microsoft/evidence-before-after
labs/zava-learning/sre-config/agent-config/skills/evidence-before-after/SKILL.md
Use to build the before-and-after visual evidence for a Zava Learning incident. First classify the fault, then render the ONE visual that actually explains what changed — a before/after path or topology diagram for connectivity/config/RBAC faults, or time-series comparison charts for performance/availability faults — plus a state/metric delta table. Never plot a metric that does not tell the story. Its output is used in the RCA and the zava-reporting deliverables.
$ install --global
skillsauthnpx skillsauth add microsoft/sre-agent evidence-before-afterInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 23, 2026, 7:53 AM87.7s1 file scanned
SKILL.md
- api_version:
- azuresre.ai/v2
- kind:
- Skill
- name:
- evidence-before-after
- description:
- Use to build the before-and-after visual evidence for a Zava Learning incident. First classify the fault, then render the ONE visual that actually explains what changed — a before/after path or topology diagram for connectivity/config/RBAC faults, or time-series comparison charts for performance/availability faults — plus a state/metric delta table. Never plot a metric that does not tell the story. Its output is used in the RCA and the zava-reporting deliverables.
Zava Learning — Before / After Evidence
Prove impact and recovery with the right visual for the fault — not a chart by reflex. Resource
Group: @@RG@@. Services: learner-portal, course-api, assessment-api. Retrieve zava-brand
and zava-report-template with SearchMemory and apply the house style. Use the windows and
root cause confirmed by rca-analysis.
Step 1 — Decide the visual FIRST (do not skip)
Classify what actually changed, then pick the visual that explains that. Plotting a smooth metric for a binary/config fault (e.g. "availability before/after" for an NSG block) is misleading and adds no insight — don't do it.
| Fault class | What changed | Primary visual | Secondary (only if telemetry shows it) | |---|---|---|---| | Connectivity / config / NSG / App Gateway probe / RBAC | a path or permission was closed → open (binary) | before→after path/topology diagram (ASCII or Mermaid) + a config-state delta table | one short recovery curve (e.g. 502-rate → 0) | | Performance / latency / saturation | a metric degraded → recovered (gradual) | time-series before/during/after + percentile delta table | before-vs-after summary bars | | Availability / reliability (5xx, restarts, replica loss) | error/health rate rose → fell | time-series + delta table | summary bars |
If a fault has both a binary cause and a metric symptom (common), lead with the diagram that explains the cause and use one metric chart only as supporting recovery proof.
Step 2 — Capture the before/after STATE (config & binary faults)
For connectivity/config/RBAC faults, the evidence is the changed configuration, not a metric:
-
Read the relevant config with
RunAzCliReadCommands(e.g. NSG effective rules, App Gateway backend health, Container Apps revision/ingress, role assignments) at the mitigated state, and reconstruct the pre-fix state fromrca-analysis/ change history. -
Build a state delta table:
item · before · after · effect, e.g.NSG rule block-appgw (prio 100 DENY) · present · removed · AppGW→apps unblocked;AppGW backend health · Unhealthy · Healthy · probes pass;GET /api/quiz · 502 · 200. -
Render a before→after path diagram showing the broken hop and the fixed hop. Author it as ASCII (preferred for chat/PagerDuty notes) and/or a Mermaid graph; for a polished report image use
ExecutePythonCode(graphviz/matplotlib). Example shape:BEFORE (blocked) AFTER (fixed) AppGW ──► NSG subnet ──► [apis] AppGW ──► NSG subnet ──► [apis] │ DENY-100 ✗ │ (rule removed) ✓ backend: UNHEALTHY (502) backend: HEALTHY (200)
Step 3 — Pull metrics (performance/availability faults, or as recovery proof)
Only when a metric genuinely tells the story. Define three windows — Before (healthy baseline),
During (detection→mitigation), After (post-fix, long enough to be credible) — using the
exact windows from rca-analysis. Per affected service pull the metric matching the symptom:
- Availability / HTTP 5xx / success rate (
QueryAppInsightsByResourceId). - Latency — for the latency scenario,
ms=<duration>from assessment-api console logs viaQueryLogAnalyticsByResourceId; report p50/p95/p99. - Replica count / restarts / throughput (
ListAvailableMetrics,GetMetricTimeSeriesElementsForAzureResource).
Render brand-colored: before series in Critical red, after in Zava Teal, target/baseline as a
dashed Slate line, every series labeled; annotate mitigation and fix points.
PlotAreaChartWithCorrelation / PlotScatter for the series, PlotBarChart for before-vs-after
bars. Use ExecutePythonCode (matplotlib) only for a comparison the Plot* tools can't express.
Rules
- One headline visual that explains the cause; supporting visuals only if the data backs them.
- Never plot a metric that doesn't change shape across the fault, or fabricate a trend to fill a slide.
- Same units, axes, and aggregation before vs. after — no misleading scales.
- Don't claim recovery a number doesn't support; if the after-window is too short, say so.
Verification
The visual matches the fault class: a before/after diagram + state delta table for config/binary
faults, or a before/after chart + metric delta table for performance/availability faults — all from
real config/telemetry over clearly stated windows, ready for rca-analysis and zava-reporting.
Related Skills
microsoft/zava-reporting
development
VerifiedTrustedCommunity
Use to package a completed Zava Learning incident analysis for the audience. First present a branded in-thread executive summary (markdown with the before/after visuals inline), then produce the downloadable deliverables — a PowerPoint deck, an HTML email, and a Teams notification — using the Zava corporate template. The calling agent may narrow this to a subset (e.g. only the HTML report). Produces content and artifacts; it does not send them. Assembles the output of rca-analysis, evidence-before-after, recommendations-next-steps, and pr-delivery.
123SKILL.mdUpdated Jun 23, 2026
microsoft/zava-audit-report
development
VerifiedTrustedCommunity
Use to package a completed Zava Learning weekly governance audit (NSG / network security, RBAC / least-privilege, or cloud cost) into a single branded, downloadable PowerPoint deck in the Zava house style. The calling audit agent passes its findings (a list of rows with severity) and a short posture summary; this skill renders the deck, applies redaction, and returns the attachment download link. Produces the artifact; it does not send it.
123SKILL.mdUpdated Jun 23, 2026
microsoft/servicenow-change-management
development
VerifiedTrustedCommunity
Use whenever a Zava Learning investigation produces a durable fix that needs change management — after a GitHub PR is opened for an Infrastructure-as-Code or application code root cause, raise a ServiceNow Change Request referencing the PR and attach the RCA report. The single owner of ServiceNow Change Request and attachment operations.
123SKILL.mdUpdated Jun 23, 2026
microsoft/redaction-guard
development
VerifiedTrustedCommunity
Use whenever you are about to emit operator-visible content — a chat/thread message, a PagerDuty or ServiceNow note, a commit message or pull-request body, or any report artifact (HTML, PowerPoint, Teams card). Deterministically masks secrets, credentials, tokens, private keys, URI-embedded passwords, and PII so they never appear in the thread or in any deliverable. This is a cross-cutting guardrail invoked by the output-producing skills, not a runbook step.
123SKILL.mdUpdated Jun 23, 2026