solution-release-notes-updater
Skill6.2k starsChanged 16 days agoMITView on GitHub
Update a Microsoft Sentinel solution's ReleaseNotes.md for an approved release. Use when asked to add, revise, or validate a solution release-notes entry without packaging the solution.
We split this skill into the rules it gives an agent
5 rules. About 0 are common, 4 are distinctive, and 1 is very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈4
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 8
Update only Solutions/<SolutionName>/ReleaseNotes.md for the approved solution release.
- Distinctive: line 18
Ask the user for any missing or ambiguous solution name, change summary, release version/bump, or date before editing.
- Distinctive: line 26
Write one concise, truthful entry (normally 1–2 sentences) that names the affected solution content and describes the actual change.
- Distinctive: line 39
Keep the edit focused. If pre-existing historical rows violate a rule, do not silently rewrite history.
- Distinctive: line 45
Do not create a PR, commit, push, deploy, or contact Azure unless separately requested and authorized.
≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Update Solution Release Notes
Update only Solutions/<SolutionName>/ReleaseNotes.md for the approved solution release. Follow .github/instructions/releasenotes.instructions.md as the source of truth for file path, table format, ordering, and dates. Read .github/instructions/packaging.instructions.md when the request overlaps packaging or version bumping; do not treat this skill as permission to package.
Inputs
Identify the exact solution folder and establish:
- The actual changes being released, from the user's description and, when useful, the solution's diff against the intended target branch.
- The approved solution-level release version and whether an approved packaging/version-bump step has already selected or applied it.
- The release date to record.
Ask the user for any missing or ambiguous solution name, change summary, release version/bump, or date before editing. Never invent a feature, date, release, or version. Do not assume the current date is the release date.
Workflow
- Read the applicable release-notes and packaging instructions. Inspect the exact solution's
ReleaseNotes.md, if present, and itsData/Solution_*.jsonversion. If a package was already generated for this release, also inspectPackage/mainTemplate.json→variables._solutionVersion. Treat an existing approved package version as authoritative for that release; do not bump it again. - Distinguish the solution's release version from versions on individual analytic rules, workbooks, parsers, or XDR detections. A content item's version is not the solution release version. Do not edit solution metadata or package files as part of a notes-only request.
- Check both staged and unstaged changes to the release-notes file. If the approved version already has an uncommitted row for this same release, update that row rather than adding a duplicate. If the version already exists in committed history, do not duplicate or rewrite it; stop and clarify whether the user intended a correction to that historical entry. If a different uncommitted top entry appears to represent another release, preserve it and ask before deciding where or how to record this release.
- For a new release, require an explicitly approved solution-level version. Confirm it is valid
X.Y.Zand newer than the current release entry. Apply the approved patch/minor/major increment only if it has not already been applied; never independently increment a version already advanced by packaging. If the version conflicts with the solution data or generated package, stop and report the mismatch instead of reconciling it silently. Write one concise, truthful entry (normally 1–2 sentences) that names the affected solution content and describes the actual change. Follow the existing table's row style. For a new file, use exactly this header and a Markdown separator:
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |---|---|---|Insert a new release immediately below the header/separator, keeping all existing history intact. Use the confirmed release date in
DD-MM-YYYYformat. Do not add empty rows or fabricate intermediate releases to fill apparent gaps in historical version numbers.- Validate the resulting table against the release-notes instructions:
- Exact header names and order; exactly three columns in the header, separator, and every data row.
- Each version is three-part semantic
X.Y.Z, unique, and in descending numeric order. - Each date is a real date formatted
DD-MM-YYYY. - Each change-history cell is nonempty and accurately reflects the approved changes.
- Keep the edit focused. If pre-existing historical rows violate a rule, do not silently rewrite history; report the existing issue separately. Do not change any solution content,
Data/,Package/, shared instructions, skills, or tooling while performing this notes-only task.
Boundaries and result
- This workflow edits only the requested solution's
ReleaseNotes.md. - Do not run the V3/V3.1/V4 packaging or build-and-validate flow merely to edit notes; those flows can change versions and generated package files. If the user asks to package or validate, switch to the repository's applicable packaging workflow and obtain the required version-bump approval first.
- Do not create a PR, commit, push, deploy, or contact Azure unless separately requested and authorized.
- Report the exact file changed, the version/date and entry added or revised, validation results, and any unresolved ambiguity or pre-existing table violations. If no safe entry can be made, leave the file untouched and explain what information is needed.
