From a2f9595dfcae114774e838fa6aa088651375b39e Mon Sep 17 00:00:00 2001 From: Michael Vanden Heuvel Date: Tue, 28 Jul 2026 09:41:21 -0700 Subject: [PATCH 1/2] Update ASIM skills for entity placeholders Require generated and reviewed parsers to emit empty entityKey, AdditionalIds, and additionalEntities fields until mappings are defined. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: f8c570d9-99f0-4316-af2d-d91b70cce8e4 --- .github/skills/asim-parser-create-parser/SKILL.md | 7 +++++++ .github/skills/asim-parser-pr-reviewer/SKILL.md | 3 +++ 2 files changed, 10 insertions(+) diff --git a/.github/skills/asim-parser-create-parser/SKILL.md b/.github/skills/asim-parser-create-parser/SKILL.md index a444b119aeb..ee4a59c6bdb 100644 --- a/.github/skills/asim-parser-create-parser/SKILL.md +++ b/.github/skills/asim-parser-create-parser/SKILL.md @@ -61,6 +61,13 @@ Parsers are KQL functions that follow a clear flow: **Filter → Parse → Map** ### Required columns - Include the column `Type` in the output of the ASIM parser. This column indicates the source table name. +- Include `entityKey`, `AdditionalIds`, and `additionalEntities` in the parser output. Until mappings for these fields are defined, set `entityKey` to an empty string and both `AdditionalIds` and `additionalEntities` to empty dynamic arrays: + + ```kusto + entityKey = "", + AdditionalIds = dynamic([]), + additionalEntities = dynamic([]) + ``` ### Required parameters diff --git a/.github/skills/asim-parser-pr-reviewer/SKILL.md b/.github/skills/asim-parser-pr-reviewer/SKILL.md index 070145b2165..20887ccec87 100644 --- a/.github/skills/asim-parser-pr-reviewer/SKILL.md +++ b/.github/skills/asim-parser-pr-reviewer/SKILL.md @@ -46,6 +46,8 @@ Review the parameter-less parser for the following: - **`pack` parameter**: If the query uses `AdditionalFields`, verify that a `pack: bool = false` parameter is included. This allows users to choose whether to populate `AdditionalFields` or return an empty dynamic, improving performance for users who do not need the extra information. +- **Placeholder entity fields**: Verify that the parser outputs `entityKey = ""`, `AdditionalIds = dynamic([])`, and `additionalEntities = dynamic([])`. These fields must remain empty until mappings for them are defined. + - **Parsing operator efficiency**: Check that high-performance parsing operators are used (`split`, `parse-kv`, `parse`) and that regular expressions are avoided where simpler operators would work. - **General KQL performance**: Flag any other inefficient patterns such as unnecessary `let` statements, redundant filters, expensive joins, or operations that could be reordered for better performance. @@ -81,6 +83,7 @@ Please review: 2. **Filter efficiency**: Are the parameter-based filters using native columns and indexed fields where possible? 3. **Redundant computation**: Are there any calculated fields or parsing operations that occur before the parameter filters, when they could be moved after? 4. **Parameter completeness**: Are the filtering parameters comprehensive enough to allow efficient querying for common use cases? +5. **Placeholder entity fields**: Does the parameterized parser preserve `entityKey = ""`, `AdditionalIds = dynamic([])`, and `additionalEntities = dynamic([])`? Flag this only when the fields are present in the parameter-less parser but missing or populated in the parameterized parser, so the same issue is not reported twice. **Output format:** From bcfa8bb9f4968e9d27235f73d89c87f312ef6dab Mon Sep 17 00:00:00 2001 From: Michael Vanden Heuvel Date: Wed, 29 Jul 2026 10:40:14 -0700 Subject: [PATCH 2/2] Make ASIM entity placeholders schema aware Derive role-specific entity placeholder fields from the target and Common schemas, preserve exact casing, and clarify review behavior across parser variants. