azure-kusto-irql

Topics in the source

• IRQL -- Incident Response Query Language
• Activation Triggers
• IRQL Function Preflight
• What IRQL Is
• Deploying IRQL
• Function Catalog
• 1. Selectors -- Get
• 2. Extractors -- Extract

Compose IRQL function pipelines from selector, extractor, and enricher building blocks. IRQL wraps raw KQL security tables behind intent-revealing, composable functions so analysts (and LLMs) can express hunts without memorizing schemas, cluster locations, or join keys. Use this skill when the user: Explicitly mentions IRQL, Get, Extract, or Enrich functions Says "use IRQL" or "write an IRQL query" Requests a composable hunting pipeline using known IRQL selectors Do not activate for generic security queries (e.g. "find failed logins") unless the user explicitly asks for IRQL. Route those to azure-kusto instead. Not a natural-language-to-IRQL converter. This skill composes IRQL function pipelines and may handle basic natural-language requests that map directly to known selectors and simple filters. For general NL-to-KQL or NL-to-IRQL conversion, use a dedicated query-generation skill (available separately). Before generating a pipeline, verify IRQL is available on the target database: If no IRQL functions are found, inform the user that IRQL is not deployed on the target database and suggest using azure-kusto for raw KQL queries instead. IRQL functions are a prerequisite -- this ski

This is an excerpt. Refer to the complete source and its current requirements.