[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M699ZDM06M32KB25C79M15M2":3,"skill-same:01M699ZDM06M32KB25C79M15M2":83},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":60,"commitSha":61,"skillDirectory":62,"forksCount":63,"repositoryHtmlUrl":64,"repositoryHomepageUrl":6,"ownerHtmlUrl":65,"ownerBlogUrl":66,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M699ZDM06M32KB25C79M15M2","evidence-before-after",null,"Use to build the before-and-after visual evidence for a Zava Learning incident. First classify the fault, then render the ONE visual that actually explains what changed — a before\u002Fafter path or topology diagram for connectivity\u002Fconfig\u002FRBAC faults, or time-series comparison charts for performance\u002Favailability faults — plus a state\u002Fmetric delta table. Never plot a metric that does not tell the story. Its output is used in the RCA and the zava-reporting deliverables.","microsoft\u002Fsre-agent","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M699YP84JQDX8CY79ZD1TTEF",187,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fevidence-before-after\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"evidence before after","evidence","delta","for","deliverables","comparison","output","availability","render","series","visual","time","incident","rca","never","use","learning","Charts","state","config","performance","2026-11-10 10:12:30",false,"---\nmetadata:\n  api_version: azuresre.ai\u002Fv2\n  kind: Skill\nname: evidence-before-after\ndescription: Use to build the before-and-after visual evidence for a Zava Learning incident. First classify the fault, then render the ONE visual that actually explains what changed — a before\u002Fafter path or topology diagram for connectivity\u002Fconfig\u002FRBAC faults, or time-series comparison charts for performance\u002Favailability faults — plus a state\u002Fmetric delta table. Never plot a metric that does not tell the story. Its output is used in the RCA and the zava-reporting deliverables.\ntools:\n  - RunAzCliReadCommands\n  - GetAzCliHelp\n  - ListAvailableMetrics\n  - GetMetricTimeSeriesElementsForAzureResource\n  - QueryAppInsightsByResourceId\n  - QueryLogAnalyticsByResourceId\n  - PlotBarChart\n  - PlotAreaChartWithCorrelation\n  - PlotScatter\n  - ExecutePythonCode\n  - SearchMemory\n---\n\n## Zava Learning — Before \u002F After Evidence\n\nProve impact and recovery with the *right* visual for the fault — not a chart by reflex. Resource\nGroup: `@@RG@@`. Services: `learner-portal`, `course-api`, `assessment-api`. Retrieve `zava-brand`\nand `zava-report-template` with `SearchMemory` and apply the house style. Use the windows and\nroot cause confirmed by `rca-analysis`.\n\n## Step 1 — Decide the visual FIRST (do not skip)\nClassify what actually changed, then pick the visual that explains *that*. Plotting a smooth metric\nfor a binary\u002Fconfig fault (e.g. \"availability before\u002Fafter\" for an NSG block) is misleading and\nadds no insight — don't do it.\n\n| Fault class | What changed | Primary visual | Secondary (only if telemetry shows it) |\n|---|---|---|---|\n| **Connectivity \u002F config \u002F NSG \u002F App Gateway probe \u002F RBAC** | a path or permission was **closed → open** (binary) | **before→after path\u002Ftopology diagram (ASCII or Mermaid)** + a config-state delta table | one short recovery curve (e.g. 502-rate → 0) |\n| **Performance \u002F latency \u002F saturation** | a metric **degraded → recovered** (gradual) | **time-series before\u002Fduring\u002Fafter** + percentile delta table | before-vs-after summary bars |\n| **Availability \u002F reliability** (5xx, restarts, replica loss) | error\u002Fhealth rate **rose → fell** | **time-series** + delta table | summary bars |\n\nIf a fault has both a binary cause and a metric symptom (common), lead with the **diagram** that\nexplains the cause and use **one** metric chart only as supporting recovery proof.\n\n## Step 2 — Capture the before\u002Fafter STATE (config & binary faults)\nFor connectivity\u002Fconfig\u002FRBAC faults, the evidence is the changed configuration, not a metric:\n- Read the relevant config with `RunAzCliReadCommands` (e.g. NSG effective rules, App Gateway\n  backend health, Container Apps revision\u002Fingress, role assignments) at the mitigated state, and\n  reconstruct the pre-fix state from `rca-analysis` \u002F change history.\n- Build a **state delta table**: `item · before · after · effect`, e.g.\n  `NSG rule block-appgw (prio 100 DENY) · present · removed · AppGW→apps unblocked`;\n  `AppGW backend health · Unhealthy · Healthy · probes pass`; `GET \u002Fapi\u002Fquiz · 502 · 200`.