microsoft/connectivity-triage
labs/zava-learning/sre-config/agent-config/skills/connectivity-triage/SKILL.md
Use for any Zava Learning incident where students cannot reach the platform or actions fail at the network/edge layer — quiz launches failing, portal 5xx, requests timing out, or backends appearing unhealthy. Traces the full request path (Application Gateway -> NSG -> Container Apps internal load balancer -> APIs) from telemetry and Azure config, finds the broken hop, and remediates within the permitted-action boundary.
$ install --global
skillsauthnpx skillsauth add microsoft/sre-agent connectivity-triageInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 23, 2026, 7:52 AM13.7s1 file scanned
SKILL.md
- api_version:
- azuresre.ai/v2
- kind:
- Skill
- name:
- connectivity-triage
- description:
- Use for any Zava Learning incident where students cannot reach the platform or actions fail at the network/edge layer — quiz launches failing, portal 5xx, requests timing out, or backends appearing unhealthy. Traces the full request path (Application Gateway -> NSG -> Container Apps internal load balancer -> APIs) from telemetry and Azure config, finds the broken hop, and remediates within the permitted-action boundary.
Zava Learning — Connectivity / Edge Incident Runbook
Resource Group: @@RG@@. Public entry: Application Gateway -> learner-portal (Container App,
internal ingress) -> course-api / assessment-api (environment-internal). App Insights
cloud_RoleName values: learner-portal, course-api, assessment-api.
Diagnose root cause from telemetry and configuration, then remediate within the boundary below. Do NOT guess the cause from the alert name — the alert is symptom-only by design.
Trace the path, hop by hop
- Application Gateway — backend health (
az network application-gateway show-backend-health), probe path/host, HTTP settings. A probe pointed at a path the portal doesn't serve marks the backend unhealthy and yields 502s. - NSG on the Container Apps subnet — list effective rules. A higher-priority DENY can beat a lower-priority ALLOW (priority inversion) and silently block App Gateway -> apps.
- Container Apps internal load balancer / ingress — revision health, replica counts.
- APIs — are
course-api/assessment-apianswering and healthy?
Use the built-in network troubleshooting skills (network_connectivity_troubleshoot,
application_gateway_troubleshoot, load_balancer_troubleshoot, network_topology_mapper) to go deep
on any hop. Filter App Insights/LAW queries by the relevant cloud_RoleName.
Permitted autonomous actions
- Neutralize a blocking NSG rule with a non-destructive update, not a delete: run
az network nsg rule update ... --access Allow(or raise the DENY rule's--priorityabove the ALLOW). The write tool restrictsdelete/remove, and anupdateachieves the same effect — so never reach foraz network nsg rule delete. - Correct an Application Gateway probe path / HTTP settings back to a healthy configuration.
- Restart a Container Apps revision.
Azure CLI usage (avoid avoidable command failures)
- Do not pass
-o/--outputor--querytoRunAzCliReadCommands. The read tool already returns JSON — adding-o json,-o table, or a--queryprojection makes the command fail with a generic "Unknown error occurred." Run the plain command (e.g.az network nsg rule list --nsg-name ... --include-default) and pick out the fields you need from the JSON in your reasoning. - If any read still returns "Unknown error occurred," just retry the plain command once — the first tool call in a session can fail transiently. Do not conclude the resource is broken.
- Always pass
--subscriptionand prefer resource IDs to avoid ambiguity. ConsultGetAzCliHelpbefore an unfamiliar write flag rather than guessing syntax.
Incident communication (PagerDuty)
Record the request-path diagram and your diagnostic notes for the incident record. PagerDuty
acknowledgement, status/summary notes, and resolution are owned by the pagerduty-incident-update
skill.
Code & change management
- For an Infrastructure-as-Code root cause, the infra lives under
infra/in@@REPO@@(the NSG is defined ininfra/modules/network.bicep). After the live mitigation, the durable fix is delivered as a GitHub pull request by thepr-deliveryskill and recorded as a Change Request byservicenow-change-management.
Out of scope (require human approval)
- VNet address-space changes, subnet deletion, IAM modifications, App Gateway SKU/tier changes.
Verification
Re-check the hop you changed, confirm the public endpoint returns 200 on / and /api/quiz/*, and
confirm the alert auto-mitigated.
Related Skills
microsoft/zava-reporting
development
VerifiedTrustedCommunity
Use to package a completed Zava Learning incident analysis for the audience. First present a branded in-thread executive summary (markdown with the before/after visuals inline), then produce the downloadable deliverables — a PowerPoint deck, an HTML email, and a Teams notification — using the Zava corporate template. The calling agent may narrow this to a subset (e.g. only the HTML report). Produces content and artifacts; it does not send them. Assembles the output of rca-analysis, evidence-before-after, recommendations-next-steps, and pr-delivery.
123SKILL.mdUpdated Jun 23, 2026
microsoft/zava-audit-report
development
VerifiedTrustedCommunity
Use to package a completed Zava Learning weekly governance audit (NSG / network security, RBAC / least-privilege, or cloud cost) into a single branded, downloadable PowerPoint deck in the Zava house style. The calling audit agent passes its findings (a list of rows with severity) and a short posture summary; this skill renders the deck, applies redaction, and returns the attachment download link. Produces the artifact; it does not send it.
123SKILL.mdUpdated Jun 23, 2026
microsoft/servicenow-change-management
development
VerifiedTrustedCommunity
Use whenever a Zava Learning investigation produces a durable fix that needs change management — after a GitHub PR is opened for an Infrastructure-as-Code or application code root cause, raise a ServiceNow Change Request referencing the PR and attach the RCA report. The single owner of ServiceNow Change Request and attachment operations.
123SKILL.mdUpdated Jun 23, 2026
microsoft/redaction-guard
development
VerifiedTrustedCommunity
Use whenever you are about to emit operator-visible content — a chat/thread message, a PagerDuty or ServiceNow note, a commit message or pull-request body, or any report artifact (HTML, PowerPoint, Teams card). Deterministically masks secrets, credentials, tokens, private keys, URI-embedded passwords, and PII so they never appear in the thread or in any deliverable. This is a cross-cutting guardrail invoked by the output-producing skills, not a runbook step.
123SKILL.mdUpdated Jun 23, 2026