azure-kusto-irql

Compose IRQL (Incident Response Query Language) queries for Kusto cybersecurity investigations. Translates natural language hunting questions into composable IRQL pipelines using Get_*, Extract_*, and Enrich_* functions. WHEN: IRQL query, security hunt, threat hunting KQL, incident response query, compose hunting pipeline, failed logins, phishing investigation, lateral movement, process execution, file creation events.

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A high-quality, actionable skill body with executable examples, a clear function catalog, and clean progressive disclosure. The main gap is the absence of an explicit validate/fix/retry loop for query execution errors.

Suggestions

Add a brief feedback-loop step for query failures (e.g., on a schema or syntax error, re-run the preflight/schema check and revise) to raise workflow clarity.

Trim the 'What IRQL Is' rationale and the repeated Step 1/Step 2 connect-query boilerplate to tighten conciseness.

Consider moving the full function catalog tables into a references file, keeping only the most-used selectors/extractors/enrichers inline.

Dimension	Reasoning	Score
Conciseness	Mostly lean and well-organized with tables and executable examples that assume Claude's competence; a few rationale sections and repeated connect-query boilerplate could be trimmed slightly.	4 / 5
Actionability	Provides fully executable, copy-paste ready KQL throughout — a preflight query, a full function catalog, composition rules, and five complete worked examples covering common hunting cases.	5 / 5
Workflow Clarity	Clear sequenced workflow (preflight -> selector -> extract -> filter -> enrich -> summarize) with a preflight validation checkpoint, though an explicit query-error recovery feedback loop is absent.	4 / 5
Progressive Disclosure	SKILL.md is a clear overview with well-signaled, one-level-deep references to real bundle files (EXAMPLES.md and KUSTO_EXPLORER_LAUNCH.md, both verified present), with detailed material appropriately split out.	5 / 5
	Total	18 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states capabilities and provides explicit, natural trigger terms with a dedicated WHEN clause. Minor room to broaden capability coverage and add a few more synonym triggers.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions ('Compose IRQL queries', 'Translates natural language hunting questions into composable IRQL pipelines using Get_, Extract_, and Enrich_* functions') with named function families, but stops short of comprehensive coverage of all capabilities.	4 / 5
Completeness	Explicitly answers both 'what' (compose/translate IRQL pipelines) and 'when' via a dedicated 'WHEN:' clause listing concrete trigger phrases.	5 / 5
Trigger Term Quality	Includes a broad set of natural trigger phrases ('IRQL query, security hunt, threat hunting KQL, incident response query, failed logins, phishing investigation, lateral movement') with synonyms, though a few common variations are absent.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (IRQL on Kusto for cybersecurity) with distinct triggers and minimal conflict risk, reinforced by explicit routing guidance away from generic azure-kusto queries.	5 / 5
	Total	18 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: microsoft/GitHub-Copilot-for-Azure
Path: plugins/azure-kusto-graph-skills/skills/azure-kusto-irql/SKILL.md
Commit: a55fe6d

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.