Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →microsoft/azure-kusto-irql
Compose IRQL (Incident Response Query Language) queries for Kusto cybersecurity investigations. Translates natural language hunting questions into composable IRQL pipelines using Get_*, Extract_*, and Enrich_* functions. WHEN: IRQL query, security hunt, threat hunting KQL, incident response query, compose hunting pipeline, failed logins, phishing investigation, lateral movement, process execution, file creation events.
Passed 19 of 22 test cases with the skill, and 4 of 22 without it.
and 23 more in the full report
16 fixed4 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 15 test cases the skill fixed. Same model, same prompt, with and without the skill.
If an analyst explicitly asks to save and automatically launch an IRQL KQL file in Kusto Explorer on Windows, what authorization step must be performed before executing local file creation commands?
| Checked | Without skill | With skill |
|---|---|---|
| The assistant specifies asking for user confirmation using ask_user before creating local files or launching executables. | Missed | Passed |
| The assistant specifies displaying the file contents in chat prior to opening. | Passed | Passed |
The instructions your model reads when the skill loads.
Compose IRQL function pipelines from selector, extractor, and enricher building blocks. IRQL wraps raw KQL security tables behind intent-revealing, composable functions so analysts (and LLMs) can express hunts without memorizing schemas, cluster locations, or join keys.
Use this skill when the user:
Get_*, Extract_*, or Enrich_* functionsDo not activate for generic security queries (e.g. "find failed logins") unless the user explicitly asks for IRQL. Route those to azure-kusto instead.
Not a natural-language-to-IRQL converter. This skill composes IRQL function pipelines and may handle basic natural-language requests that map directly to known selectors and simple filters. For general NL-to-KQL or NL-to-IRQL conversion, use a dedicated query-generation skill (available separately).
Before generating a pipeline, verify IRQL is available on the target database:
.show functions
| where Name startswith "Get_" or Name startswith "Extract_" or Name startswith "Enrich_"
| project Name
If no IRQL functions are found, inform the user that IRQL is not deployed on the target database and suggest using azure-kusto for raw KQL queries instead. IRQL functions are a prerequisite -- this skill does not deploy base IRQL selectors.
IRQL is a function-based dialect on top of KQL. It provides:
| invoke to build complex hunts from simple stepsGet_* primitives need re-pointingIRQL is not a separate language. It's KQL functions you invoke. Any valid KQL works alongside IRQL functions.
IRQL functions are stored KQL functions (.create-or-alter function). They must already be deployed to the target database before this skill can generate pipelines.
test cases passed, vs 4 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.