microsoft/rca-analysis
labs/zava-learning/sre-config/agent-config/skills/rca-analysis/SKILL.md
Use to produce the root-cause analysis narrative for a resolved or mitigated Zava Learning incident — the incident timeline, the trigger vs. latent root cause (5-Whys), contributing factors, and how to present them. Defines the RCA section format; its output is used in the before/after, recommendations, and reporting deliverables.
$ install --global
skillsauthnpx skillsauth add microsoft/sre-agent rca-analysisInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 23, 2026, 7:53 AM90.1s1 file scanned
SKILL.md
- api_version:
- azuresre.ai/v2
- kind:
- Skill
- name:
- rca-analysis
- description:
- Use to produce the root-cause analysis narrative for a resolved or mitigated Zava Learning incident — the incident timeline, the trigger vs. latent root cause (5-Whys), contributing factors, and how to present them. Defines the RCA section format; its output is used in the before/after, recommendations, and reporting deliverables.
Zava Learning — Root Cause Analysis
Produce the analytical heart of the incident report: a defensible, evidence-backed RCA in the
house format. Resource Group: @@RG@@. Services: learner-portal, course-api,
assessment-api. Retrieve zava-brand and zava-report-template with SearchMemory and
follow the Root cause + Timeline sections of the template.
Gather evidence first (never assert without it)
- Timeline: reconstruct detection → mitigation → durable fix from
GetActivityLogsSummary,GetChangeHistory, and the relevant App Insights / Log Analytics queries (QueryAppInsightsByResourceId,QueryLogAnalyticsByResourceId) filtered by the affectedcloud_RoleName. Every timeline row cites a source. - Align the symptom onset to the nearest config/revision/deployment change.
Structure the RCA
-
What happened — the symptom and customer impact in plain language (no cause in the title).
-
Timeline — UTC table: time · event · evidence/source.
-
5-Whys (MANDATORY, render the ladder) — write an explicit, numbered Why-ladder, not a one-line summary. Start from the student-visible symptom and ask "why?" repeatedly until you reach the latent root cause — typically five steps:
- Why 1: students saw <symptom> → because <immediate technical effect>
- Why 2: <effect> → because <misbehaving component/config>
- Why 3: <component> misbehaved → because <the change/state that caused it>
- Why 4: that change happened → because <how it got introduced / trigger>
- Why 5 (latent root cause): it was possible/undetected → because <missing guardrail or gap>
Each rung cites its evidence. Then state the trigger (what set it off now) separately from the latent cause (the condition that made it possible) — the latent cause is Why 5. Render this ladder in the RCA section; never collapse it to a single trigger/latent two-liner.
-
Contributing factors — gaps in detection, guardrails, or process that widened impact.
-
Why it was hard / easy to detect — informs the detective recommendations.
Presentation rules
- Symptom-only headings; the root cause appears in the body, never in a title.
- The 5-Whys ladder is ALWAYS rendered under a literal
5 Whysheading (### 5 Whys/<h3>5 Whys</h3>) inside the Root Cause section, with five numbered rungs each on its own line (Why 1:…Why 5:). A request-path Mermaid diagram may accompany it but never replaces it. - Distinguish facts (with evidence) from hypotheses (label clearly).
- Keep it blameless: systems and conditions, not individuals.
Outputs
This skill produces, for the wider investigation: the fault class (connectivity/config/RBAC vs.
performance/availability — so evidence-before-after picks the right visual), the confirmed
before/after time windows and affected metrics or config state (used by evidence-before-after),
the unresolved detection/guardrail gaps (used
by recommendations-next-steps), and the finished RCA section (used by zava-reporting). Record
them clearly so the agent can use them in whichever skill it runs next.
Verification
The RCA names a specific, evidence-backed root cause; an explicit numbered 5-Whys ladder is
rendered (symptom → … → latent cause), not a single trigger/latent two-liner; trigger and latent
cause are separated; every timeline entry is sourced; the section matches zava-report-template.
Related Skills
microsoft/zava-reporting
development
VerifiedTrustedCommunity
Use to package a completed Zava Learning incident analysis for the audience. First present a branded in-thread executive summary (markdown with the before/after visuals inline), then produce the downloadable deliverables — a PowerPoint deck, an HTML email, and a Teams notification — using the Zava corporate template. The calling agent may narrow this to a subset (e.g. only the HTML report). Produces content and artifacts; it does not send them. Assembles the output of rca-analysis, evidence-before-after, recommendations-next-steps, and pr-delivery.
123SKILL.mdUpdated Jun 23, 2026
microsoft/zava-audit-report
development
VerifiedTrustedCommunity
Use to package a completed Zava Learning weekly governance audit (NSG / network security, RBAC / least-privilege, or cloud cost) into a single branded, downloadable PowerPoint deck in the Zava house style. The calling audit agent passes its findings (a list of rows with severity) and a short posture summary; this skill renders the deck, applies redaction, and returns the attachment download link. Produces the artifact; it does not send it.
123SKILL.mdUpdated Jun 23, 2026
microsoft/servicenow-change-management
development
VerifiedTrustedCommunity
Use whenever a Zava Learning investigation produces a durable fix that needs change management — after a GitHub PR is opened for an Infrastructure-as-Code or application code root cause, raise a ServiceNow Change Request referencing the PR and attach the RCA report. The single owner of ServiceNow Change Request and attachment operations.
123SKILL.mdUpdated Jun 23, 2026
microsoft/redaction-guard
development
VerifiedTrustedCommunity
Use whenever you are about to emit operator-visible content — a chat/thread message, a PagerDuty or ServiceNow note, a commit message or pull-request body, or any report artifact (HTML, PowerPoint, Teams card). Deterministically masks secrets, credentials, tokens, private keys, URI-embedded passwords, and PII so they never appear in the thread or in any deliverable. This is a cross-cutting guardrail invoked by the output-producing skills, not a runbook step.
123SKILL.mdUpdated Jun 23, 2026