Apply IRQL graph functions to KQL or IRQL query results for Kusto Explorer visualization. Generates Lift_To_Graph mappings and composes Graph_Render_View, Graph_Fold_By_Property, Extract_Node_*, Enrich_Node_*, and Enrich_Graph_* calls. Accepts a supplied query or limited basic natural-language sourc

IRQL Graph Functions Query Results to Visualization Apply the IRQL graph function family to tabular results. Given a KQL or IRQL query and the user's graph description, generate a Lift To Graph mapping and compose only the stored graph functions needed to visualize, fold, extract, or enrich the graph in Kusto Explorer. The source query does not need to use IRQL. Scope and Routing Request Use Turn supplied KQL/IRQL rows into an icon decorated visual graph This skill: Lift To Graph + Graph Render View Fold nodes or apply Extract Node , Enrich Node , or Enrich Graph This skill Use make graph , graph match , shortest paths, connected components, graph models, or snapshots azure kusto graph Author a non trivial KQL/IRQL investigation from natural language A Kusto or IRQL query generation skill, then this skill If a request mixes visualization and native graph analysis, use this skill for the lift/render portion and azure kusto graph for operator semantics. Do not replace graph lift functions with a hand built edges first graph unless the user asks for native graph operators. Input Contract Preferred input : a working KQL/IRQL query that produces tabular results, plus a natural language description of the desired nodes, edges, labels, icons, extracts, enrichments, or folds. This skill is not a natural language to KQL or NL to IRQL converter . It transforms existing query results into graph visualizations. For general NL to KQL or NL to IRQL conversion, use a dedicated query generation skill (available separately). Preserve the supplied query's retrieval, joins, filters, and aggregations. Add only projections or synthetic IDs required by the graph mapping. A basic natural language source request is supported only when it maps directly to one known table or IRQL Get selector with obvious columns and simple filters. State the assumed source, and do not invent joins, schema, or investigation logic. For non trivial query construction, use a separate Kusto/IRQL query generation skill first, then apply this skill to its output. If no query or output schema is available and the source is not trivial, request the KQL query or its result columns before generating a mapping. Activation Triggers Use this skill when the user: Supplies KQL/IRQL results and asks for an IRQL graph visualization or mapping Mentions Lift To Graph , Graph Render View , or Graph Fold By Property Asks for icon decorated node/edge mappings in Kusto Explorer Wants to fold/collapse nodes by a shared property Requests graph extraction or enrichment through Extract Node , Enrich Node , or Enrich Graph Do not activate this skill solely for graph match , graph paths/components, persistent graphs, or generic make graph construction; those belong to azure kusto graph . Not a natural language to KQL/IRQL converter. The input should generally be a working KQL or IRQL query whose results need graph visualization. Basic NL source requests work only for trivial single table/selector cases. For general NL to KQL or NL to IRQL, use a dedicated query generation skill (available separately). Environment Cluster : https://kc7001.eastus.kusto.windows.net Databases : ValdyTimes , JoJosHospital (graph functions pre deployed) Rendering : Kusto Explorer desktop app (make graph visualization window) Tool : kusto query (via Azure MCP Server) Function Preflight Lift To Graph and Graph Render View are stored functions, not built in Kusto operators. Before generating or running a lift pipeline against a target database, check what is deployed: Lift To Graph and Graph Render View are required. Graph Fold By Property is required only when folding is requested. Check any Extract Node , Enrich Node , or Enrich Graph function before using it; omit optional enrichment when unavailable unless the user wants it deployed. If a required function is missing and you have permission to alter the database, ask the user for confirmation before deploying . Then use the .create or alter function definitions in [references/DEPLOY IRQL FUNCTIONS.md](references/DEPLOY IRQL FUNCTIONS.md). Run the relevant .create or alter block, then rerun the preflight check to confirm. If you do not have alter permissions, tell the user which functions are missing and point them to references/DEPLOY IRQL FUNCTIONS.md for manual deployment. IRQL Graph Function Family Lift To Graph(T, mappingJson) Transforms any tabular KQL result into a unified node + edge table. Input : Any table T + a JSON mapping string. Output : Rows with EntityType = "node" or "edge" , ready for make graph . Graph Render View(T) Takes Lift To Graph output, splits nodes/edges, and calls make graph to open Kusto Explorer's graph window. Graph Fold By Property(T, NodeType, PropertyName) Collapses nodes of a given type sharing a property value into a single node. Rewires edges automatically. Graph Extraction and Enrichment Functions These are additional stored functions that must already be deployed on the target database. They are not bundled in references/DEPLOY IRQL FUNCTIONS.md . Use .show functions to verify availability before including in a pipeline. Function Operation Key Property Extract Node Email Sender Domain(T, displayName) Adds Domain to node props EmailSender Extract Node Employee Firstname(T, displayName) Adds Firstname to node props Name Extract Node Event Network Domain(T, displayName) Adds DomainName to node props Url Enrich