Add Windows event knowledge resources: sigma://events/windows and sigma://events/windows/{channel}/{event_id}

[Copilot]

LLMs writing Sigma rules for Windows log sources had no structured access to Windows event documentation, limiting their ability to reason about specific event fields and channels.

New resources

• sigma://events/windows — Fetches the GitHub directory listing from duckxing/windows-itpro-docs/windows/keep-secure, then fetches each event-{id}.md and parses its YAML front matter + embedded event XML. Returns a sorted list of:

  [
    {
      "event_id": "4624",
      "title": "4624(S) An account was successfully logged on. (Windows 10)",
      "description": "Describes security event 4624(S) ...",
      "channel": "security",
      "resource_url": "sigma://events/windows/security/4624"
    }
  ]

• sigma://events/windows/{channel}/{event_id} — Returns the full Markdown documentation for a specific event (description, XML schema, field meanings, security monitoring recommendations). The channel segment is cosmetic/organisational and maps to the Sigma service field; lookup is by event_id alone. Both resources share the same _spec_cache, so the overview pre-warms detail lookups.

New internals

• _parse_win_event_front_matter(markdown) — extracts YAML front matter key/value pairs (title, description, ms.pagetype, etc.)
• _extract_win_event_channel(markdown) — finds <Channel>…</Channel> in the embedded event XML and returns it lower-cased
• Constants _WIN_EVENTS_BASE_URL / _WIN_EVENTS_INDEX_URL for the upstream raw content and GitHub API endpoints

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/duckxing/windows-itpro-docs/contents/windows/keep-secure
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

I like to add the Windows log source event descriptions as knowledge resources: https://github.com/duckxing/windows-itpro-docs/tree/master/windows/keep-secure, e.g. this for Windows Security event 4624: https://raw.githubusercontent.com/duckxing/windows-itpro-docs/refs/heads/master/windows/keep-secure/event-4624.md

My idea is to provide a knowledge resources sigma://events/windows// with the detailed descriptions and a general overview about the log sources with mappings of channel names and IDs to their short description from the metadata of the resources mentioned above to enable the LLMs to gain more knowledge about specific events and create more precise results.

The user has attached the following file paths as relevant context:

• .github\copilot-instructions.md

Created from VS Code.