avd-alert-kql-validation

Create and review KQL for the FederalAVD AVD Alerts add-on. Use when adding or changing scheduled query alerts, comparing alert logic with Microsoft AVD Insights workbooks, investigating query failures, or documenting intentional workbook deviations.

Aller à l'installation

Dépôt: Azure/FederalAVD
Dernière activité de la source: 18 août 2026 à 18:24
Langue détectée de SKILL.md: anglais
Étoiles: 17
Forks: 19

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/Azure/FederalAVD --skill avd-alert-kql-validation

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Explorateur de fichiers

3 fichiers

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

federalavd-bicep-maintenance

Modify and validate FederalAVD Bicep templates, generated ARM JSON, parameters, and uiFormDefinition files. Use when changing deployment resources, adding parameters or outputs, synchronizing Bicep with JSON, publishing Template Specs, or debugging portal form behavior.

2026-08-20

federalavd-air-gapped-readiness

Review FederalAVD deployments and image artifacts for Azure Government Secret or Top Secret air-gapped readiness. Use when auditing downloads.json, finding public network dependencies, preparing transfer inventories, validating pre-staged files, or checking that image builds and host pools avoid internet runtime downloads.

2026-08-18

federalavd-artifact-authoring

Create, update, and validate FederalAVD image artifacts and software download definitions. Use when adding customer-example artifacts, editing downloads.json, packaging installers, documenting download sources, or preparing artifacts for connected or air-gapped image builds.

2026-08-18

Tout voir dans ce dépôt

AVD Alert KQL Validation

Use this workflow for log-based alerts under deployments/add-ons/avdAlerts/.

Procedure

Read deployments/add-ons/avdAlerts/README.md, especially Query Design and Validation, and locate the corresponding operator response in ALERT-RESPONSE.md.

Identify the authoritative AVD Insights workbook for the condition. Use the official Microsoft workbook sources listed in workbook sources.

Extract and structurally validate the repository queries:

& .github/skills/avd-alert-kql-validation/scripts/Test-AvdAlertQueries.ps1 `
  -ModulePath deployments/add-ons/avdAlerts/modules

To inspect standalone KQL, add -OutputDirectory <temporary-folder>. Do not commit generated extraction output.

Compare table selection, joins, event names or IDs, status filters, casts, deduplication, and aggregation with the workbook query covering the same condition.

Adapt interactive workbook queries for alert semantics: remove render, return rows suitable for the configured aggregation and threshold, and use a bounded time window.

Verify overrideQueryTimeRange is at least windowSize multiplied by numberOfEvaluationPeriods and that persistent-event behavior matches autoMitigate.

Preserve cloud compatibility. Do not introduce workspace-specific functions or preview-only KQL without confirming support in every target cloud.

Document every intentional deviation in the add-on README. The reason must describe alert semantics, noise suppression, cloud compatibility, or source-data behavior.

Build the affected Bicep entry template and update ALERT-RESPONSE.md when operator action, thresholds, or dimensions change.

name	avd-alert-kql-validation
description	Create and review KQL for the FederalAVD AVD Alerts add-on. Use when adding or changing scheduled query alerts, comparing alert logic with Microsoft AVD Insights workbooks, investigating query failures, or documenting intentional workbook deviations.
argument-hint	[alert resource, KQL condition, or module]