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: f8c570d9-99f0-4316-af2d-d91b70cce8e4 --- .github/skills/asim-parser-create-parser/SKILL.md | 11 +++++++---- .github/skills/asim-parser-pr-reviewer/SKILL.md | 4 ++-- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/.github/skills/asim-parser-create-parser/SKILL.md b/.github/skills/asim-parser-create-parser/SKILL.md index ee4a59c6bdb..938e2bebdc2 100644 --- a/.github/skills/asim-parser-create-parser/SKILL.md +++ b/.github/skills/asim-parser-create-parser/SKILL.md @@ -61,12 +61,15 @@ Parsers are KQL functions that follow a clear flow: **Filter → Parse → Map** ### Required columns - Include the column `Type` in the output of the ASIM parser. This column indicates the source table name. -- Include `entityKey`, `AdditionalIds`, and `additionalEntities` in the parser output. Until mappings for these fields are defined, set `entityKey` to an empty string and both `AdditionalIds` and `additionalEntities` to empty dynamic arrays: +- Determine the placeholder entity fields applicable to the parser from the target schema and `Common` rows in `ASimTester.csv`. Include every defined column whose name ends in `EntityKey` or `AdditionalIds`, as well as `AdditionalEntities` when it is defined for the schema. +- Preserve the exact field names and casing from `ASimTester.csv`. Entity fields are role-specific (for example, `ActorUserEntityKey`, `SrcSystemEntityKey`, and `ActorUserAdditionalIds`); do not replace them with generic names such as `entityKey` or `AdditionalIds`. +- Until mappings for these fields are defined, set every `*EntityKey` field to an empty string and every `*AdditionalIds` field and `AdditionalEntities` to an empty dynamic array. For example: ```kusto - entityKey = "", - AdditionalIds = dynamic([]), - additionalEntities = dynamic([]) + ActorUserEntityKey = "", + SrcSystemEntityKey = "", + ActorUserAdditionalIds = dynamic([]), + AdditionalEntities = dynamic([]) ``` ### Required parameters diff --git a/.github/skills/asim-parser-pr-reviewer/SKILL.md b/.github/skills/asim-parser-pr-reviewer/SKILL.md index 20887ccec87..59dd5a15dfe 100644 --- a/.github/skills/asim-parser-pr-reviewer/SKILL.md +++ b/.github/skills/asim-parser-pr-reviewer/SKILL.md @@ -46,7 +46,7 @@ Review the parameter-less parser for the following: - **`pack` parameter**: If the query uses `AdditionalFields`, verify that a `pack: bool = false` parameter is included. This allows users to choose whether to populate `AdditionalFields` or return an empty dynamic, improving performance for users who do not need the extra information. -- **Placeholder entity fields**: Verify that the parser outputs `entityKey = ""`, `AdditionalIds = dynamic([])`, and `additionalEntities = dynamic([])`. These fields must remain empty until mappings for them are defined. +- **Placeholder entity fields**: Determine the complete set of applicable fields from the target schema and `Common` rows in `ASimTester.csv`. Verify that the parser includes every defined `*EntityKey` and `*AdditionalIds` field, plus `AdditionalEntities` when defined. Names and casing must exactly match `ASimTester.csv`; generic names such as `entityKey` or `AdditionalIds` are invalid. Every `*EntityKey` must be an empty string, and every `*AdditionalIds` field and `AdditionalEntities` must be an empty dynamic array until mappings are defined. - **Parsing operator efficiency**: Check that high-performance parsing operators are used (`split`, `parse-kv`, `parse`) and that regular expressions are avoided where simpler operators would work. @@ -83,7 +83,7 @@ Please review: 2. **Filter efficiency**: Are the parameter-based filters using native columns and indexed fields where possible? 3. **Redundant computation**: Are there any calculated fields or parsing operations that occur before the parameter filters, when they could be moved after? 4. **Parameter completeness**: Are the filtering parameters comprehensive enough to allow efficient querying for common use cases? -5. **Placeholder entity fields**: Does the parameterized parser preserve `entityKey = ""`, `AdditionalIds = dynamic([])`, and `additionalEntities = dynamic([])`? Flag this only when the fields are present in the parameter-less parser but missing or populated in the parameterized parser, so the same issue is not reported twice. +5. **Placeholder entity field consistency**: Compare the parameterized parser's placeholder fields and values with the parameter-less parser. Report fields missing from both parsers only in the parameter-less review above. In this section, report only differences introduced by the parameterized parser, such as a placeholder that is omitted, renamed, or populated when the parameter-less parser defines it correctly. Matching omissions are not acceptable; they are already reported in the parameter-less review. **Output format:**