analyzing-azure-activity-logs-for-threats

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-azure-activity-logs-for-threats/SKILL.md

Quality

Content

62%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is concise and mostly actionable with real executable KQL/Python, but it lacks validation checkpoints for its batch detection workflow and fails to clearly link to its existing bundle files, capping workflow_clarity and progressive_disclosure.

Suggestions

Add an explicit validation/feedback step to the detection workflow — e.g., 'Review findings for false positives before reporting; re-query with tighter time ranges if results are noisy' — to lift workflow_clarity above the batch-skill cap of 3.

Link the bundle files inline in the body, e.g., 'See [references/api-reference.md](references/api-reference.md) for table schemas and KQL patterns' and 'Run [scripts/agent.py](scripts/agent.py) --action full_hunt for a full hunt', to improve navigation and progressive disclosure.

Replace or complete the 'Examples' fragment with a full executable snippet (including iterating response.tables/rows) so the example is copy-paste ready rather than a partial query.

Dimension	Reasoning	Score
Conciseness	The body is largely efficient with executable code and a compact detection-query list, but 'Prerequisites' and 'When to Use' include some generic boilerplate ('Familiarity with security operations concepts') that could be trimmed, keeping it just below the lean anchor.	4 / 5
Actionability	The main code snippet is executable and the numbered detection queries are concrete, but the 'Examples' block is an incomplete fragment (a query with no result handling) and the body does not point to the runnable scripts/agent.py, leaving minor gaps.	4 / 5
Workflow Clarity	Detection hunting is a batch operation, yet the body provides no validation or feedback checkpoints (e.g., verifying query results, confirming findings before reporting); per the rubric cap, a batch skill without validation cannot score above 3.	3 / 5
Progressive Disclosure	A references/api-reference.md and scripts/agent.py bundle exists, but the body never signals them inline (no links or 'See api-reference.md' pointers), so the structure is present but navigation is not clearly surfaced.	3 / 5
	Total	14 / 20 Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, complete, and clearly distinct, with explicit 'Use when' trigger guidance and multiple concrete detection capabilities. The only minor gap is slightly less exhaustive coverage of synonym/extension-style trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Queries Azure Monitor activity logs and sign-in logs', 'detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications', 'Builds KQL queries for threat hunting' — giving comprehensive coverage of the skill's capabilities.	5 / 5
Completeness	Clearly answers both 'what' (queries activity and sign-in logs to detect the named threat types, builds KQL) and 'when' via the explicit 'Use when investigating suspicious Azure tenant activity or building cloud SIEM detections' clause.	5 / 5
Trigger Term Quality	Good natural keyword coverage ('suspicious Azure tenant activity', 'threat hunting', 'cloud SIEM detections', 'privilege escalation') but misses common synonym/extension variants a user might say, so it falls just below the comprehensive anchor.	4 / 5
Distinctiveness Conflict Risk	A clear niche — Azure Monitor/KQL-based cloud SIEM detection — with distinct triggers ('Azure tenant activity', 'cloud SIEM detections') that minimize overlap with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-azure-activity-logs-for-threats/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.