asim-parser-validator

This skill will validate an ASIM by checking the schema output of the parser and also checking the data that the parser represents in the columns. Use this skill after you have created or updated an ASIM parser to validate that the parser is correctly mapping the source data to the ASIM schema.

Quality

95%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

100%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tightly written, fully actionable validation procedure: lean prose, executable KQL and CLI commands, a clearly sequenced workflow with explicit validation gates and an error-recovery loop, and well-organized sections. No significant weaknesses were found.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence — it never explains what ASIM, KQL, parsers, or ARM are, and jumps straight into concrete inputs and steps; the one explanatory note about `\| limit 1000` is operationally relevant rather than padding.	3 / 3
Actionability	It provides fully executable KQL queries and `az` CLI commands with fill-in placeholders, concrete ARM template download URLs, and a ready-to-run deployment command — copy-paste ready rather than pseudocode.	3 / 3
Workflow Clarity	A clear Step 0→3 sequence with an explicit validation gate ("Address all errors before proceeding to Step 2"), severity-level interpretation guidance, and a feedback loop ("If the query fails with a syntax error, fix the issue before returning results").	3 / 3
Progressive Disclosure	The skill is a self-contained single procedure with no bundle files and no nested document references; content is well-organized under clear section headers (Inputs, Step 0–3, Outputs), fitting the scoring-note allowance for skills that need no external references.	3 / 3
	Total	12 / 12 Passed

Description

90%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-targeted description that clearly states both what the skill does and when to use it, with natural trigger terms for its specialized Sentinel niche. The only minor weakness is the slightly generic, repetitive action phrasing ("checking...checking").

Suggestions

Replace the repeated generic verb "checking" with more specific actions, e.g. "Validates ASIM parsers by verifying schema output columns and data types and confirming column values, enumerations, and data formatting."

Dimension	Reasoning	Score
Specificity	The description names the ASIM domain and two validation actions ("checking the schema output of the parser" and "checking the data that the parser represents in the columns"), but the repeated generic verb "checking...checking" is not richly enumerative, matching anchor 2 rather than the multi-action anchor 3.	2 / 3
Completeness	It answers both what ("validate an ASIM by checking the schema output... and checking the data...") and when via the explicit trigger clause "Use this skill after you have created or updated an ASIM parser to validate...", matching the anchor-3 example with a clear "Use when" equivalent.	3 / 3
Trigger Term Quality	Terms like "ASIM", "parser", "schema", "validate", and "ASIM schema" are exactly what a Sentinel engineer would naturally say when needing this skill, giving good coverage of the niche's natural trigger language.	3 / 3
Distinctiveness Conflict Risk	ASIM parser validation is a narrow, distinct niche with specific triggers (ASIM parser, ASIM schema) that are unlikely to fire for unrelated skills.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: Azure/Azure-Sentinel
Path: .github/skills/asim-parser-validator/SKILL.md
Commit: fd26ba7

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.