Azure Kusto IRQL

by microsoft

Azure Kusto IRQL is a Data skill for Claude Code, published by microsoft in skills.

2.9K stars331 forkson microsoft/skillsAdded 2026/08/17+1% in starsRepository updated 2026/08/14

View source on GitHub Download repo ZIP

agent-skillsagentsazurefoundrymcpsdkskills

Install in seconds

Install Azure Kusto IRQL

Copy Azure Kusto IRQL into your Claude Code skills folder. Run the command in your terminal, or review the source on GitHub before installing.

terminal

npx degit https://github.com/microsoft/skills/tree/main/.github/plugins/azure-kusto-graph-skills/skills/azure-kusto-irql ~/.claude/skills/azure-kusto-irql

Requires Node.js. Downloads this skill only — not the rest of the repository — into your Claude Code skills folder.

Without Node.js

git clone https://github.com/microsoft/skills.git

Clones the whole repository, then copy the skill’s own directory into your skills folder yourself.

In this catalog

Source file: .github/plugins/azure-kusto-graph-skills/skills/azure-kusto-irql/SKILL.md in microsoft/skills
Installs to: ~/.claude/skills/azure-kusto-irql
Collection: One of 25 skills cataloged from this repository
Category: Data — 668 skills

What Azure Kusto IRQL does

Azure Kusto IRQL composes IRQL (Incident Response Query Language) function pipelines for Kusto cybersecurity investigations. Use it to translate hunting questions into composable Get_*, Extract_*, and Enrich_* queries for failed logins, phishing, lateral movement, and process/file events.

Azure Kusto IRQL is cataloged under Data on DirSkills. Azure Kusto IRQL comes from a repository tagged agent-skills, agents, azure, foundry and mcp.

Documentation

README

Excerpt

IRQL -- Incident Response Query Language

Compose IRQL function pipelines from selector, extractor, and enricher building blocks. IRQL wraps raw KQL security tables behind intent-revealing, composable functions so analysts (and LLMs) can express hunts without memorizing schemas, cluster locations, or join keys.

Activation Triggers

Use this skill when the user:

Explicitly mentions IRQL, Get_*, Extract_*, or Enrich_* functions
Says "use IRQL" or "write an IRQL query"
Requests a composable hunting pipeline using known IRQL selectors

Do not activate for generic security queries (e.g. "find failed logins") unless the user explicitly asks for IRQL. Route those to azure-kusto instead.

This is the opening of the README. Read the full README on GitHub.

Frequently asked about Azure Kusto IRQL

What else does microsoft publish alongside Azure Kusto IRQL?
Azure Kusto IRQL is one of 25 skills that DirSkills catalogs from microsoft/skills, the repository it ships in. Its siblings there include Application Insights Web, Azure AI Agents Persistent .NET and Azure AI Document Intelligence .NET. Each one is a separate skill with its own page in this directory, installs the same way Azure Kusto IRQL does, and is maintained by microsoft in that same repository. The rest of the collection is listed on the microsoft/skills page.
How does Azure Kusto IRQL compare to other Data skills?
Azure Kusto IRQL ranks #275 by stars among the 668 Data skills in this catalog. The most-starred ones next to it are Benchmark Methodology, Jupyter Notebook and Solana. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of Azure Kusto IRQL against them. Open each page to compare what they document and how they install.