Compose IRQL Hunt Pipelines with azure-kusto-irql

Where this fits

A security analyst has just confirmed a phishing email and wants to check whether the attachment launched a process on any Windows workstations. They know the investigation should look for file creation and process execution, but the Kusto schema, cluster locations, and join keys are not at their fingertips. The azure-kusto-irql skill lets an AI agent translate that hunting question directly into a composable IRQL pipeline using Get_*, Extract_*, and Enrich_* functions, so the analyst can spend time on the investigation, not on query syntax.

Why agents benefit

• Translates natural-language hunting questions like "which accounts had failed logins before the phishing click" into a starting IRQL selector without guessing table names.
• Hides Kusto cluster and schema details behind intent-revealing functions, so the agent can compose pipelines that are readable and auditable.
• Each Get_* event set can be chained by Extract_* and Enrich_*, making multi-step hunts easier for the agent to build and debug.
• Reduces hallucinated field names by using known IRQL building blocks, especially when the user explicitly says "use IRQL."
• Fits standard incident response flows: authentication failures, file creation, process execution, and lateral movement all follow the same composable pattern.

Practical scenarios

Failed logins and account compromise

When an alert fires for brute-force attempts, the agent can call Get_FailedLogins() to pull the raw events, Extract_Accounts() to isolate the target accounts, and Enrich_AccountDetails() to identify privileged users. This gives the incident response team a focused list to check for password reset or token revocation.

Phishing investigation with file creation

A malicious document is suspected. The agent can start with Get_FileCreationEvents() in the time window around the email click, then pipe to Extract_FilePaths() and Enrich_ProcessInfo() to see whether the dropped file executed. This turns a vague "check what happened" request into a concrete IRQL pipeline.

Lateral movement through process execution

To trace movement from an infected host, the agent can use Get_ProcessExecution() with a remote command pattern, then Extract_UserAccounts() and Enrich_DeviceInfo() to map which hosts and accounts were involved. The composable structure makes the investigation reproducible and easier to document.

Add it to your agent workflow

Install the skill with:

npx skills add microsoft/GitHub-Copilot-for-Azure --skill azure-kusto-irql

Then ask your agent: "Use IRQL to find failed logins in the last 24 hours, then enrich the accounts." The agent can produce:

Get_FailedLogins()
| Extract_Accounts()
| Enrich_AccountDetails()

The skill activates when you mention IRQL or ask for a composable hunting pipeline. For generic security questions, include "use IRQL" to make the intent explicit.

Compare before adopting

Before using this skill, compare it with writing raw KQL in your agent prompt or using a different Kusto skill. Look at maintenance freshness: the README version is still a placeholder, so check recent commits and issue responses. Verify that the Get_*, Extract_*, and Enrich_* functions match the Kusto tables you actually use in your environment. Also consider workflow fit: if your agent already uses Microsoft's GitHub Copilot for Azure, this skill is a natural extension; otherwise, confirm the function names align with your IRQL setup.

Why it is worth tracking

The skill is authored by Microsoft and has 248 stars, which is a decent early signal for a security-focused agent skill. More important is momentum: IRQL is designed for LLM-driven incident response, and a composable query language reduces the risk of speculative KQL. Track this skill if you run Kusto-based security hunts and want a faster, more repeatable way for agents to compose investigations. For a snapshot of its metadata and quality signals, see this skill's page on OpenAgentSkill: https://www.openagentskill.com/skills/microsoft-azure-kusto-irql