Skip to content
mcp/skillhub

Agent Skill

Azure Kusto Irql Graph skill

azure-kusto-irql-graphmicrosoft/skills.github/plugins/azure-kusto-graph-skills/skills/azure-kusto-irql-graph/SKILL.md

Apply IRQL graph functions to KQL or IRQL query results for Kusto Explorer visualization. Generates Lift_To_Graph mappings and composes Graph_Render_View, Graph_Fold_By_Property, Extract_Node_*, Enrich_Node_*, and Enrich_Graph_* calls. Accepts a supplied query or limited basic natural-language source request; it is not a general natural-language-to-KQL/IRQL skill. WHEN: Lift_To_Graph, Graph_Render_View, Graph_Fold_By_Property, IRQL graph enrichment, graph mapping for existing query results, icon-decorated graph, fold graph nodes. Use azure-kusto-graph for native make-graph analysis, graph-match, shortest paths, components, or persistent graphs.

3.1kMIT

always on

155 tokname + description

once used

4,563 tokSKILL.md body

bundled files

317 KB

repo stars

3.1kGitHub

Install the Azure Kusto Irql Graph skill

Skills CLI (Claude Code, Codex, Cursor and others)

npx skills add https://github.com/microsoft/skills --skill azure-kusto-irql-graph

Claude Code, by hand (all projects)

git clone --depth 1 https://github.com/microsoft/skills.git /tmp/skills
mkdir -p ~/.claude/skills
cp -R /tmp/skills/.github/plugins/azure-kusto-graph-skills/skills/azure-kusto-irql-graph ~/.claude/skills/azure-kusto-irql-graph

For one project only, copy the folder into .claude/skills/ in that project instead. The agent picks it up when a task matches its description.

What it costs your context

Agent Skills load in three steps. Tokens counted with the o200k tokenizer; your model's count will differ a little.

WhenWhat loadsCost
Every sessionName and description155 tok
When the agent uses itThe SKILL.md instructions4,563 tok
Only if opened3 bundled files (17 KB)varies

Until it is used, azure-kusto-irql-graph costs about 8.8× less than the median MCP server we measured (1,363 tokens on every turn). Installing all 150 skills from microsoft/skills would load 10,823 tokens of descriptions. Skills vs MCP study

Checks

Our checks found nothing to flag: it follows the Agent Skills specification's naming and size guidelines and doesn't pipe downloads into a shell.

Checked 2026-10-22 · method

What's inside

The headings of its SKILL.md. Read the full file on GitHub.

  • IRQL Graph Functions -- Query Results to Visualization
  • Scope and Routing
  • Input Contract
  • Activation Triggers
  • Environment
  • Function Preflight
  • IRQL Graph Function Family
  • LiftToGraph(T, mappingJson)
  • GraphRenderView(T)
  • GraphFoldByProperty(T, NodeType, PropertyName)
  • Graph Extraction and Enrichment Functions
  • Mapping JSON Schema
  • nodetypes[]
  • edges[]
  • Icon Repository
  • Mapping Generation Rules
  • Column Reference (IRQL unified schema)
  • Function Selection
  • Pipeline Pattern
  • Examples
  • Authentication graph: IP -> AuthEvent -> User -> Host
  • Email graph: Sender -> Message -> Recipient
  • Suspicious domain investigation (end-to-end)
  • Process execution graph: User -> Process -> ParentProcess

More skills from microsoft/skills

All skills in this repo
  1. agent-framework-azure-ai-pymicrosoft/skills

    Build Azure AI Foundry agents using the Microsoft Agent Framework Python SDK (agent-framework-azure-ai). Use when creating persistent agents with AzureAIAgentsProvider, using hosted tools (code interpreter, file search, web search), integrating MCP servers, managing conversation threads, or implementing streaming responses. Covers function tools, structured outputs, and multi-tool agents.

