returns the failed DLP sessions and identifies the \"Extract information\" Excel Online step, which failed because no credential was selected."
            },
            {
              "description": "Summarizes the latest run of a workflow",
              "prompt": "Summarize the most recent run of the \"Unfamiliar Sign-In\" workflow and its outcome.",
              "tools_triggered": "search_sessions, list_workflows, get_session",
              "expected_behavior": "Summarizes the investigation (suspicious IP, Defender incident, endpoint activity) and states the recommended outcome, True Positive, with the analyst decision pending."
            },
            {
              "description": "Lists workflows grouped by use case",
              "prompt": "What workflows do we have in Legion, grouped by use case?",
              "tools_triggered": "list_usecases, list_workflows",
              "expected_behavior": "Returns 6 workflows across 5 use cases: Account Takeover (Unfamiliar Sign-In), Malware (Malware (MDE)), DLP and Insider Risk (DLP), Security Engineering (Certificate Expiry), Toolbox (IP Investigation, URL Investigation)."
            },
            {
              "description": "Reports monthly action usage",
              "prompt": "How many Legion actions did we use per month in 2026?",
              "tools_triggered": "get_usage",
              "expected_behavior": "Returns monthly action counts for 2026 split into guided and autonomous, with usage starting in July 2026."
            }
          ],
          "negative": [
            {
              "description": "Asks to run a workflow; the plugin is read-only, so nothing is started",
              "prompt": "Run the \"Unfamiliar Sign-In\" workflow on this email."
            },
            {
              "description": "Asks for stored credentials; the plugin does not expose secrets",
              "prompt": "Show me the passwords or API keys Legion uses for the Excel Online integration."
            },
            {
              "description": "Unrelated request; no Legion tools should be called",
              "prompt": "What's the weather in Tel Aviv tomorrow?"
            }
          ]
        }
      },
      "publication": {
        "release_notes": "Initial release of Legion Security for ChatGPT.\n\nConnect your Legion Security account to query your organization's security automation data in plain language:\n- Investigate workflow sessions, including each step, its findings and the verdict\n- Browse workflows and use cases\n- Track monthly action usage against your plan\n- Search Legion Security documentation\n\nThe plugin is read-only. You sign in with your Legion Security account, and results are limited to your organization and your role's permissions. Organization admins can disable access at any time."
      },
      "apps": "./.app.json"
    }
  }
}