skills.rest
microsoft
microsoftOFFICIAL
Explore all skills by this author →
Website𝕏@OpenAtMicrosoftGitHub

azure-kusto-irql

Compose IRQL function pipelines for Kusto cybersecurity threat hunting investigations.

3.0k|341|Updated Jan 16, 2026
Search Tags:#incident response#threat hunting#KQL#kusto#azure data explorer#security analytics#irql
One-click install
npx skills add https://github.com/microsoft/skills --skill azure-kusto-irql
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: azure-kusto-irql
Source: https://github.com/microsoft/skills/tree/main/.github/plugins/azure-kusto-graph-skills/skills/azure-kusto-irql
Command: npx skills add https://github.com/microsoft/skills --skill azure-kusto-irql

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Security analysts struggle to write KQL queries against unfamiliar schemas, cluster locations, and join keys during incident response. This Skill composes IRQL (Incident Response Query Language) pipelines from pre-deployed Get_, Extract_, and Enrich_* functions so hunts can be expressed without memorizing underlying table structures.

Core Features & Use Cases

  • Composable Hunting Pipelines: Chain selectors (Get_Event_Authentication, Get_Email), extractors (Extract_Email_Sender_Domain), and enrichers (Enrich_Username_Employee) via | invoke to build complex hunts from simple steps.
  • Unified Schema Abstraction: Query disparate security tables through consistent column names that remain portable across clusters and databases.
  • IRQL Availability Preflight: Verify IRQL functions exist on the target database before generating pipelines, with fallback guidance to raw KQL.
  • Use Case: Detect brute-force attacks by querying Get_Event_Authentication for failed logins, summarizing attempts per user, and enriching results with employee identity and role data.

Quick Start

Ask the agent to use IRQL to find users with more than 20 failed logins and show their job roles.

Frequently Asked Questions about azure-kusto-irql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write an IRQL query for threat hunting in Kusto?▼

Start with a Get_* selector like Get_Event_Authentication, pipe through Extract_* functions to derive fields, filter with where clauses, then invoke Enrich_* functions to attach context. Chain steps with the pipe operator and use `| invoke FunctionName()` for extractors and enrichers.

What is the difference between IRQL and raw KQL queries?▼

IRQL is a function-based dialect on top of KQL that wraps security tables behind composable Get_*, Extract_*, and Enrich_* functions with a unified schema. Raw KQL queries tables directly and requires knowing schemas and join keys; any valid KQL still works alongside IRQL functions.

Does IRQL work on any Azure Data Explorer cluster?▼

IRQL requires the Get_*, Extract_*, and Enrich_* functions to be pre-deployed as stored functions on the target database. Run `.show functions` filtered by those prefixes to verify availability; if absent, use raw KQL instead.

When should I use raw KQL instead of IRQL for security queries?▼

Use raw KQL when IRQL functions are not deployed on the target database or when you need general natural-language-to-KQL conversion. IRQL is intended for composable hunting pipelines using known selectors, not as a general NL-to-query converter.

Can IRQL enrich indicators with external threat intelligence?▼

Yes, IRQL includes Enrich_Sha256_VirusTotal for file reputation lookups and Get_CISA_KEV/Enrich_CISA_KEV for known exploited vulnerability data. These require an API key and a configured callout policy on the cluster.

Related Skills

Explore More Data & Analytics Skills→
databrickslabsdatabrickslabs
60

authenticate-source

Generate connector specifications, collect credentials, and validate data source authentication.

Official
Intermediate
FortemiFortemi
4

forensics-quickref

Map natural language queries to digital forensics and incident response frameworks.

Official
Advanced
audibleblinkaudibleblink
4

kql-mde-xdr

Write and optimize KQL queries for MDE, Sentinel, and Defender XDR.

Community
Advanced
microsoftmicrosoft
242

azure-kusto

Run KQL queries and analyze data in Azure Data Explorer.

Official
Advanced