Use whenever the user asks for a KQL query for Microsoft Sentinel, Log Analytics or Defender XDR Advanced Hunting — writing one, fixing one, modifying one, or explaining one — including requests that never say "KQL" (for example "query SigninLogs", "hunt for phishing URLs in Defender", "write a Sentinel detection").
Install
npx skills add microsoft/cat-agent-skills --skill kql-grounded-queriesnpx skills add microsoft/cat-agent-skills --skill kql-grounded-queries -a claude-code -gnpx skills add microsoft/cat-agent-skills --skill kql-grounded-queries -a codex -ggemini skills install https://github.com/microsoft/cat-agent-skills.git --path submissions/kql-grounded-queriesgh skill install microsoft/cat-agent-skills kql-grounded-queriesgit clone --depth 1 https://github.com/microsoft/cat-agent-skills /tmp/microsoft__cat-agent-skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/microsoft__cat-agent-skills/submissions/kql-grounded-queries ~/.claude/skills/kql-grounded-queries # Claude Code
cp -R /tmp/microsoft__cat-agent-skills/submissions/kql-grounded-queries ~/.agents/skills/kql-grounded-queries # Codex, Cursor, Gemini CLI, Copilot, OpenCode