[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M699ZQBV3ECBCA58WSBCJE54":3,"skill-same:01M699ZQBV3ECBCA58WSBCJE54":78},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":6,"ownerHtmlUrl":60,"ownerBlogUrl":61,"ownerDescription":62,"updatedAt":63,"install":64,"resources":77},"01M699ZQBV3ECBCA58WSBCJE54","rca-analysis",null,"Use to produce the root-cause analysis narrative for a resolved or mitigated Zava Learning incident — the incident timeline, the trigger vs. latent root cause (5-Whys), contributing factors, and how to present them. Defines the RCA section format; its output is used in the before\u002Fafter, recommendations, and reporting deliverables.","microsoft\u002Fsre-agent","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M699YP84JQDX8CY79ZD1TTEF",188,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Frca-analysis\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"rca analysis","rca","analysis","root cause","section","for","deliverables","output","narrative","how to","trigger","recommendations","incident","root-cause","use","format","learning","how","contributing","produce","2026-11-10 10:12:30",false,"---\nmetadata:\n  api_version: azuresre.ai\u002Fv2\n  kind: Skill\nname: rca-analysis\ndescription: Use to produce the root-cause analysis narrative for a resolved or mitigated Zava Learning incident — the incident timeline, the trigger vs. latent root cause (5-Whys), contributing factors, and how to present them. Defines the RCA section format; its output is used in the before\u002Fafter, recommendations, and reporting deliverables.\ntools:\n  - SearchMemory\n  - GetActivityLogsSummary\n  - GetChangeHistory\n  - QueryAppInsightsByResourceId\n  - QueryLogAnalyticsByResourceId\n  - RunAzCliReadCommands\n  - ExecutePythonCode\n---\n\n## Zava Learning — Root Cause Analysis\n\nProduce the analytical heart of the incident report: a defensible, evidence-backed RCA in the\nhouse format. Resource Group: `@@RG@@`. Services: `learner-portal`, `course-api`,\n`assessment-api`. Retrieve `zava-brand` and `zava-report-template` with `SearchMemory` and\nfollow the Root cause + Timeline sections of the template.\n\n## Gather evidence first (never assert without it)\n- **Timeline:** reconstruct detection → mitigation → durable fix from `GetActivityLogsSummary`,\n  `GetChangeHistory`, and the relevant App Insights \u002F Log Analytics queries\n  (`QueryAppInsightsByResourceId`, `QueryLogAnalyticsByResourceId`) filtered by the affected\n  `cloud_RoleName`. Every timeline row cites a source.\n- Align the symptom onset to the nearest config\u002Frevision\u002Fdeployment change.\n\n## Structure the RCA\n1. **What happened** — the symptom and customer impact in plain language (no cause in the title).\n2. **Timeline** — UTC table: time · event · evidence\u002Fsource.\n3. **5-Whys (MANDATORY, render the ladder)** — write an explicit, numbered Why-ladder, not a\n   one-line summary. Start from the student-visible symptom and ask \"why?\" repeatedly until you\n   reach the latent root cause — typically five steps:\n   - **Why 1:** students saw \u003Csymptom> → because \u003Cimmediate technical effect>\n   - **Why 2:** \u003Ceffect> → because \u003Cmisbehaving component\u002Fconfig>\n   - **Why 3:** \u003Ccomponent> misbehaved → because \u003Cthe change\u002Fstate that caused it>\n   - **Why 4:** that change happened → because \u003Chow it got introduced \u002F trigger>\n   - **Why 5 (latent root cause):** it was possible\u002Fundetected → because \u003Cmissing guardrail or gap>\n\n   Each rung cites its evidence. Then state the **trigger** (what set it off now) separately from\n   the **latent cause** (the condition that made it possible) — the latent cause is Why 5. Render\n   this ladder in the RCA section; never collapse it to a single trigger\u002Flatent two-liner.\n4. **Contributing factors** — gaps in detection, guardrails, or process that widened impact.\n5. **Why it was hard \u002F easy to detect** — informs the detective recommendations.\n\n## Presentation rules\n- Symptom-only headings; the root cause appears in the body, never in a title.\n- The 5-Whys ladder is ALWAYS rendered under a literal **`5 Whys`** heading (`### 5 Whys` \u002F\n  `\u003Ch3>5 Whys\u003C\u002Fh3>`) inside the Root Cause section, with five numbered rungs each on its own line\n  (`Why 1:` … `Why 5:`). A request-path Mermaid diagram may accompany it but never replaces it.\n- Distinguish facts (with evidence) from hypotheses (label clearly).\n- Keep it blameless: systems and conditions, not individuals.\n\n## Outputs\nThis skill produces, for the wider investigation: the **fault class** (connectivity\u002Fconfig\u002FRBAC vs.\nperformance\u002Favailability — so `evidence-before-after` picks the right visual), the confirmed\nbefore\u002Fafter time windows and affected metrics or config state (used by `evidence-before-after`),\nthe unresolved detection\u002Fguardrail gaps (used\nby `recommendations-next-steps`), and the finished RCA section (used by `zava-reporting`). Record\nthem clearly so the agent can use them in whichever skill it runs next.