    3.1k79 tok idle · 2,496 in use
  2. aks-gpu-inferencemicrosoft/skills

    Diagnose Day-2 AKS GPU and KAITO incidents using profile-aware, read-only evidence. WHEN: 'Insufficient nvidia.com/gpu', GPU pod Pending, model-load OOM, DCGM/VRAM, KAITO Workspace not ready, or GPU autoscaling. DO NOT USE FOR: setup (airunway-aks-setup), non-GPU incidents (aks-troubleshooting), standalone VM quota (azure-quotas), or generic cost (cost-analysis or cost-optimization from the optional azure-cost plugin).

    3.1k113 tok idle · 545 in use
  3. aks-known-issuesmicrosoft/skills

    Lookup documented AKS fixes only when the prompt includes an exact catalog signature and all of its qualifiers: VMCannotFitEphemeralOSDisk; NodePoolMcVersionIncompatible; 'NodeImageVersion is not accepted'; AKS SkuNotAvailable with size, location, and zone; ZonalAllocationFailed with insufficient zone capacity; OverconstrainedAllocationRequest with listed constraints; nested AKS vmssCSE/CSE VMExtensionError_OutboundConnFail, VMExtensionError_K8SAPIServerConnFail, or VMExtensionError_K8SAPIServerDNSLookupFail; or AllocationFailed with the full cataloged internal-error or insufficient-regional-capacity message. Never use for quota errors, code-only or bare wrappers, generic symptoms, incomplete signatures, or failures outside AKS; use aks-troubleshooting or azure-diagnostics.

    3.1k174 tok idle · 247 in use
  4. aks-network-capturemicrosoft/skills

    Collects bounded packet captures from AKS nodes and Azure network configuration for wire-level evidence. WHEN: "capture packets on an AKS node", "take a pcap", "run tcpdump on AKS", "prove where packets drop". Use for explicit packet-capture intent after read-only diagnostics, not general AKS connectivity or ingress troubleshooting.

    3.1k1175 tok idle · 557 in use
  5. aks-troubleshootingmicrosoft/skills

    Debug live Azure Kubernetes Service (AKS) incidents with a read-only, evidence-first investigation. WHEN: pod crashes or Pending, CrashLoopBackOff, OOMKilled, ImagePullBackOff, node NotReady, DNS or ingress failure, connectivity timeout, network policy, SNAT exhaustion, node-pool scaling blocked by QuotaExceeded or InsufficientVCPUQuota, upgrade stuck, spot or zone disruption, a bare VMExtensionProvisioningError or AllocationFailed wrapper, an uncataloged capacity symptom, or 'investigate my AKS cluster'. DO NOT USE FOR: packet capture (use aks-network-capture); GPU or model-serving issues (use aks-gpu-inference); cluster creation or provisioning (use azure-kubernetes); cost (use cost-analysis from the optional azure-cost plugin); pod rightsizing (use azure-kubernetes); a fully qualified documented AKS signature with every required nested qualifier (use aks-known-issues); standalone failures on non-AKS Azure resources (use azure-diagnostics). Unqualified errors and open-ended incidents stay here only for AKS.

    3.1k2221 tok idle · 2,554 in use
  6. applicationinsights-web-tsmicrosoft/skills

    Instrument browser/web apps with the Application Insights JavaScript SDK (@microsoft/applicationinsights-web). Use for Real User Monitoring (RUM) — page views, clicks, AJAX/fetch dependencies, exceptions, custom events, and browser-side GenAI agent traces correlated to backend OpenTelemetry traces. Covers SDK Loader Script and npm setup, framework extensions (React, React Native, Angular), Click Analytics, telemetry initializers, and OTel GenAI semantic conventions for agent/tool/model spans emitted from the browser.

    3.1k106 tok idle · 4,818 in use
  7. azure-advisormicrosoft/skills

    Use Azure Advisor recommendations. WHEN: "show Advisor recommendations", "service retirements", "update recommendation status". DO NOT USE FOR: fixes or remediation (use azure-advisor-actionability).

    3.1k42 tok idle · 255 in use
  8. azure-advisor-actionabilitymicrosoft/skills

    Remediate Azure Advisor recommendations. WHEN: "fix Advisor recommendation".

    3.1k20 tok idle · 342 in use