Trending
More talk lately.about the whole repository
Who's talking about Azure/Azure-Sentinel
- @github-trending.bsky.social“📦 Azure / Azure-Sentinel ⭐ 4,774 (+3) 🗒 Python Cloud-native SIEM for intelligent security analytics for …”Bluesky · Feb 12, 2025 · 2 likes
- pulumi/pulumi-cloud-requests“Logs automated export into Azure Storage Account and/or Log Analytics Workspace”GitHub · Aug 9, 2024 · 2 reactions
- octocat/Spoon-Knife“**Describe the bug**”GitHub · Jun 11, 2022 · 2 reactions
- redaliscbe/Azure-Sentinel“Feature 1”GitHub · Jul 8, 2026 · 1 reactions
- Stack Overflow“How do I search through the in Sentinel Workbooks stored queries?”Stack Overflow · Aug 12, 2024 · 1 votes
The biggest 5 of 57 mentions linking to the repository that our crawl found. Each line is their own headline.
See all 57
Talked about on GitHub, Stack Overflow and Bluesky (57 times).
On GitHub · 43
- Aug 9, 2024Logs automated export into Azure Storage Account and/or Log Analytics Workspace — pulumi/pulumi-cloud-requests2 reactions · 1 comment
- Jun 11, 2022**Describe the bug** — octocat/Spoon-Knife2 reactions
- Jul 8, 2026Feature 1 — redaliscbe/Azure-Sentinel1 reaction
- Dec 3, 2020Updat the Entity eum to include all the new types — wortell/AZSentinel1 reaction
- Oct 29, 2026Daily catalog: Iwatobi, SCuBA, AI scanning, and GCP detections — amcamillo/Cybersecurity_Tools0 reactions
38 more on GitHub
- Oct 15, 2026Support reviewed workbook updates with clean public artifacts and local audit evidence — oferInbar/Azure-Sentinel0 reactions
- Sep 28, 2026Mxdr 5375 v1 sentinel ccf multitenant — V1ManagedServices/Azure-Sentinel0 reactions
- Sep 22, 2026Main to master — idoshabi07/Azure-Sentinel0 reactions
- Sep 22, 2026Main — idoshabi07/Azure-Sentinel0 reactions
- Sep 15, 2026Release/3.75.0 — ccx-mss/Azure-Sentinel0 reactions
- Sep 14, 2026Release/3.75.0 — ccx-mss/Azure-Sentinel0 reactions · 1 comment
- Sep 9, 2026Create connector-builder-agent configuration — fuqing04/Azure-Sentinel0 reactions
- Aug 16, 2026Add dual-signal containment gate community plugin — Azure/Security-Copilot0 reactions
- Aug 16, 2026Add dual_signal_containment_gate custom function — phantomcyber/playbooks0 reactions
- Aug 10, 2026Semperis Lightning 4.1.0: merge CCF into existing offer (Function App + CCF) — MitchellGulledge3/Azure-Sentinel0 reactions · 5 comments
- Aug 10, 2026RFPD-77178: log ingestion api (v3.0) — recordedfuture/Azure-Sentinel0 reactions
- Jun 4, 2026Change api — adutt-commvault/Azure-Sentinel0 reactions
- May 21, 2026Update README with contribution guidelines and resources — vikorium/Azure-Sentinel0 reactions
- May 18, 2026Add weekly Azure Sentinel connector report workflow — fuqing04/sentinel-agent-runner0 reactions
- Mar 17, 2026Feat sar 46819 — sonraisecurity/Azure-Sentinel0 reactions
- Feb 27, 2026Update requirements.txt — daneshelias01/Azure-Sentinel0 reactions
- Jan 20, 2026test — BC-47/Azure-Sentinel0 reactions
- Jan 16, 2026Add new entry to ExclusionListForASimTests.csv — v-sabiraj/Azure-Sentinel0 reactions
- Mar 13, 2025Create Cholitas — GravityFallsInc/GravityFalls_Sentinel0 reactions
- Sep 10, 2024Patch-1 — mpmisha/Azure-Sentinel0 reactions
- Jul 11, 2024 - added metadata tags to incident description — synack/Azure-Sentinel0 reactions
- Jan 12, 2024Added local changes for test — SmitR01/Azure-Sentinel0 reactions
- Nov 9, 2023Create dsdsadasda — aviatam/Azure-Sentinel0 reactions · 1 comment
- Aug 24, 2023Praveenthepro patch 1 1 — praveenthepro/Azure-Sentinel0 reactions
- Jul 31, 2023seraphic security connector — LihiAtzmoni1/Azure-Sentinel0 reactions · 1 comment
- Jun 1, 2023Automation test — cohesity/Azure-Sentinel0 reactions
- May 4, 2023Just a demo branch to show right structure of the installation and co… — cohesity/Azure-Sentinel0 reactions
