Skill UI

This skill guides users on querying Azure Monitor activity and sign-in logs using KQL to detect sophisticated security threats. It covers identifying suspicious administrative activities, impossible travel scenarios, privilege escalation attempts, and unauthorized resource modifications. Ideal for Security Operations Center (SOC) analysts building advanced threat hunting rules or developing cloud SIEM detections.

Generates weekly telemetry reports and customer adoption reports for Azure Backup MCP tools. Runs KQL queries to classify errors into Customer/Azure Service/MCP Tool Bug, identifies customers via cross-cluster joins, compares week-over-week metrics, correlates with merged PRs, and produces an Outlook-compatible HTML report.