\n- Render a **before→after path diagram** showing the broken hop and the fixed hop. Author it as\n  ASCII (preferred for chat\u002FPagerDuty notes) and\u002For a Mermaid graph; for a polished report image\n  use `ExecutePythonCode` (graphviz\u002Fmatplotlib). Example shape:\n\n  ```\n  BEFORE (blocked)                         AFTER (fixed)\n  AppGW ──►  NSG subnet  ──► [apis]         AppGW ──►  NSG subnet  ──► [apis]\n                │ DENY-100 ✗                              │ (rule removed) ✓\n  backend: UNHEALTHY (502)                 backend: HEALTHY (200)\n  ```\n\n## Step 3 — Pull metrics (performance\u002Favailability faults, or as recovery proof)\nOnly when a metric genuinely tells the story. Define three windows — **Before** (healthy baseline),\n**During** (detection→mitigation), **After** (post-fix, long enough to be credible) — using the\nexact windows from `rca-analysis`. Per affected service pull the metric matching the symptom:\n- Availability \u002F HTTP 5xx \u002F success rate (`QueryAppInsightsByResourceId`).\n- Latency — for the latency scenario, `ms=\u003Cduration>` from assessment-api console logs via\n  `QueryLogAnalyticsByResourceId`; report p50\u002Fp95\u002Fp99.\n- Replica count \u002F restarts \u002F throughput (`ListAvailableMetrics`,\n  `GetMetricTimeSeriesElementsForAzureResource`).\n\nRender brand-colored: before series in Critical red, after in Zava Teal, target\u002Fbaseline as a\ndashed Slate line, every series labeled; annotate mitigation and fix points.\n`PlotAreaChartWithCorrelation` \u002F `PlotScatter` for the series, `PlotBarChart` for before-vs-after\nbars. Use `ExecutePythonCode` (matplotlib) only for a comparison the Plot* tools can't express.\n\n## Rules\n- One headline visual that explains the cause; supporting visuals only if the data backs them.\n- Never plot a metric that doesn't change shape across the fault, or fabricate a trend to fill a slide.\n- Same units, axes, and aggregation before vs. after — no misleading scales.\n- Don't claim recovery a number doesn't support; if the after-window is too short, say so.\n\n## Verification\nThe visual matches the fault class: a before\u002Fafter diagram + state delta table for config\u002Fbinary\nfaults, or a before\u002Fafter chart + metric delta table for performance\u002Favailability faults — all from\nreal config\u002Ftelemetry over clearly stated windows, ready for `rca-analysis` and `zava-reporting`.\n","## Zava Learning — Before \u002F After Evidence\n\nProve impact and recovery with the *right* visual for the fault — not a chart by reflex. Resource\nGroup: `@@RG@@`. Services: `learner-portal`, `course-api`, `assessment-api`. Retrieve `zava-brand`\nand `zava-report-template` with `SearchMemory` and apply the house style. Use the windows and\nroot cause confirmed by `rca-analysis`.\n\n## Step 1 — Decide the visual FIRST (do not skip)\nClassify what actually changed, then pick the visual that explains *that*. Plotting a smooth metric\nfor a binary\u002Fconfig fault (e.g. \"availability before\u002Fafter\" for an NSG block) is misleading and\nadds no insight — don't do it.\n\n| Fault class | What changed | Primary visual | Secondary (only if telemetry shows it) |\n|---|---|---|---|\n| **Connectivity \u002F config \u002F NSG \u002F App Gateway probe \u002F RBAC** | a path or permission was **closed → open** (binary) | **before→after path\u002Ftopology diagram (ASCII or Mermaid)** + a config-state delta table | one short recovery curve (e.g. 502-rate → 0) |\n| **Performance \u002F latency \u002F saturation** | a metric **degraded → recovered** (gradual) | **time-series before\u002Fduring\u002Fafter** + percentile delta table | before-vs-after summary bars |\n| **Availability \u002F reliability** (5xx, restarts, replica loss) | error\u002Fhealth rate **rose → fell** | **time-series** + delta table | summary bars |\n\nIf a fault has both a binary cause and a metric symptom (common), lead with the **diagram** that\nexplains the cause and use **one** metric chart only as supporting recovery proof.\n\n## Step 2 — Capture the before\u002Fafter STATE (config & binary faults)\nFor connectivity\u002Fconfig\u002FRBAC faults, the evidence is the changed configuration, not a metric:\n- Read the relevant config with `RunAzCliReadCommands` (e.g. NSG effective rules, App Gateway\n  backend health, Container Apps revision\u002Fingress, role assignments) at the mitigated state, and\n  reconstruct the pre-fix state from `rca-analysis` \u002F change history.\n- Build a **state delta table**: `item · before · after · effect`, e.g.