Use this skill when asked to write, create, or help with KQL (Kusto Query Language) queries for Microsoft Sentinel, Defender XDR, or Azure Data Explorer. Triggers on keywords like "write KQL", "create KQL query", "help with KQL", "query [table]", "KQL for [scenario]", or when a user requests queries for specific data analysis scenarios.
Install
npx skills add SCStelz/security-investigator --skill kql-query-authoringnpx skills add SCStelz/security-investigator --skill kql-query-authoring -a claude-code -gnpx skills add SCStelz/security-investigator --skill kql-query-authoring -a codex -ggemini skills install https://github.com/SCStelz/security-investigator.git --path .github/skills/kql-query-authoringgh skill install SCStelz/security-investigator kql-query-authoringgit clone --depth 1 https://github.com/SCStelz/security-investigator /tmp/SCStelz__security-investigator
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/SCStelz__security-investigator/.github/skills/kql-query-authoring ~/.claude/skills/kql-query-authoring # Claude Code
cp -R /tmp/SCStelz__security-investigator/.github/skills/kql-query-authoring ~/.agents/skills/kql-query-authoring # Codex, Cursor, Gemini CLI, Copilot, OpenCode