Node Ip Employee(T, displayName) Adds employee info to IP nodes ClientIp Enrich Node Username Employee(T, displayName) Adds employee info to user nodes Username Enrich Node Event Authentication Username(T, displayName) Adds auth context Username Enrich Node Ip Domain(T, displayName) Adds DNS domains ClientIp Enrich Node Ip Event NetworkOutbound(T, displayName) Adds outbound events ClientIp Enrich Graph Ip Employee(T, mappingJson) Expands graph with employee nodes ClientIp Enrich Graph Username Employee(T, mappingJson) Expands graph with employee nodes Username Enrich Graph Event Authentication Username(T, mappingJson) Expands with auth nodes Username Mapping JSON Schema The JSON mapping has two arrays: node types and edges . node types[] Field Required Description type Yes Node type label (e.g. "User" , "Host" , "IP" ) id Yes Prefix for node ID; usually same as type key Yes Column name whose value becomes the node's identity props Yes Array of columns to carry as node properties defaults No Object of fallback values for null/empty properties defIcon No Default icon URL for this node type displayName No Column to use for display label (defaults to id ) color No Column to source color from size No Column to source size from edges[] Field Required Description type Yes Edge type label (e.g. "AuthenticatesTo" , "SentEmail" ) source Yes {"id": "<prefix ", "type": "<NodeType "} target Yes {"id": "<prefix ", "type": "<NodeType "} props No Array of columns to carry as edge properties displayName No Column for edge label color No Column for edge color Icon Repository Use icons from https://raw.githubusercontent.com/benc uk/icon collection/master/azure icons/ : IP: Public IP Addresses (Classic).svg Host/VM: Virtual Machine.svg User: Users.svg Email: Mailbox.svg (or azure cds/command 1070 Mail.svg ) Process: App Services.svg File: Storage Accounts.svg Alert: Activity Log.svg Domain: DNS Zones.svg Mapping Generation Rules Given the supplied query columns and the user's graph description, generate the mapping JSON by: 1. Identify entities each distinct noun becomes a node type 2. Identify relationships each verb/preposition becomes an edge 3. Map to columns use actual columns produced by the supplied query; never assume unavailable columns 4. Set direction source is the actor, target is the acted upon 5. Add properties include columns relevant to investigation (timestamps, results, hashes) 6. Assign icons pick from the icon set above based on entity type Column Reference (IRQL unified schema) Entity Key Column Available Props User Username Username , Name , Role , Email Host Hostname Hostname IP ClientIp ClientIp Email Message Subject EnvTime , Subject , Verdict , Url Sender EmailSender EmailSender , Domain Recipient EmailRecipient EmailRecipient Process ProcessName EnvTime , ProcessName , ProcessCommandLine , ProcessHash File Filename EnvTime , Filename , Path , Sha256 Domain DomainName DomainName Auth Event (synthetic ID) EnvTime , UserAgent , Result , Description Function Selection 1. Start with the supplied KQL/IRQL tabular pipeline. 2. Use Lift To Graph(mapping) to create graph entities. 3. Add Extract Node , Enrich Node , or Enrich Graph only when requested and compatible with the mapped keys. 4. Add Graph Fold By Property() only when grouping/collapse is requested. 5. End visual output with Graph Render View() . 6. Preflight the exact stored functions selected for the pipeline. Pipeline Pattern Examples For additional prompts and worked examples, see [references/EXAMPLES.md](references/EXAMPLES.md). Authentication graph: IP AuthEvent User Host Input query : Get Event Authentication All where Result == "Failed Login" take 200 Graph request : "Show IPs, authentication events, users, and hosts; fold events by result." Email graph: Sender Message Recipient Input query : Get Email All take 400 Graph request : "Visualize sender to message to recipient flow and fold messages by verdict." Suspicious domain investigation (end to end) Basic source request : "Use outbound network events for these suspicious domains and graph IP to domain connections enriched with employee names." This is the limited fallback: one known selector, one extractor, and one direct filter. Process execution graph: User Process ParentProcess Input query : Get Event Process All where ProcessCommandLine has "powershell" take 300 Graph request : "Visualize process, parent process, host, and user relationships." Query Results Mapping Translation When the user supplies a query and describes the graph: 1. Inspect the query's final output columns 2. Parse the entity nouns and relationship verbs 3. Generate the mapping JSON using only those columns 4. Preserve the supplied pipeline and append Lift To Graph() 5. Include Graph Render View() at the end 6. If the user mentions grouping/collapsing and the function exists, add Graph Fold By Property() Output the complete KQL the supplied query plus mapping JSON inline as a string let binding after the required function preflight passes. Clearly mark unverified function dependencies when the target database cannot be checked. Opening Queries in Kusto Explorer (Windows Only) Optional convenience feature. The default workflow is to output the KQL in chat and let the user copy it into Kusto Explorer or the VS Code Kusto extension manually. Auto launch is opt in only. Always output the complete KQL query in the chat response with Step 1 (connect) and Step 2 (query) clearly labeled: If the user asks to save or open in Kusto Explorer, follow the procedure in [references/KUSTO EXPLORER LAUNCH.md](references/KUSTO EXPLORER LAUNCH.md). Key rules: Use ask user to confirm before writing files

azure-kusto-irql-graph