\n  `NSG rule block-appgw (prio 100 DENY) · present · removed · AppGW→apps unblocked`;\n  `AppGW backend health · Unhealthy · Healthy · probes pass`; `GET \u002Fapi\u002Fquiz · 502 · 200`.\n- Render a **before→after path diagram** showing the broken hop and the fixed hop. Author it as\n  ASCII (preferred for chat\u002FPagerDuty notes) and\u002For a Mermaid graph; for a polished report image\n  use `ExecutePythonCode` (graphviz\u002Fmatplotlib). Example shape:\n\n  ```\n  BEFORE (blocked)                         AFTER (fixed)\n  AppGW ──►  NSG subnet  ──► [apis]         AppGW ──►  NSG subnet  ──► [apis]\n                │ DENY-100 ✗                              │ (rule removed) ✓\n  backend: UNHEALTHY (502)                 backend: HEALTHY (200)\n  ```\n\n## Step 3 — Pull metrics (performance\u002Favailability faults, or as recovery proof)\nOnly when a metric genuinely tells the story. Define three windows — **Before** (healthy baseline),\n**During** (detection→mitigation), **After** (post-fix, long enough to be credible) — using the\nexact windows from `rca-analysis`. Per affected service pull the metric matching the symptom:\n- Availability \u002F HTTP 5xx \u002F success rate (`QueryAppInsightsByResourceId`).\n- Latency — for the latency scenario, `ms=\u003Cduration>` from assessment-api console logs via\n  `QueryLogAnalyticsByResourceId`; report p50\u002Fp95\u002Fp99.\n- Replica count \u002F restarts \u002F throughput (`ListAvailableMetrics`,\n  `GetMetricTimeSeriesElementsForAzureResource`).\n\nRender brand-colored: before series in Critical red, after in Zava Teal, target\u002Fbaseline as a\ndashed Slate line, every series labeled; annotate mitigation and fix points.\n`PlotAreaChartWithCorrelation` \u002F `PlotScatter` for the series, `PlotBarChart` for before-vs-after\nbars. Use `ExecutePythonCode` (matplotlib) only for a comparison the Plot* tools can't express.\n\n## Rules\n- One headline visual that explains the cause; supporting visuals only if the data backs them.\n- Never plot a metric that doesn't change shape across the fault, or fabricate a trend to fill a slide.\n- Same units, axes, and aggregation before vs. after — no misleading scales.\n- Don't claim recovery a number doesn't support; if the after-window is too short, say so.\n\n## Verification\nThe visual matches the fault class: a before\u002Fafter diagram + state delta table for config\u002Fbinary\nfaults, or a before\u002Fafter chart + metric delta table for performance\u002Favailability faults — all from\nreal config\u002Ftelemetry over clearly stated windows, ready for `rca-analysis` and `zava-reporting`.\n",{"name":5,"tools":45,"metadata":57,"description":7},[46,47,48,49,50,51,52,53,54,55,56],"RunAzCliReadCommands","GetAzCliHelp","ListAvailableMetrics","GetMetricTimeSeriesElementsForAzureResource","QueryAppInsightsByResourceId","QueryLogAnalyticsByResourceId","PlotBarChart","PlotAreaChartWithCorrelation","PlotScatter","ExecutePythonCode","SearchMemory",{"kind":58,"api_version":59},"Skill","azuresre.ai\u002Fv2","main","f3dccc6bae8c932ff4f21e6d4117e14285da4db3","labs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fevidence-before-after",192,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-11-10 10:20:55",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add microsoft\u002Fsre-agent --skill evidence-before-after",{"tool":75,"command":76},"bunx","bunx skills add microsoft\u002Fsre-agent --skill evidence-before-after",{"tool":78,"command":79},"pnpm","pnpm dlx skills add microsoft\u002Fsre-agent --skill evidence-before-after","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fevidence-before-after\u002FSKILL.md",true,[],[84,109,146,168,192,210],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":40},"01M699ZY06GBDPEYW1HEDRAVK8","zava-reporting","Use to package a completed Zava Learning incident analysis for the audience. First present a branded in-thread executive summary (markdown with the before\u002Fafter visuals inline), then produce the downloadable deliverables — a PowerPoint deck, an HTML email, and a Teams notification — using the Zava corporate template. The calling agent may narrow this to a subset (e.g. only the HTML report). Produces content and artifacts; it does not send them. Assembles the output of rca-analysis, evidence-before-after, recommendations-next-steps, and pr-delivery.