investigate-sentinel-pr

Files (2)

• SKILL.md
• review-contract.md · references/

SKILL.md (first lines)

# Investigate a Microsoft Sentinel PR

Treat `$ARGUMENTS` as the investigation target. Work read-only unless the user
separately authorizes a modification.

1. Establish the exact repository, head commit, base branch, parent or follow-up
   PRs, issue references, review threads, checks, and unresolved conversations.
2. Inspect the changed source and generated package separately. Never infer that
   a generated ARM template is correct solely because its source is correct.
3. Map each reviewer concern to a requirement, implementation location,
   verification method, current evidence, and remaining uncertainty.
4. Review analytics, parsers, workbooks, playbooks, permissions, packaging,
   release notes, metadata, and documentation that are actually in scope.
5. Classify findings by consequence: observation, recommendation, reversible
   mutation, containment, destructive mutation, or external communication.
6. Label every claim `verified`, `inferred`, `unverified`, or `contradicted`.
7. Produce a concise decision ledger and a prioritized gap list. Do not post it
   to GitHub without explicit approval.

Use `references/review-contract.md` for the required output fields.

From AAH20/azure-trustops, MIT.

More from AAH20/azure-trustops