菜单
Create and review KQL for the FederalAVD AVD Alerts add-on. Use when adding or changing scheduled query alerts, comparing alert logic with Microsoft AVD Insights workbooks, investigating query failures, or documenting intentional workbook deviations.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/Azure/FederalAVD --skill avd-alert-kql-validation命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Modify and validate FederalAVD Bicep templates, generated ARM JSON, parameters, and uiFormDefinition files. Use when changing deployment resources, adding parameters or outputs, synchronizing Bicep with JSON, publishing Template Specs, or debugging portal form behavior.
Review FederalAVD deployments and image artifacts for Azure Government Secret or Top Secret air-gapped readiness. Use when auditing downloads.json, finding public network dependencies, preparing transfer inventories, validating pre-staged files, or checking that image builds and host pools avoid internet runtime downloads.
Create, update, and validate FederalAVD image artifacts and software download definitions. Use when adding customer-example artifacts, editing downloads.json, packaging installers, documenting download sources, or preparing artifacts for connected or air-gapped image builds.
正在显示 SKILL.md
| name | avd-alert-kql-validation |
| description | Create and review KQL for the FederalAVD AVD Alerts add-on. Use when adding or changing scheduled query alerts, comparing alert logic with Microsoft AVD Insights workbooks, investigating query failures, or documenting intentional workbook deviations. |
| argument-hint | [alert resource, KQL condition, or module] |
Use this workflow for log-based alerts under deployments/add-ons/avdAlerts/.
Read deployments/add-ons/avdAlerts/README.md, especially Query Design and Validation, and
locate the corresponding operator response in ALERT-RESPONSE.md.
Identify the authoritative AVD Insights workbook for the condition. Use the official Microsoft workbook sources listed in workbook sources.
Extract and structurally validate the repository queries:
& .github/skills/avd-alert-kql-validation/scripts/Test-AvdAlertQueries.ps1 `
-ModulePath deployments/add-ons/avdAlerts/modules
To inspect standalone KQL, add -OutputDirectory <temporary-folder>. Do not commit generated
extraction output.
Compare table selection, joins, event names or IDs, status filters, casts, deduplication, and aggregation with the workbook query covering the same condition.
Adapt interactive workbook queries for alert semantics: remove render, return rows suitable for
the configured aggregation and threshold, and use a bounded time window.
Verify overrideQueryTimeRange is at least windowSize multiplied by
numberOfEvaluationPeriods and that persistent-event behavior matches autoMitigate.
Preserve cloud compatibility. Do not introduce workspace-specific functions or preview-only KQL without confirming support in every target cloud.
Document every intentional deviation in the add-on README. The reason must describe alert semantics, noise suppression, cloud compatibility, or source-data behavior.
Build the affected Bicep entry template and update ALERT-RESPONSE.md when operator action,
thresholds, or dimensions change.