Compose IRQL (Incident Response Query Language) queries for Kusto cybersecurity investigations. Translates natural language hunting questions into composable IRQL pipelines using Get_*, Extract_*, and Enrich_* functions. WHEN: IRQL query, security hunt, threat hunting KQL, incident response query, c

IRQL Incident Response Query Language Compose IRQL function pipelines from selector, extractor, and enricher building blocks. IRQL wraps raw KQL security tables behind intent revealing, composable functions so analysts (and LLMs) can express hunts without memorizing schemas, cluster locations, or join keys. Activation Triggers Use this skill when the user: Explicitly mentions IRQL, Get , Extract , or Enrich functions Says "use IRQL" or "write an IRQL query" Requests a composable hunting pipeline using known IRQL selectors Do not activate for generic security queries (e.g. "find failed logins") unless the user explicitly asks for IRQL. Route those to azure kusto instead. Not a natural language to IRQL converter. This skill composes IRQL function pipelines and may handle basic natural language requests that map directly to known selectors and simple filters. For general NL to KQL or NL to IRQL conversion, use a dedicated query generation skill (available separately). IRQL Function Preflight Before generating a pipeline, verify IRQL is available on the target database: If no IRQL functions are found, inform the user that IRQL is not deployed on the target database and suggest using azure kusto for raw KQL queries instead. IRQL functions are a prerequisite this skill does not deploy base IRQL selectors. What IRQL Is IRQL is a function based dialect on top of KQL . It provides: 1. Unified schema disparate security tables project into consistent column names regardless of the underlying data source 2. Composability small functions chain via invoke to build complex hunts from simple steps 3. Portability the same IRQL pipeline works across different clusters/databases; only the Get primitives need re pointing IRQL is not a separate language. It's KQL functions you invoke. Any valid KQL works alongside IRQL functions. Deploying IRQL IRQL functions are stored KQL functions ( .create or alter function ). They must already be deployed to the target database before this skill can generate pipelines. Public example cluster (functions pre deployed): Cluster: https://kc7001.eastus.kusto.windows.net Databases: ValdyTimes , JoJosHospital To port IRQL to a new cluster/database, create Get selectors that project your source tables into the unified schema (column names below), then deploy extractors and enrichers. The extractors and enrichers work unchanged as long as the input schema matches. Function Catalog 1. Selectors Get Return projected, schema unified views of source tables. Use the minimal form by default; use All when extra columns are needed. Function Columns Get Event Authentication EnvTime , Hostname , ClientIp , Username , Result Get Event Authentication All + Description , UserAgent , PasswordHash Get Email EnvTime , EmailSender , EmailRecipient , Subject , Url Get Email All + ReplyTo , Verdict Get Employees Name , ClientIp , Email , Username , Hostname , Role Get Employees All + HireDate , UserAgent , Domain Get Event FileCreation EnvTime , Hostname , Filename , Path Get Event FileCreation All + Username , Sha256 , ProcessName Get Event NetworkInbound EnvTime , ClientIp , Url Get Event NetworkInbound All + Method , UserAgent , StatusCode Get Event NetworkOutbound EnvTime , ClientIp , Url Get Event NetworkOutbound All + Method , UserAgent Get Dns All EnvTime , Domain , ClientIp Get Event Process EnvTime , ProcessCommandLine , ProcessName , Hostname , Username Get Event Process All + ParentProcessName , ParentProcessHash , ProcessHash Get SecurityAlerts All EnvTime , AlertType , Severity , Description , Indicators Get Network Connection All EnvTime , SourceIp , SourcePort , DestinationIp , DestinationPort , Protocol , Bytes 2. Extractors Extract Derive a new column from an existing one. Invoke after a selector. Function Input Column Adds Extract Email Sender Domain(T) EmailSender Domain Extract Employee Firstname(T) Name Firstname Extract Event Network Domain(T) Url DomainName 3. Enrichers Enrich Left join helpers that attach context from a related table. Function Key Column Enriches With Enrich Event Authentication Username(T) Username Auth events for user Enrich Ip Employee(T) ClientIp Employee identity from IP Enrich Username Employee(T) Username Employee identity from username Enrich Ip Domain(T) ClientIp DNS domains resolved to IP Enrich Ip Event NetworkOutbound(T) ClientIp Outbound network from IP Enrich Ip Network Connection(T) ClientIp Network flows from IP 4. External Enrichment Function Source Requirement Enrich Sha256 VirusTotal(T) VirusTotal file report API key + callout policy Get CISA KEV() / Enrich CISA KEV(T) CISA KEV catalog Callout policy Composition Rules 1. Start with a Selector : Get Event Authentication , Get Email , etc. 2. Extract derived fields: invoke Extract Email Sender Domain() 3. Filter to the signal: where Result == "Failed Login" 4. Enrich with context: invoke Enrich Username Employee() 5. Summarize / project the answer Always pipe ( ) between steps. Extractors and Enrichers use invoke FunctionName() . Query Generation Guidelines Use the minimal selector unless extra columns are needed then All Chain extractors before enrichers (extractors add columns enrichers may key on) Place where filters as early as possible Use summarize for aggregations, project for final column selection End with order by + take to limit output Examples For additional prompts and worked examples, see [references/EXAMPLES.md](references/EXAMPLES.md). Brute force detection Phishing triage by recipient seniority Post exploitation pivot from an indicator Suspicious outbound traffic enriched with identity External IP authentication anomaly MCP Tools Used Tool Purpose kusto query Execute IRQL pipelines against a Kusto database kusto table schema get Discover available tables and columns kusto cluster list List available ADX clusters kusto database list List databases in a cluster Opening Queries in Kusto Explorer (Windows Only) Optional convenience feature. The default workflow is to output the KQL in chat and let the user copy it into Kusto Explorer or the VS Code Kusto extension manually. Auto launch is opt in only. Always output the complete KQL query in the chat response with Step 1 (connect) and Step 2 (query) clearly labeled: If the user asks to save or open in Kusto Explorer, follow the procedure in [references/KUSTO EXPLORER LAUNCH.md](references/KUSTO EXPLORER LAUNCH.md). Key rules: Use ask user to confirm before writing files or launching executables Display file contents in chat so the user can review before opening Never use shell interpolation or here strings — write files via Set Content / Add Content Never encode queries into browser URLs On macOS/Linux, save the .kql file and suggest the VS Code Kusto extension or ADX Web Explorer For graph visualization from IRQL data, see azure kusto graph and azure kusto irql graph

azure-kusto-irql