\n\n## Verification\nThe RCA names a specific, evidence-backed root cause; an explicit numbered 5-Whys ladder is\nrendered (symptom → … → latent cause), not a single trigger\u002Flatent two-liner; trigger and latent\ncause are separated; every timeline entry is sourced; the section matches `zava-report-template`.\n","## Zava Learning — Root Cause Analysis\n\nProduce the analytical heart of the incident report: a defensible, evidence-backed RCA in the\nhouse format. Resource Group: `@@RG@@`. Services: `learner-portal`, `course-api`,\n`assessment-api`. Retrieve `zava-brand` and `zava-report-template` with `SearchMemory` and\nfollow the Root cause + Timeline sections of the template.\n\n## Gather evidence first (never assert without it)\n- **Timeline:** reconstruct detection → mitigation → durable fix from `GetActivityLogsSummary`,\n  `GetChangeHistory`, and the relevant App Insights \u002F Log Analytics queries\n  (`QueryAppInsightsByResourceId`, `QueryLogAnalyticsByResourceId`) filtered by the affected\n  `cloud_RoleName`. Every timeline row cites a source.\n- Align the symptom onset to the nearest config\u002Frevision\u002Fdeployment change.\n\n## Structure the RCA\n1. **What happened** — the symptom and customer impact in plain language (no cause in the title).\n2. **Timeline** — UTC table: time · event · evidence\u002Fsource.\n3. **5-Whys (MANDATORY, render the ladder)** — write an explicit, numbered Why-ladder, not a\n   one-line summary. Start from the student-visible symptom and ask \"why?\" repeatedly until you\n   reach the latent root cause — typically five steps:\n   - **Why 1:** students saw \u003Csymptom> → because \u003Cimmediate technical effect>\n   - **Why 2:** \u003Ceffect> → because \u003Cmisbehaving component\u002Fconfig>\n   - **Why 3:** \u003Ccomponent> misbehaved → because \u003Cthe change\u002Fstate that caused it>\n   - **Why 4:** that change happened → because \u003Chow it got introduced \u002F trigger>\n   - **Why 5 (latent root cause):** it was possible\u002Fundetected → because \u003Cmissing guardrail or gap>\n\n   Each rung cites its evidence. Then state the **trigger** (what set it off now) separately from\n   the **latent cause** (the condition that made it possible) — the latent cause is Why 5. Render\n   this ladder in the RCA section; never collapse it to a single trigger\u002Flatent two-liner.\n4. **Contributing factors** — gaps in detection, guardrails, or process that widened impact.\n5. **Why it was hard \u002F easy to detect** — informs the detective recommendations.\n\n## Presentation rules\n- Symptom-only headings; the root cause appears in the body, never in a title.\n- The 5-Whys ladder is ALWAYS rendered under a literal **`5 Whys`** heading (`### 5 Whys` \u002F\n  `\u003Ch3>5 Whys\u003C\u002Fh3>`) inside the Root Cause section, with five numbered rungs each on its own line\n  (`Why 1:` … `Why 5:`). A request-path Mermaid diagram may accompany it but never replaces it.\n- Distinguish facts (with evidence) from hypotheses (label clearly).\n- Keep it blameless: systems and conditions, not individuals.\n\n## Outputs\nThis skill produces, for the wider investigation: the **fault class** (connectivity\u002Fconfig\u002FRBAC vs.\nperformance\u002Favailability — so `evidence-before-after` picks the right visual), the confirmed\nbefore\u002Fafter time windows and affected metrics or config state (used by `evidence-before-after`),\nthe unresolved detection\u002Fguardrail gaps (used\nby `recommendations-next-steps`), and the finished RCA section (used by `zava-reporting`). Record\nthem clearly so the agent can use them in whichever skill it runs next.\n\n## Verification\nThe RCA names a specific, evidence-backed root cause; an explicit numbered 5-Whys ladder is\nrendered (symptom → … → latent cause), not a single trigger\u002Flatent two-liner; trigger and latent\ncause are separated; every timeline entry is sourced; the section matches `zava-report-template`.\n",{"name":5,"tools":44,"metadata":52,"description":7},[45,46,47,48,49,50,51],"SearchMemory","GetActivityLogsSummary","GetChangeHistory","QueryAppInsightsByResourceId","QueryLogAnalyticsByResourceId","RunAzCliReadCommands","ExecutePythonCode",{"kind":53,"api_version":54},"Skill","azuresre.ai\u002Fv2","main","f3dccc6bae8c932ff4f21e6d4117e14285da4db3","labs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Frca-analysis",198,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-11-10 10:20:55",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add microsoft\u002Fsre-agent --skill rca-analysis",{"tool":70,"command":71},"bunx","bunx skills add microsoft\u002Fsre-agent --skill rca-analysis",{"tool":73,"command":74},"pnpm","pnpm dlx skills add microsoft\u002Fsre-agent --skill rca-analysis","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Frca-analysis\u002FSKILL.md",true,[],[79,103,140,161,186,203],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":39},"01M699ZY06GBDPEYW1HEDRAVK8","zava-reporting","Use to package a completed Zava Learning incident analysis for the audience. First present a branded in-thread executive summary (markdown with the before\u002Fafter visuals inline), then produce the downloadable deliverables — a PowerPoint deck, an HTML email, and a Teams notification — using the Zava corporate template. The calling agent may narrow this to a subset (e.g. only the HTML report). Produces content and artifacts; it does not send them. Assembles the output of rca-analysis, evidence-before-after, recommendations-next-steps, and pr-delivery.