Azure Kusto Irql
Compose IRQL (Incident Response Query Language) queries for Kusto cybersecurity...
Install
npx skills add microsoft/skills --skill azure-kusto-irql -g -a claude-code -y- Repository
- microsoft/skills3.2k
- Category
- Security
- Updated
- 3d ago
- License
- MIT
- Context cost
- Mediumabout 2,489 tokens
- Runs scripts
- No, instructions only
What it does
Compose IRQL (Incident Response Query Language) queries for Kusto cybersecurity investigations. Translates natural language hunting questions into composable IRQL pipelines using Get_*, Extract_*, and Enrich_* functions. WHEN: IRQL query, security hunt, threat hunting KQL, incident response query, compose hunting pipeline, failed logins, phishing investigation, lateral movement, process execution, file creation events.
IRQL -- Incident Response Query Language
Compose IRQL function pipelines from selector, extractor, and enricher building blocks. IRQL wraps raw KQL security tables behind intent-revealing, composable functions so analysts (and LLMs) can express hunts without memorizing schemas, cluster locations, or join keys.
Activation Triggers
Use this skill when the user:
- Explicitly mentions IRQL,
Get_*,Extract_*, orEnrich_*functions - Says "use IRQL" or "write an IRQL query"
- Requests a composable hunting pipeline using known IRQL selectors
Do not activate for generic security queries (e.g. "find failed logins") unless the user explicitly asks for IRQL. Route those to azure-kusto instead.
Not a natural-language-to-IRQL converter. This skill composes IRQL function pipelines and may handle basic natural-language requests that map directly to known selectors and simple filters. For general NL-to-KQL or NL-to-IRQL conversion, use a dedicated query-generation skill (available separately).
IRQL Function Preflight
Before generating a pipeline, verify IRQL is available on the target database:
.show functions
| where Name startswith "Get_" or Name startswith "Extract_" or Name startswith "Enrich_"
| project Name
If no IRQL functions are found, inform the user that IRQL is not deployed on the target database and suggest using azure-kusto for raw KQL queries instead. IRQL functions are a prerequisite -- this skill does not deploy base IRQL selectors.
What IRQL Is
IRQL is a function-based dialect on top of KQL. It provides:
- Unified schema -- disparate security tables project into consistent column names regardless of the underlying data source
- Composability -- small functions chain via
| invoketo build complex hunts from simple steps - Portability -- the same IRQL pipeline works across different clusters/databases; only the
Get_*primitives need re-pointing