- Dec 6, 2022Cmmc2.0 — cwling75/AzureSentinel0 reactions
- Dec 2, 2022Just initialize this new branch for Cohesity internal collaboration/r… — cohesity/Azure-Sentinel0 reactions · 4 comments
- Aug 5, 2022Create intrigus-lgtm.txt — intrigus-lgtm/Azure-Sentinel0 reactions
- Jun 7, 2022Yaronfr/log4j 1 — qusaiismail/Sentinel0 reactions
- May 30, 2022test new script — sivanguetta/Azure-Sentinel0 reactions · 1 comment
- May 30, 2022test — sivanguetta/Azure-Sentinel0 reactions · 1 comment
- May 26, 2022Run ASIM testers on 'eco-connector-test' workspace — sivanguetta/Azure-Sentinel0 reactions · 1 comment
- May 19, 2022Run ASIM testers on 'eco-connector-test' workspace — sivanguetta/Azure-Sentinel0 reactions · 1 comment
- May 2, 2022[Asim] test kqlFuncYaml2Arm on ASimProcessEvent folder — sivanguetta/Azure-Sentinel0 reactions · 1 comment
- Apr 26, 2022Test GitHub action that generates ARM templates from KQL — sivanguetta/Azure-Sentinel0 reactions
- Feb 14, 2022Google Workspace connector: Don't use pickle — r4vi/Azure-Sentinel0 reactions
On Stack Overflow · 13
- Aug 12, 2024How do I search through the in Sentinel Workbooks stored queries?1 vote
- Apr 3, 2019Azure log analytics: monitoring successful sign-ins following repeated sign-in failures1 vote
- Sep 29, 2024KQL for exfiltration of files/data ...almost there but slightly wrong0 votes · 1 answer
- Aug 8, 2024How do I search through the in Sentinel Workbooks stored queries?0 votes
- May 1, 2024Trying to set Azure Activity Log from Tenant Root(all subscriptions) getting Resource Provider Error0 votes · 1 answer
8 more on Stack Overflow
- Apr 11, 2024Azure Sentinel Incident Trigger in Logic Apps Automation Delay0 votes
- Nov 17, 2023Need Assistance with collecting O365 Audit Logs with function app and directing them to Event Hub0 votes · 1 answer
- Oct 21, 2022Azure Sentinel Sample data CSV0 votes · 1 answer
- Oct 12, 2022AZURE sentinel query to log off Azure remote session for user0 votes
- Feb 4, 2022Integration issues with Microsoft Sentinel and ServiceNow and Get Etag0 votes
- Dec 13, 2021How to detect when a security incident occurs0 votes
- Jul 1, 2021Download multiple file from GitHub public repos without git0 votes
- Feb 13, 2020Creating a Pull Request in Azure sentinel Repository0 votes · 1 answer
On Bluesky · 1
- Feb 12, 2025📦 Azure / Azure-Sentinel ⭐ 4,774 (+3) 🗒 Python Cloud-native SIEM for intelligent security analytics for your entire enterprise. — @github-trending.bsky.social2 likes and reposts
In this repository30 other files it gives its agents.
- AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- .github/copilot-instructions.mdCopilot instructions
- Tools/Microsoft-Sentinel-Classic-CLv1-Tables-Impact-Assessment/.github/copilot-instructions.mdCopilot instructions
- .cursor/rules/sentinel-xdr-migration.mdcCursor rule
- sentinel-xdr-migrationSkill
- asim-parser-create-parameter-parserSkill
- asim-parser-create-parserSkill
- asim-parser-creator-orchestratorSkill
- asim-parser-filter-validatorSkill
- asim-parser-github-pr-packagerSkill
- asim-parser-la-deployerSkill
- asim-parser-pr-reviewerSkill
- asim-parser-user-prompterSkill
- asim-parser-validatorSkill
- az-cli-command-runnerSkill
- azure-monitor-logs-ingestionSkill
- log-analytics-workspace-queryerSkill
- run-solution-analyzerSkill
- sentinel-solution-mock-data-generationSkill
- sentinel-solution-optional-testingSkill
- sentinel-xdr-alert-parity-validatorSkill
- sentinel-xdr-dependency-helperSkill
- sentinel-xdr-detection-validatorSkill
- sentinel-xdr-end-to-end-orchestratorSkill
- sentinel-xdr-migration-orchestratorSkill
- sentinel-xdr-rule-converterSkill
- sentinel-xdr-solution-deployerSkill
- sentinel-xdr-solution-packagerSkill
- update-solution-analyzerSkill
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

