CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

azure-monitor-logs-ingestion

Ingest synthetic JSON records into Azure Monitor custom tables or supported Microsoft standard tables by provisioning a writable Custom-* DCR input stream.

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.github/skills/azure-monitor-logs-ingestion/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a tightly written, highly actionable runbook: real commands, an explicit validation-before-write checkpoint, verification after ingestion, and concrete error-recovery paths. Its weaknesses are mild redundancy between Safety and Workflow, and dense one-off constraint material (Sentinel qualification rules, DCE notes) inlined where a reference file would keep the main workflow lean.

Suggestions

Move the Sentinel Qualification DCR-selection rules and the DCE/metadata explanations into a reference file, leaving the main workflow with the decision rule and a link.

Show a minimal contract example (or inline skeleton) so the core artifact can be authored without leaving the skill.

Deduplicate the connector-DCR protection rules — state them once in Safety and reference them from the workflow step.

DimensionReasoningScore

Conciseness

The body is dense, imperative, and assumes Azure/DCR knowledge without explaining concepts Claude already knows, but there is duplication (the step-5 rule 'Never change an existing connector DCR or add an input stream to it' repeats Safety bullets) and the DCE/metadata asides could be tightened — anchor 4, not 5 because some tokens are redundant, not 3 because there is no real padding or concept-teaching.

4 / 5

Actionability

Concrete copy-paste-ready CLI commands with real flags appear throughout ("azure-monitor-logs-ingestion inspect --contract <path> --payload <path>", "run", "verify", "--principal-id") plus specific 403 remediation; the gap is that the contract artifact — the core input — is never shown or sketched, delegated entirely to an examples path outside the file, fitting anchor 4 ('mostly executable with minor gaps') rather than 5.

4 / 5

Workflow Clarity

An 8-step numbered sequence includes explicit pre-write validation (step 6 'Validate without Azure writes'), post-ingestion verification (step 9), and error-recovery feedback loops (403 remediation, MCP failure fallback with 'A genuine KQL or table error returned by the MCP is not a reason to retry'), matching anchor 5's clear sequence with explicit validation and feedback loops.

5 / 5

Progressive Disclosure

Sections (Safety, Workflow) are well-organized and external Microsoft doc links are clear, but the ~95-line body inlines dense constraint material (e.g., the multi-paragraph Sentinel Qualification rules in step 5) that would fit a reference file, and the cited 'Tools\AzureMonitorLogsIngestion\examples' path is not part of the bundle — anchor 4 ('good structure, minor organization gaps') rather than 5 ('content appropriately split').

4 / 5

Total

17

/

20

Passed

Description

62%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinctive, accurately describing the mechanism (provisioning a writable Custom-* DCR input stream) and destinations. Its main weaknesses are the complete absence of a 'Use when...' trigger clause and missing natural synonyms like 'Log Analytics' and 'mock/test data' that users would most likely say.

Suggestions

Append an explicit trigger clause such as 'Use when the user wants to load mock, test, or synthetic data into a Log Analytics table in Azure Monitor (e.g., for Sentinel solution qualification or pipeline testing).'

Add natural synonyms users would say — 'Log Analytics', 'mock data', 'test data' — alongside the existing 'synthetic JSON records' phrasing.

Optionally mention the validation/verification capability (e.g., dry-run inspection and post-ingestion query checks) to round out capability coverage.

DimensionReasoningScore

Specificity

The description names concrete actions ("Ingest synthetic JSON records", "provisioning a writable Custom-* DCR input stream") and specific destinations ("Azure Monitor custom tables or supported Microsoft standard tables"), but coverage has minor gaps (e.g., validation and verification capabilities are unmentioned), fitting anchor 4 rather than 3 since it goes beyond 1-2 generic actions.

4 / 5

Completeness

The 'what' is clearly stated but there is no 'Use when...' clause or equivalent trigger guidance anywhere in the description; per the judging guidelines this caps completeness at 3.

3 / 5

Trigger Term Quality

Relevant keywords exist ("Azure Monitor", "custom tables", "JSON records", "ingest") but common natural variations users would say are missing — notably "Log Analytics", "mock/test data", and "Sentinel" — matching anchor 3 ('some relevant keywords but missing common variations') rather than 4.

3 / 5

Distinctiveness Conflict Risk

The description occupies a clear niche — Azure Monitor Logs ingestion via Custom-* DCR input streams — with distinct technical triggers and minimal overlap risk with other skills, matching anchor 5.

5 / 5

Total

15

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

Azure/Azure-Sentinel

Path

.github/skills/azure-monitor-logs-ingestion/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.