ingest-azure-activity-ocsf

Thin, single-purpose ingestion skill: raw Azure Activity Logs in -> canonical API activity projection -> OCSF 1.8 API Activity JSONL or native enriched API activity JSONL out. No detection logic, no Azure API calls, no side effects.

Wire contract

Azure Activity Logs are emitted by Azure Monitor in this shape (the JSON form delivered to Event Hubs, Storage Accounts, or Log Analytics):