Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →microsoftdocs/azure-sentinel
Expert knowledge for Azure Sentinel development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment.
Passed 8 of 14 test cases with the skill, and 4 of 14 without it.
and 4 more in the full report
7 fixed5 passed either way8 still failing2 broke
Tokens, turns and time describe resource use, not a dollar price.
This benchmark measured an earlier version of the skill.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are standardizing our custom DNS firewall logs to follow the Advanced SIEM Information Model (ASIM) in Sentinel so our built-in analytics rules work seamlessly. Which documentation resource defines the ASIM DNS normalization schema fields?
| Checked | Without skill | With skill |
|---|---|---|
| References the official URL https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-dns | Missed | Passed |
| Names the standard ASIM field DnsQuery | Passed | Passed |
The instructions your model reads when the skill loads.
This skill provides expert guidance for Azure Sentinel. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.
IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g.,
L35-L120), useread_filewith the specified lines. For categories with file links (e.g.,[security.md](security.md)), useread_fileon the linked reference file
IMPORTANT for Agent: If
metadata.generated_atis more than 3 months old, suggest the user pull the latest version from the repository. Ifmcp_microsoftdocstools are not available, suggest the user install it: Installation Guide
This skill requires network access to fetch documentation content:
mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.| Category | Lines | Description |
|---|---|---|
| Troubleshooting | L37-L50 | Diagnosing and fixing Microsoft Sentinel ingestion, connector, KQL, notebook, MCP, SAP, and analytics rule errors, plus monitoring and troubleshooting scheduled rule execution. |
| Best Practices | L51-L74 | Best practices for designing, tuning, and operating Microsoft Sentinel: automation, playbooks, KQL hunting, analytics rules, UEBA, ASIM, watchlists, SOC metrics, and solution quality. |
| Decision Making | L75-L117 | Guidance for planning Sentinel deployments, costs, data tiers, and connectors, plus detailed strategies to migrate from legacy SIEMs (Splunk, QRadar, ArcSight) and optimize detections and automation. |
| Architecture & Design Patterns | L118-L129 | Designing Microsoft Sentinel architectures: workspace/tenant layouts, SIEM patterns, BCDR/resiliency, data lake/graph designs, and coexisting with or migrating from other SIEMs. |
| Limits & Quotas | L130-L142 | Limits, quotas, pricing, and availability of Sentinel features (rules, data lake, MCP), plus constraints and safe management of search jobs and watchlists, and removal implications. |
| Security | L143-L162 | Configuring secure access, permissions, encryption, and RBAC for Microsoft Sentinel, including playbooks, data lake, storage connectors, SAP integration, and automated attack disruption across clouds. |
| Configuration | L163-L296 | Configuring Microsoft Sentinel: data connectors and ASIM schemas, analytics rules, automation/playbooks, TI and SAP integrations, data lake jobs, health/auditing, and solution/workbook setup. |
| Integrations & Coding Patterns | L297-L342 | Patterns and APIs for integrating Sentinel with logs, threat intel, MCP/AI tools, Logic Apps playbooks, data lake, connectors, and external platforms like AWS, Entra ID, Purview. |
| Deployment | L343-L357 | Deploying and customizing Sentinel solutions and content (rules, automation, notebooks, SAP, Copilot agents) via CI/CD, ARM, data lake, and multi-cloud/Stack Hub onboarding. |
test cases passed, vs 4 / 14 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.