CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

sentinel-xdr-end-to-end-orchestrator

Orchestrate resumable Sentinel-to-Defender-XDR authoring and optional qualification by following the canonical agent-neutral workflow.

Quality

66%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./.github/skills/sentinel-xdr-end-to-end-orchestrator/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an efficient, information-dense adapter that delegates detail appropriately and specifies concrete gates, files, and skill boundaries. Its weaknesses are structural: no section headers, no ordered overview of the stages it orchestrates, and reliance on an external canonical workflow file (not part of the bundle) for the actual sequence. Reorganizing into labeled stage sections with a brief ordered summary would address the lowest-scoring dimensions without adding tokens.

Suggestions

Add a short ordered stage list (e.g. Authoring → Packaging → Qualification testing → Parity → Watchdog handoff) at the top so the sequence is explicit in this file rather than scattered across paragraphs.

Split the body into headed sections (Authoring, Packaging, Qualification, Partial packages, Execution governance) so an agent can locate the rules for the stage it is currently executing.

Show the exact structured-elicitation prompt or one concrete command example for the lab-deployment preapproval, since that interaction is fully specified in prose but has no template.

DimensionReasoningScore

Conciseness

The body is dense, rule-carrying prose with no explanations of concepts Claude already knows — every paragraph states a constraint, a file, or a gate — matching anchor 4 ('efficient; minor instances of over-explanation'). It falls short of anchor 5 because some rules are restated across paragraphs (immutability, not weakening canonical gates, approval requirements) and several sentences could be tightened.

4 / 5

Actionability

Guidance is concrete for an orchestration skill: exact skill invocations ('always invoke `sentinel-xdr-solution-packager`', 'run `sentinel-solution-optional-testing`'), state files ('workflow-state.json', 'qualification-target.json', 'mock.json'), locked field names ('tenantId', 'subscriptionId', 'workspaceResourceId', 'workspaceCustomerId'), CLI subcommands ('doctor', 'configure-workspace', 'package-v3-1'), and a specified prompt format ('X Sentinel rules, Y workbooks, and Z custom detections'). It is below anchor 5 because actual command syntax and the structured-elicitation format are delegated rather than shown, leaving minor execution gaps.

4 / 5

Workflow Clarity

Validation and approval checkpoints for risky writes are explicit ('confirm both exact queries return the same uniquely marked rows, and only then run alert parity', 'only after explicit user approval', single-owner leases with 'duplicate_executor_blocked'), but the multi-stage sequence itself is never laid out in order — stage ordering (authoring, packaging, testing extension, parity, watchdog handoff) must be assembled from scattered paragraphs plus an external canonical workflow file. This sits between anchor 3 (sequence present but incomplete) and anchor 4 (clear sequence), closer to 3 because the in-document sequence is implicit and fragmented rather than merely having minor gaps.

3 / 5

Progressive Disclosure

Delegation is appropriately one level deep — the canonical workflow file and the specialist skills own the details — but the ~90-line body has no section headers at all: roughly fifteen dense paragraphs under a single H1 covering authoring, qualification, packaging, partial packages, and execution governance. This matches anchor 3 ('some structure but could be better organized'): content is not inlined that belongs in separate files (ruling out anchor 2), but navigation and organization are weak (ruling out anchor 4).

3 / 5

Total

14

/

20

Passed

Description

53%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description identifies a clear, niche domain but reads as an internal process summary rather than a capability-and-trigger statement. It lacks any 'when to use' guidance and omits the natural vocabulary (migrate, convert, detections) a user would say. Adding an explicit trigger clause and concrete action verbs would lift most dimensions.

Suggestions

Add an explicit 'Use when...' clause, e.g. 'Use when the user asks to migrate, convert, or end-to-end validate Microsoft Sentinel analytics rules as Defender XDR custom detections.'

List the concrete capabilities covered (migration, packaging, mock-data testing, alert parity validation, publication) instead of the abstract 'Orchestrate ... by following the canonical agent-neutral workflow.'

Include natural synonyms and artifact names users would mention — 'migrate', 'convert', 'analytics rules', 'custom detections', 'solution package' — to improve trigger term coverage.

DimensionReasoningScore

Specificity

The description names the domain ('Sentinel-to-Defender-XDR') and two stage-level actions ('authoring and optional qualification'), but the operative verb is abstract ('Orchestrate ... by following the canonical agent-neutral workflow') rather than the several concrete actions of anchor 4, and coverage of what the skill actually does (migration, packaging, testing, parity validation) is thin.

3 / 5

Completeness

A 'what' is stated (orchestrating resumable authoring and optional qualification for the Sentinel-to-XDR flow), but there is no 'Use when...' clause or equivalent trigger guidance, which caps completeness at 3 per the judging guidelines. The 'what' itself is also more process-framing than capability listing.

3 / 5

Trigger Term Quality

Strong product keywords ('Sentinel', 'Defender XDR', 'authoring', 'qualification') are present, but the most natural user phrasings — 'migrate', 'convert', 'analytics rules', 'custom detections', 'test' — are absent, matching anchor 3 ('some relevant keywords but missing common variations or synonyms'). It is above anchor 2 because more than one or two generic keywords are present, and below anchor 4 because key synonyms users would actually say are missing.

3 / 5

Distinctiveness Conflict Risk

The niche is clear ('Sentinel-to-Defender-XDR authoring and optional qualification') and unlikely to trigger unrelated skills, fitting anchor 4 ('mostly distinct; minor overlap risk'). It is below anchor 5 because the description does not articulate triggers that would distinguish it from closely related Sentinel/XDR migration or packaging skills in the same family.

4 / 5

Total

13

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

Azure/Azure-Sentinel

Path

.github/skills/sentinel-xdr-end-to-end-orchestrator/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.