sentinel-xdr-alert-parity-validator
Azure/Azure-Sentinel/.github/skills/sentinel-xdr-alert-parity-validator/SKILL.md
Perform strict lab-only parity validation between a Microsoft Sentinel Analytic Rule and its migrated Defender XDR Custom Detection.
One search for your own team's files and the public ecosystem. See how real projects write their agent instructions, and bring the good ideas home.
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Azure/Azure-Sentinel/.github/skills/sentinel-xdr-alert-parity-validator/SKILL.md
Perform strict lab-only parity validation between a Microsoft Sentinel Analytic Rule and its migrated Defender XDR Custom Detection.
Azure/Azure-Sentinel/.github/skills/sentinel-xdr-dependency-helper/SKILL.md
Help authors review and fill XDR YAML workload and connector dependencies using exact-query Log Analytics lab metadata. Conversion remains offline.
Azure/Azure-Sentinel/.github/skills/sentinel-xdr-detection-validator/SKILL.md
Validate generated XDR Detection YAML structurally and validate source and converted KQL through official Microsoft Sentinel Triage MCP tools first, with direct API fallback.
Azure/Azure-Sentinel/.github/skills/sentinel-xdr-end-to-end-orchestrator/SKILL.md
Orchestrate resumable Sentinel-to-Defender-XDR authoring and optional qualification by following the canonical agent-neutral workflow.
Azure/Azure-Sentinel/.github/skills/sentinel-xdr-migration-orchestrator/SKILL.md
Orchestrate conversion of a Microsoft Sentinel solution into Defender XDR Custom Detection YAML by using repository utilities and available runtime providers.
Azure/Azure-Sentinel/.github/skills/sentinel-xdr-rule-converter/SKILL.md
Convert every Microsoft Sentinel analytic rule in a solution into a Defender XDR Custom Detection YAML under the solution's XDR Detections folder.
Azure/Azure-Sentinel/.github/skills/sentinel-xdr-solution-deployer/SKILL.md
Deploy and verify Sentinel Analytic Rules and Defender XDR Custom Detections disabled in an approved non-production environment.
Azure/Azure-Sentinel/.github/skills/sentinel-xdr-solution-packager/SKILL.md
Package a complete Microsoft Sentinel and Defender XDR solution through the V3.1 packaging implementation.
Azure/Azure-Sentinel/.github/skills/solution-release-notes-updater/SKILL.md
Update a Microsoft Sentinel solution's ReleaseNotes.md for an approved release. Use when asked to add, revise, or validate a solution release-notes entry without packaging the solution.
Azure/Azure-Sentinel/.github/skills/update-solution-analyzer/SKILL.md
MANDATORY guidelines for ANY edit to ANY file under Tools/Solutions Analyzer/ — including the mapper (map_solutions_connectors_tables.py), doc generator (generate_connector_docs.py), interactive docs (generate_interactive_docs.py), ASIM browser, collect_table_info, collect_asim_fields, upload_to_kusto, compare_runs, solution_analyzer_overrides.csv, filter_field_resolution.yaml, or any other script/config in that folder. Use when: editing/modifying/refactoring/fixing/renaming/tweaking ANY logic in those files, even one-line fixes such as renaming a classification, escaping a character, adjusting a regex, adding an override row, suppressing a false positive, or changing a constant. Covers: keeping script-docs in sync, README Version History changelog rules (required for feature/behavior changes; optional for small bug fixes), CSV output sync with upload_to_kusto.py, static/interactive index synchronization, and markdown/HTML entity page synchronization.
Azure/Azure-Sentinel/Tools/Microsoft-Sentinel-Classic-CLv1-Tables-Impact-Assessment/.github/copilot-instructions.md
These instructions apply to all Copilot interactions in this repository. They provide context about the project, coding conventions, and domain knowledge so that Copilot can give accurate, relevant assistance. PowerShell tool that discovers classic V1 custom log tables (CLv1) in a Microsoft Sentinel / Log Analytics workspace, assesses dependency impact across all content types, and maps tables to Content Hub solutions with connector classification. The HTTP Data Collector API retires September 14, 2026. All classic custom log tables must migrate…
No other project uses it yet
Azure/azure-sdk-for-net/AGENTS.md
This document provides guidelines for AI agents (e.g., GitHub Copilot, MCP-based assistants, LLM-based tools) working with the Azure SDK for .NET repository. It defines safe and effective patterns for agent interactions with this codebase, automation workflows, and development processes. The Azure SDK for .NET repository contains: - Data plane client Libraries: SDKs for interacting with Azure services at application runtime - Management plane Libraries: SDKs for provisioning and managing Azure resources - Code Generators: Tools that generate Azure Data Plane…
Azure/azure-sdk-for-net/.github/copilot-instructions.md
Note: For general AI agent guidelines and repository overview, see AGENTS.md at the repository root. This repo contains Azure SDKs for various Azure services and tools that generate them. Before committing changes to SDK packages under sdk/, always run the pre-commit validation checks described in the pre-commit-checks skill. These checks run dotnet format, regenerate public API listings, update snippets, and regenerate code as needed. They may produce additional file changes that must be included in the commit. Before inspecting or…
Azure/azure-sdk-for-net/.github/skills/agentic-workflows/SKILL.md
Route gh-aw design, creation, diagnosis, patching, active debugging, and upgrade requests to the right strategies.
