SKILL

The provided text outlines a detailed workflow for creating a Markdown file from a KQL (Kusto Query Language) query. Here's a simplified summary:

1. Understand the Query: Examine the KQL query to determine its purpose, the tables it uses, and any specific operations or filters it applies.

2. Determine Query Type: Classify the query into categories like Detection, Threat Hunting, etc., based on its purpose.

3. File Naming and Location: Choose an appropriate file name and location in the repository, following existing naming conventions.

4. Verify Tables and Columns: Check the tables and columns used in the query against official Microsoft documentation to ensure they are valid.

5. Map to ATT&CK/ATLAS: If applicable, map the query to MITRE ATT&CK or ATLAS frameworks to identify related tactics or techniques.

6. Create Markdown File: Use a specific template to create a Markdown file that documents the query, including metadata like author, date, and version.

7. Include Metadata: Add information about the query's behavior, risk, data sources, and any relevant references or mappings.

8. Preserve Original Query: Include the original KQL query in the Markdown file without modifications.

9. Update ATT&CK Index: If the query is mapped to ATT&CK, update the repository's ATT&CK index with the new mapping.

10. Validate and Report: Ensure the new file is correctly formatted and all information is accurate. Report the file path and any assumptions made during the process.

The workflow emphasizes accuracy, adherence to existing conventions, and thorough documentation of the query and its context.