azure-kusto-irql
azure-kusto-irql is an agent skill published by microsoft, listed under deploy & operate. It lives in the microsoft/skills repository, which has 3,148 GitHub stars and is licensed under MIT; we last read it on 2026-09-16.
This tool composes IRQL queries for Kusto cybersecurity investigations, translating natural language hunting questions into composable IRQL pipelines using Get_*, Extract_*, and Enrich_* functions.
Install
skills is a generic installer for any repository of Claude agent skills -- it reads microsoft/skills’s own structure rather than assuming one, the same way this page reads the skill’s own SKILL.md rather than assuming a format.
npx skills add microsoft/skills
Maintenance
Compose IRQL (Incident Response Query Language) queries for Kusto cybersecurity investigations. Translates natural language hunting questions into composable IRQL pipelines using Get_*, Extract_*, and Enrich_* functions. WHEN: IRQL query, security hunt, threat hunting KQL, incident response query, compose hunting pipeline, failed logins, phishing investigation, lateral movement, process execution, file creation events.
azure-kusto-irql compared with similar skills
| Skill | Publisher | What it does | Repo stars | Last update |
|---|---|---|---|---|
| azure-kusto-irql (this page) | microsoft | Compose IRQL (Incident Response Query Language) queries for Kusto cybersecurity investigations. Translates na… | 3,148 | 2026-10-25 |
| azure-ai-anomalydetector-java(same repository) | microsoft | Build anomaly detection applications with Azure AI Anomaly Detector SDK for Java. Use when implementing univa… | 3,148 | 2026-10-25 |
| azure-enterprise-infra-planner(same repository) | microsoft | Architect and provision enterprise Azure infrastructure from workload descriptions. For cloud architects and… | 3,148 | 2026-10-25 |
| azure-kubernetes-app-deploy(same repository) | microsoft | Use when deploying an existing web application or API to an already-running Azure Kubernetes Service cluster.… | 3,148 | 2026-10-25 |
| azure-local(same repository) | microsoft | Plan, deploy, operate, and troubleshoot Azure Local (formerly Azure Stack HCI): sizing and prerequisites, Arc… | 3,148 | 2026-10-25 |
| azure-mgmt-arizeaiobservabilityeval-dotnet(same repository) | microsoft | Azure Resource Manager SDK for Arize AI Observability and Evaluation (.NET). Use when managing Arize AI organ… | 3,148 | 2026-10-25 |
| azure-prepare(same repository) | microsoft | Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and… | 3,148 | 2026-10-25 |
Skills from the same repository first, then others for this job by repository stars. Figures are from each repository when we last read it.
Common questions about azure-kusto-irql
- What does azure-kusto-irql do?
- This tool composes IRQL queries for Kusto cybersecurity investigations, translating natural language hunting questions into composable IRQL pipelines using Get_*, Extract_*, and Enrich_* functions.
- How do I install azure-kusto-irql?
- Run npx skills add microsoft/skills. The skills installer reads the repository’s own structure, so it works for any repository of agent skills.
- Who publishes azure-kusto-irql?
- microsoft.
- Is azure-kusto-irql maintained, and what licence does it use?
- Its repository has 3,148 GitHub stars and its state in our directory is listed. Its last commit we recorded was on 2026-10-25. The repository declares the MIT licence.
More agent skills for deploy & operate
- ai-content-pipelineby 101-skills
- explainer-video-guideby 101-skills
- ci-cd-and-automationby addyosmani
- observability-and-instrumentationby addyosmani
- internal-commsby anthropic
- xlsxby anthropic