Often used withagentic-workflow-designer
Azure/azure-sdk-for-net/.github/skills/analyze-ci-failures/SKILL.md
Analyze CI failures on Azure SDK for .NET pull requests and post a comment with how-to-fix instructions. Use when a PR has failing checks, CI is red, or someone asks for help fixing CI.
Azure/azure-sdk-for-net/.github/skills/auto-build-repair/SKILL.md
Repair custom-code build failures in generated Azure SDK pull requests with one bounded customized-update invocation. WHEN: an eligible release-planner Auto SDK PR labeled auto-sdk-build-fix needs repair, or requests mention auto build repair, custom-code build repair, or fixing the SDK PR build. Not for migrations, TypeSpec authoring, or API review.
Azure/azure-sdk-for-net/.github/skills/azsdk-common-apiview-feedback-resolution/SKILL.md
Analyze and resolve APIView review feedback on Azure SDK PRs. **UTILITY SKILL**. USE FOR: APIView comments, API review feedback, SDK API surface changes. DO NOT USE FOR: general code review, non-APIView feedback. INVOKES: azure-sdk-mcp:azsdk_apiview_get_comments, azure-sdk-mcp:azsdk_customized_code_update, azure-sdk-mcp:azsdk_typespec_delegate_apiview_feedback, azure-sdk-mcp:azsdk_run_typespec_validation, azure-sdk-mcp:azsdk_package_generate_code.
Azure/azure-sdk-for-net/.github/skills/azsdk-common-generate-sdk-locally/SKILL.md
Generate, build, and test Azure SDKs locally from TypeSpec with automatic customization. WHEN: "generate SDK locally", "build SDK", "run SDK tests", "run CI checks", "validate package", "run checks", "update changelog", "fix SDK build errors", "fix breaking changes", "resolve SDK generation errors", "customize TypeSpec", "rename SDK client", "rename SDK model", "hide operation from SDK", "fix analyzer errors", "resolve customization drift", "create subclient", "update metadata", "update version". DO NOT USE FOR: publishing to package registries, CI pipeline configuration, API design review. INVOKES: azsdk_verify_setup, azsdk_package_generate_code, azsdk_package_build_code, azsdk_package_run_check, azsdk_package_run_tests, azsdk_customized_code_update, azsdk_package_update_changelog_content, azsdk_package_update_metadata, azsdk_package_update_version.
Azure/azure-sdk-for-net/.github/skills/azsdk-common-pipeline-analysis/SKILL.md
Analyze Azure SDK CI/CD pipeline failures into a structured diagnosis, and define the required output format. Load this skill before calling azsdk_analyze_pipeline, which returns raw failure data that this skill interprets and formats. USE FOR: "pipeline failed", "build failure", "CI check failing", "tests failing in CI", "analyze pipeline", "debug SDK pipeline". DO NOT USE FOR: local build issues without pipeline context, API design review, SDK publishing, applying code fixes (instead use azsdk-common-pipeline-fixer). INVOKES: azure-sdk-mcp:azsdk_analyze_pipeline, azure-sdk-mcp:azsdk_get_pipeline_llm_artifacts, azure-sdk-mcp:azsdk_get_failed_test_run_data, azure-sdk-mcp:azsdk_get_failed_test_case_data, azure-sdk-mcp:azsdk_get_pr_checks, azure-sdk-mcp:azsdk_get_pipeline_status.
Azure/azure-sdk-for-net/.github/skills/azsdk-common-pipeline-fixer/SKILL.md
Automatically fix Azure SDK CI/CD pipeline failures by applying code changes and verifying locally. USE FOR: "fix pipeline failure", "fix CI", "fix failing tests", "auto-fix and commit the fix", "fix build error", "fix mypy/pylint/type-check/lint errors", "auto-fix pipeline", "resolve pipeline failure". DO NOT USE FOR: pipeline analysis (instead use azsdk-common-pipeline-analysis), API design review, SDK publishing. INVOKES: azure-sdk-mcp:azsdk_package_build_code, azure-sdk-mcp:azsdk_package_run_check, azure-sdk-mcp:azsdk_package_run_tests, azure-sdk-mcp:azsdk_verify_setup.
Plain text files in a repository that tell a coding agent how the project works: commands to run, conventions to follow and things to avoid. CLAUDE.md, AGENTS.md, cursor rules and skills are the common kinds.
CLAUDE.md is read by Claude Code. AGENTS.md is an open format that Codex, Cursor and other agents read. Many projects keep one and point the other at it.
A folder with a SKILL.md that describes one capability, such as filling PDFs or reviewing code. The agent loads it only when the task calls for it.
Your agents already can, over MCP, limited to the files you're allowed to read. Searching them from this page is coming.