Courier Planner Tab

Queue Burp evidence and use it in Guard Planner conversations

Overview

The Planner tab provides access to Guard's AI assistant, Marcus Aurelius, from inside Burp Suite. It lets you select Burp request and response evidence and include it in the active conversation. Evidence is placed in a queue first, then you choose which request to attach to the next message.

Courier must be connected to Guard before it can send Planner messages. Available AI features depend on the Guard settings, role, and tenant associated with the supplied credentials.

Add Burp Evidence to the Queue

  1. Select one or more HTTP messages in a Burp tool that provides request and response context.

  2. Open the Burp context menu.

  3. Choose Send to Courier Planner.

  4. Open Courier → Planner.

Each selected HTTP message is added to the request queue. Adding evidence to the queue does not immediately send it to Guard or attach it to a conversation.

Use the Request Queue

The request queue summarizes each item by time, method, URL, source, response status, header count, and body size.

To work with the queue:

  • Click a row to select it for attachment.

  • Click the selected row again to clear the selection.

  • Click Clear selection to keep the queue while removing the current attachment selection.

  • Right-click a row and choose Remove request to remove that item.

  • Click Clear queue to remove all queued requests.

Courier allows one selected request at a time. The attachment area above the message field shows which request will be considered for the next message.

Preview Request and Response Evidence

Selecting a queue item opens its request and response in Evidence preview.

Choose a display mode:

  • Pretty — Readable, wrapped HTTP content

  • Raw — Unwrapped HTTP content

  • Hex — Hexadecimal representation for binary or low-level inspection

Use the arrows beside Request or Response to collapse or expand either section.

What Marcus and Aurelius Can Do

The Planner brings the same Guard AI modes used in the Guard platform into Burp, with the option to include the selected HTTP evidence as conversation context.

Query with the Guard AI Assistant

In Query mode, the Guard AI Assistant can retrieve and present factual information from Guard, including:

  • Asset inventories and counts

  • Risks, findings, and severity information

  • Technologies associated with assets

  • Ports, services, and relationships between entities

  • Cloud resources

  • Running and recent job information

  • Formatted reports and executive summaries based on Guard data

Query mode is read-only. It does not execute scans or modify Guard data.

Operate with Aurelius

When Agent mode is enabled, Aurelius can assess an objective, propose a plan, request confirmation when required, and coordinate Guard operations. Depending on the enabled capabilities, Aurelius can:

  • Query and analyze attack-surface data

  • Identify relevant security capabilities and execute approved scans

  • Build and validate attack graphs with MITRE ATT&CK context

  • Add and link web application information in Guard

  • Delegate reconnaissance and cloud discovery to specialist agents

  • Delegate service fingerprinting, secret scanning, and CI/CD security analysis

  • Coordinate approved credential testing and LLM security testing

  • Validate findings, research CVEs, and support remediation retesting

Active scans and offensive operations require operator confirmation and remain subject to Guard scope, role, and tenant controls.

For complete details, see:

Choose Query or Agent Mode

The conversation header provides two modes:

  • Query — Ask Guard questions about available data and the selected evidence.

  • Agent — Request operational agent workflows when Agent Mode is enabled for the Guard account and role.

For the Guard behavior and access requirements of each mode, see Query Mode and Agent Mode.

Send a Message with Evidence

  1. Open or create the intended chat tab.

  2. Select the queued request you want to use.

  3. Confirm the attachment shown above the message field.

  4. Select Query or Agent.

  5. Enter the message.

  6. Click Send or press Enter.

A selected request that has not already been sent in that chat is attached to the next successful message. The queue selection remains visible, but Courier does not attach the same request repeatedly to later messages in that chat.

If sending fails, Courier releases the reserved evidence so it can be attached on a later attempt.

Manage Conversations

  • Click New chat to create another conversation tab.

  • Click Clear chat to clear the visible messages in the active chat.

  • Switch chat tabs to return to another conversation.

Conversation and evidence-delivery state is isolated by chat. A request used in one chat can still be selected for a different chat.

Sensitive Evidence

Planner evidence can contain complete HTTP headers, cookies, authorization values, request bodies, response bodies, and personal data. Before sending a message:

  • Confirm that the selected request belongs to the authorized target.

  • Review both request and response content.

  • Avoid attaching evidence that is unrelated to the question.

  • Use dedicated testing credentials where possible.