skills.rest
microsoft
microsoftOFFICIAL
Explore all skills by this author →
Website𝕏@OpenAtMicrosoftGitHub

azure-kusto-irql-graph

Generate Lift_To_Graph mappings and IRQL graph pipelines for Kusto Explorer visualization.

3.0k|341|Updated Jan 16, 2026
Search Tags:#graph visualization#KQL#kusto#azure data explorer#irql#lift_to_graph#kusto explorer
One-click install
npx skills add https://github.com/microsoft/skills --skill azure-kusto-irql-graph
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: azure-kusto-irql-graph
Source: https://github.com/microsoft/skills/tree/main/.github/plugins/azure-kusto-graph-skills/skills/azure-kusto-irql-graph
Command: npx skills add https://github.com/microsoft/skills --skill azure-kusto-irql-graph

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Turning existing KQL or IRQL query results into interactive graph visualizations in Kusto Explorer requires hand-writing complex Lift_To_Graph mapping JSON and composing stored graph functions correctly, which is error-prone and slow.

Core Features & Use Cases

  • Mapping Generation: Converts a supplied KQL/IRQL query's output columns plus a natural-language graph description into a valid Lift_To_Graph mapping JSON with node types, edges, icons, and properties.
  • Pipeline Composition: Builds complete pipelines chaining Lift_To_Graph, optional Extract_Node_/Enrich_Node_/Enrich_Graph_* functions, Graph_Fold_By_Property, and Graph_Render_View.
  • Function Preflight & Deployment: Verifies required stored functions with .show functions and provides .create-or-alter definitions for missing ones.
  • Use Case: Given Get_Event_Authentication_All | where Result == "Failed Login" | take 200, produce a graph of IPs, auth events, users, and hosts folded by result, rendered in Kusto Explorer.

Quick Start

Ask the agent to take your KQL query results and create an icon-decorated graph visualization with Lift_To_Graph and Graph_Render_View.

Frequently Asked Questions about azure-kusto-irql-graph

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I visualize KQL query results as a graph in Kusto Explorer?▼

Supply your working KQL query plus a description of the desired nodes and edges. The skill generates a Lift_To_Graph mapping JSON and appends Graph_Render_View, which calls make-graph to open Kusto Explorer's graph window.

What is the difference between Lift_To_Graph and make-graph in Kusto?▼

Lift_To_Graph is a stored function that transforms tabular rows into node and edge entities using a JSON mapping, while make-graph is the native Kusto operator that builds the graph structure. This skill covers Lift_To_Graph pipelines; native make-graph, graph-match, and shortest-path analysis belong to the azure-kusto-graph skill.

Can this skill convert natural language directly into KQL queries?▼

No, it is not a natural-language-to-KQL or NL-to-IRQL converter. It expects a working query as input and only supports trivial single-table or single-selector source requests; use a dedicated query-generation skill for non-trivial query authoring.

Why does my Lift_To_Graph pipeline fail with a missing function error?▼

Lift_To_Graph, Graph_Render_View, and Graph_Fold_By_Property are stored functions, not built-in operators, and may not exist on your database. Run .show functions to check, then deploy missing definitions using the .create-or-alter commands in references/DEPLOY_IRQL_FUNCTIONS.md.

Can I open generated KQL graph queries in Kusto Explorer automatically?▼

Yes, on Windows only, and only after explicit user confirmation. The skill saves a .kql file with a #connect line and the query, then launches Kusto Explorer; on macOS or Linux it suggests the VS Code Kusto extension or ADX Web Explorer instead.

Related Skills

Explore More Data & Analytics Skills→
anishi1222anishi1222

azure-kusto

Execute KQL queries and manage clusters in Azure Data Explorer.

Community
Advanced
backbay-labsbackbay-labs
285

Threat Hunt

Automate security event investigation and threat hunting workflows.

Official
Advanced
Lin-HiLin-Hi
1

networkx

Create, analyze, and visualize graphs using NetworkX APIs in Python.

Community
Intermediate
ricablericable
1

@ruvector/graph-node

Create and query RuVector graph databases with Cypher from Node.js.

Community
Advanced