Compose IRQL (Incident Response Query Language) queries for Kusto cybersecurity investigations. Translates natural language hunting questions into composable IRQL pipelines using Get_*, Extract_*, and Enrich_* functions.
Install
npx skills add microsoft/GitHub-Copilot-for-Azure --skill azure-kusto-irqlnpx skills add microsoft/GitHub-Copilot-for-Azure --skill azure-kusto-irql -a claude-code -gnpx skills add microsoft/GitHub-Copilot-for-Azure --skill azure-kusto-irql -a codex -ggemini skills install https://github.com/microsoft/GitHub-Copilot-for-Azure.git --path plugins/azure-kusto-graph-skills/skills/azure-kusto-irqlgh skill install microsoft/GitHub-Copilot-for-Azure azure-kusto-irqlgit clone --depth 1 https://github.com/microsoft/GitHub-Copilot-for-Azure /tmp/microsoft__GitHub-Copilot-for-Azure
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/microsoft__GitHub-Copilot-for-Azure/plugins/azure-kusto-graph-skills/skills/azure-kusto-irql ~/.claude/skills/azure-kusto-irql # Claude Code
cp -R /tmp/microsoft__GitHub-Copilot-for-Azure/plugins/azure-kusto-graph-skills/skills/azure-kusto-irql ~/.agents/skills/azure-kusto-irql # Codex, Cursor, Gemini CLI, Copilot, OpenCode