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fzava-reporting\u002FSKILL.md",[],[86,87,20,88,89,90,21,91,92,93,94,95,96,97,98,99,31,30,100,101,102],"zava reporting","reporting","visuals","powerpoint","executive summary","markdown","html report","template","html","only","evidence","before-after","next","delivery","present","inline","send",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":122,"publishedAt":39},"01M699ZWCMAF3M8P4A8P0VXEF7","zava-audit-report","Use to package a completed Zava Learning weekly governance audit (NSG \u002F network security, RBAC \u002F least-privilege, or cloud cost) into a single branded, downloadable PowerPoint deck in the Zava house style. The calling audit agent passes its findings (a list of rows with severity) and a short posture summary; this skill renders the deck, applies redaction, and returns the attachment download link. Produces the artifact; it does not send it.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fzava-audit-report\u002FSKILL.md",[109,114,117],{"categoryNo":110,"categoryName":111,"taxonomyType":112,"taxonomyTypeDesc":113},"01JBSEEDCAT000000000000003","演示文稿","SCENARIO","使用场景",{"categoryNo":115,"categoryName":116,"taxonomyType":112,"taxonomyTypeDesc":113},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[123,124,125,126,127,128,129,89,130,131,132,35,133,134,135,136,137,138,102,139],"zava audit report","report","audit","audit report","security","network security","rbac","network","least-privilege","severity","returns","short","list","deck","artifact","weekly","single",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":39},"01M699ZV3DK2HK74MMKABQBNC7","servicenow-change-management","Use whenever a Zava Learning investigation produces a durable fix that needs change management — after a GitHub PR is opened for an Infrastructure-as-Code or application code root cause, raise a ServiceNow Change Request referencing the PR and attach the RCA report. The single owner of ServiceNow Change Request and attachment operations.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fservicenow-change-management\u002FSKILL.md",[],[147,148,149,150,151,152,20,153,154,155,35,156,33,157,158,159,160,24,139,22],"change","servicenow change management","servicenow","change management","management","github","pr","code","infrastructure-as-code","fix","attach","github pr","as","infrastructure-as",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":167,"publishedAt":39},"01M699ZSQAYXNM5YXH35GQXG2E","redaction-guard","Use whenever you are about to emit operator-visible content — a chat\u002Fthread message, a PagerDuty or ServiceNow note, a commit message or pull-request body, or any report artifact (HTML, PowerPoint, Teams card). Deterministically masks secrets, credentials, tokens, private keys, URI-embedded passwords, and PII so they never appear in the thread or in any deliverable. This is a cross-cutting guardrail invoked by the output-producing skills, not a runbook step.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Fredaction-guard\u002FSKILL.md",[],[168,169,170,171,172,173,174,175,176,33,177,178,179,180,181,182,26,183,184,185],"redaction guard","guard","redaction","commit","teams","commit message","pull","runbook","pii","never","pagerduty","chat","tokens","guardrail","card","you","passwords","thread",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":192,"publishedAt":39},"01M699ZRHD3XNYX412M7613ACM","recommendations-next-steps","Use to produce the forward-looking recommendations and next steps for a Zava Learning incident — prioritized preventive, detective, and process actions with owners, target dates, and the risk of inaction. Its output is used in the zava-reporting deliverables.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Frecommendations-next-steps\u002FSKILL.md",[],[193,98,30,194,195,9,196,38,197,198,87,199,35,200,33,31,26,201,25,24,202],"recommendations next steps","next steps","docs","learn","search","actions","risk","process","with","dates",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":209,"publishedAt":39},"01M699ZNT5B9DS72SBWEHFWX8C","rbac-audit","Use when an operator or a scheduled task requests a periodic RBAC \u002F least-privilege audit of the Zava Learning resource group — enumerate the real role assignments effective on the group, correlate each identity against actual Activity-Log usage to find standing access that is never used, flag over-privileged and directly-assigned (versus group-governed) identities and stale troubleshooting access, and recommend least-privilege corrections. Read-only; produces findings for a report.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fsre-agent\u002Fblob\u002Fmain\u002Flabs\u002Fzava-learning\u002Fsre-config\u002Fagent-config\u002Fskills\u002Frbac-audit\u002FSKILL.md",[],[210,129,125,195,9,211,196,197,35,212,213,33,177,95,214,215,216,217,218,219,220,24,221],"rbac audit","identity","access","find","periodic","log","task","read-only","usage","requests","scheduled","when"]