# Azure Kusto Irql

Compose IRQL (Incident Response Query Language) queries for Kusto cybersecurity...

- Repository: https://github.com/microsoft/skills (3164 stars)
- Category: Security
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add microsoft/skills --skill azure-kusto-irql -g -a claude-code -y`
Codex: `npx skills add microsoft/skills --skill azure-kusto-irql -g -a codex -y`
Cursor: `npx skills add microsoft/skills --skill azure-kusto-irql -g -a cursor -y`
Gemini CLI: `npx skills add microsoft/skills --skill azure-kusto-irql -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add microsoft/skills`

## Description

Compose IRQL (Incident Response Query Language) queries for Kusto cybersecurity investigations. Translates natural language hunting questions into composable IRQL pipelines using Get_*, Extract_*, and Enrich_* functions. WHEN: IRQL query, security hunt, threat hunting KQL, incident response query, compose hunting pipeline, failed logins, phishing investigation, lateral movement, process execution, file creation events.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# IRQL -- Incident Response Query Language

Compose IRQL function pipelines from selector, extractor, and enricher building blocks. IRQL wraps raw KQL security tables behind intent-revealing, composable functions so analysts (and LLMs) can express hunts without memorizing schemas, cluster locations, or join keys.

## Activation Triggers

Use this skill when the user:
- Explicitly mentions IRQL, `Get_*`, `Extract_*`, or `Enrich_*` functions
- Says "use IRQL" or "write an IRQL query"
- Requests a composable hunting pipeline using known IRQL selectors

Do **not** activate for generic security queries (e.g. "find failed logins") unless the user explicitly asks for IRQL. Route those to `azure-kusto` instead.

**Not a natural-language-to-IRQL converter.** This skill composes IRQL function pipelines and may handle basic natural-language requests that map directly to known selectors and simple filters. For general NL-to-KQL or NL-to-IRQL conversion, use a dedicated query-generation skill (available separately).

## IRQL Function Preflight

Before generating a pipeline, verify IRQL is available on the target database:

```kql
.show functions
| where Name startswith "Get_" or Name startswith "Extract_" or Name startswith "Enrich_"
| project Name
```

If no IRQL functions are found, inform the user that IRQL is not deployed on the target database and suggest using `azure-kusto` for raw KQL queries instead. IRQL functions are a prerequisite -- this skill does not deploy base IRQL selectors.

## What IRQL Is

IRQL is a **function-based dialect on top of KQL**. It provides:

1. **Unified schema** -- disparate security tables project into consistent column names regardless of the underlying data source
2. **Composability** -- small functions chain via `| invoke` to build complex hunts from simple steps
3. **Portability** -- the same IRQL pipeline works across different clusters/databases; only the `Get_*` primitives need re-pointing

The rest: https://github.com/microsoft/skills/blob/HEAD/.github/plugins/azure-kusto-graph-skills/skills/azure-kusto-irql/SKILL.md