Agent skill · microsoft
azure-kusto-irql
Compose IRQL (Incident Response Query Language) queries for Kusto cybersecurity investigations. Translates natural language hunting questions into composable IRQL pipelines using Get_*, Extract_*, and Enrich_* functions. WHEN: IRQL query, security hunt, threat hunting KQL, incident response query, compose hunting pipeline, failed logins, phishing investigation, lateral movement, process execution, file creation events.
What it needs
About 6k tokens when loaded.
What this skill does
IRQL -- Incident Response Query Language Compose IRQL function pipelines from selector, extractor, and enricher building blocks. IRQL wraps raw KQL security tables behind intent-revealing, composable functions so analysts (and LLMs) can express hunts without memorizing schemas, cluster locations, or join keys. Activation Triggers Use this skill when the user: Explicitly mentions IRQL, Get, Extract, or Enrich functions Says "use IRQL" or "write an IRQL query" Requests a composable hunting pipeline using known IRQL selectors Do not activate for generic security queries (e.g. "find failed logins") unless the user explicitly asks for IRQL. Route those to azure-kusto instead. Not a natural-language-to-IRQL converter. This skill composes IRQL function pipelines and may handle basic natural-language requests that map directly to known selectors and simple filters. For general NL-to-KQL or NL-to-IRQL conversion, use a dedicated query-generation skill (available separately). IRQL Function Preflight Before generating a pipeline, verify IRQL is available on the target database: If no IRQL functions are found, inform the user that IRQL is not deployed on the target database and suggest using azure-kusto for raw KQL queries instead. IRQL functions are a prerequisite -- this skill does not deploy base IRQL selectors. What IRQL Is IRQL is a function-based dialect on top of KQL. It provides: 1. Unified schema -- disparate security tables project into consistent column names regardless of the underlying data source 2. Composability -- small functions chain via invoke to build complex hunts from simple steps 3. Portability -- the same IRQL pipeline works across different clusters/databases; only the Get primitives need re-pointing IRQL is not a separate language. It's KQL functions you invoke. Any valid KQL works alongside IRQL functions. Deploying IRQL IRQL functions are stored KQL functions (.create-or-alter function). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills microsoft/azure-kusto-irql