Name: azure-kusto-irql
Rating: 73.6 (1 reviews)
Author: microsoft

azure-kusto-irql

Compose IRQL (Incident Response Query Language) queries for Kusto cybersecurity investigations. Translates natural language hunting questions into composable IRQL pipelines using Get_*, Extract_*, and Enrich_* functions. WHEN: IRQL query, security hunt, threat hunting KQL, incident response query, compose hunting pipeline, failed logins, phishing investigation, lateral movement, process execution, file creation events.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

The canonical home for this skill is azure-kusto-irql in microsoft/GitHub-Copilot-for-Azure

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable skill body with concrete KQL pipelines, a complete function catalog, and sensible progressive disclosure to two real reference files. The lower-scoring dimensions are conciseness (minor motivational prose) and workflow clarity (no explicit error-recovery loop).

Suggestions

Trim the "What IRQL Is" benefits framing to a one-line definition; the unified-schema/composability/portability bullets can be folded into the Composition Rules section so every line drives query generation.

Add a short feedback-loop note in Composition Rules for the empty/failed-pipeline case (e.g., re-run .show functions preflight, verify the selector column exists, then retry) to give the workflow an explicit validation→fix→retry cycle.

Dimension	Reasoning	Score
Conciseness	The body is largely lean and assumes competence, but the "What IRQL Is" benefits prose ("intent-revealing, composable functions so analysts (and LLMs) can express hunts without memorizing schemas") and the unified-schema/composability/portability bullets read as slightly padded justification that could be trimmed.	4 / 5
Actionability	Fully executable, copy-paste-ready KQL examples (brute-force, phishing triage, post-exploitation pivot, outbound traffic, external-IP anomaly) plus a concrete preflight query, a complete function catalog with exact columns, and an MCP tools table cover the common cases.	5 / 5
Workflow Clarity	A clear ordered sequence (preflight → Selector → Extract → Filter → Enrich → Summarize/Project) with the IRQL-availability preflight as an explicit checkpoint, but there is no documented error-recovery/feedback loop for when a pipeline returns empty or a function is missing.	4 / 5
Progressive Disclosure	Well-signaled one-level-deep references to real files ([references/EXAMPLES.md] and [references/KUSTO_EXPLORER_LAUNCH.md]) keep worked examples and the platform-specific launch procedure off the main page while the core function catalog stays appropriately inline.	5 / 5
	Total	18 / 20 Passed

Description

95%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that cleanly separates what the skill does from when to invoke it, using a dedicated WHEN clause rich in natural trigger terms. The only minor weakness is mild redundancy between the two action verbs, which slightly limits the specificity ceiling.

Dimension	Reasoning	Score
Specificity	"Compose IRQL queries" and "Translates natural language hunting questions into composable IRQL pipelines using Get_, Extract_, and Enrich_* functions" name concrete actions and the function families, but the two verbs largely restate the same capability, leaving minor coverage gaps versus a fully comprehensive action list.	4 / 5
Completeness	It explicitly answers both what ("Compose IRQL… pipelines using Get_, Extract_, and Enrich_* functions") and when ("WHEN: IRQL query, security hunt…") with concrete trigger phrases.	5 / 5
Trigger Term Quality	The WHEN clause supplies comprehensive natural terms and synonyms an analyst would actually say — "IRQL query", "security hunt", "threat hunting KQL", "failed logins", "phishing investigation", "lateral movement", "process execution", "file creation events".	5 / 5
Distinctiveness Conflict Risk	"IRQL" with the Get_/Extract_/Enrich_ function vocabulary is a clear niche with distinct triggers unlikely to fire for the sibling azure-kusto skill; voice is correctly third person ("Compose", "Translates").	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: microsoft/azure-skills
Path: .github/plugins/azure-kusto-graph-skills/skills/azure-kusto-irql/SKILL.md
Commit: 9d46511

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.