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fzava-reporting\u002FSKILL.md",[],[91,92,32,93,94,95,96,97,98,99,100,101,20,102,103,104,31,105,106,107,108],"zava reporting","reporting","visuals","powerpoint","executive summary","analysis","markdown","html report","template","html","only","before-after","next","delivery","recommendations","present","inline","send",{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":128,"publishedAt":40},"01M699ZWCMAF3M8P4A8P0VXEF7","zava-audit-report","Use to package a completed Zava Learning weekly governance audit (NSG \u002F network security, RBAC \u002F least-privilege, or cloud cost) into a single branded, downloadable PowerPoint deck in the Zava house style. The calling audit agent passes its findings (a list of rows with severity) and a short posture summary; this skill renders the deck, applies redaction, and returns the attachment download link. Produces the artifact; it does not send it.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fzava-audit-report\u002FSKILL.md",[115,120,123],{"categoryNo":116,"categoryName":117,"taxonomyType":118,"taxonomyTypeDesc":119},"01JBSEEDCAT000000000000003","演示文稿","SCENARIO","使用场景",{"categoryNo":121,"categoryName":122,"taxonomyType":118,"taxonomyTypeDesc":119},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":124,"categoryName":125,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[129,130,131,132,133,134,135,94,136,137,138,35,139,140,141,142,143,144,108,145],"zava audit report","report","audit","audit report","security","network security","rbac","network","least-privilege","severity","returns","short","list","deck","artifact","weekly","single",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":152,"publishedAt":40},"01M699ZV3DK2HK74MMKABQBNC7","servicenow-change-management","Use whenever a Zava Learning investigation produces a durable fix that needs change management — after a GitHub PR is opened for an Infrastructure-as-Code or application code root cause, raise a ServiceNow Change Request referencing the PR and attach the RCA report. The single owner of ServiceNow Change Request and attachment operations.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fservicenow-change-management\u002FSKILL.md",[],[153,154,155,156,157,158,32,159,160,161,35,162,34,163,164,165,166,22,145,167],"change","servicenow change management","servicenow","change management","management","github","pr","code","infrastructure-as-code","fix","attach","github pr","as","infrastructure-as","root cause",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":174,"publishedAt":40},"01M699ZSQAYXNM5YXH35GQXG2E","redaction-guard","Use whenever you are about to emit operator-visible content — a chat\u002Fthread message, a PagerDuty or ServiceNow note, a commit message or pull-request body, or any report artifact (HTML, PowerPoint, Teams card). Deterministically masks secrets, credentials, tokens, private keys, URI-embedded passwords, and PII so they never appear in the thread or in any deliverable. This is a cross-cutting guardrail invoked by the output-producing skills, not a runbook step.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fredaction-guard\u002FSKILL.md",[],[175,176,177,178,179,180,181,182,183,34,33,184,185,186,187,188,25,189,190,191],"redaction guard","guard","redaction","commit","teams","commit message","pull","runbook","pii","pagerduty","chat","tokens","guardrail","card","you","passwords","thread",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":198,"publishedAt":40},"01M699ZRHD3XNYX412M7613ACM","recommendations-next-steps","Use to produce the forward-looking recommendations and next steps for a Zava Learning incident — prioritized preventive, detective, and process actions with owners, target dates, and the risk of inaction. Its output is used in the zava-reporting deliverables.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Frecommendations-next-steps\u002FSKILL.md",[],[199,103,105,200,201,9,202,203,204,205,92,206,35,207,34,31,25,208,23,22,209],"recommendations next steps","next steps","docs","learn","produce","search","actions","risk","process","with","dates",{"skillNo":211,"name":212,"nameZh":6,"description":213,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":214,"categories":215,"keywords":216,"publishedAt":40},"01M699ZQBV3ECBCA58WSBCJE54","rca-analysis","Use to produce the root-cause analysis narrative for a resolved or mitigated Zava Learning incident — the incident timeline, the trigger vs. latent root cause (5-Whys), contributing factors, and how to present them. Defines the RCA section format; its output is used in the before\u002Fafter, recommendations, and reporting deliverables.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Frca-analysis\u002FSKILL.md",[],[32,217,96,203,218,219,35,220,34,221,31,105,222,223,224,25,23,22,225,167],"rca analysis","contributing","how","format","root-cause","trigger","how to","narrative","section"]