Localized reading guide
azure-kusto-irql-graphPurpose, usage and source
Apply IRQL graph functions to KQL or IRQL query results for Kusto Explorer visualization. Generates Lift_To_Graph mappings and composes Graph_Render_View, Graph_Fold_By_Property, Extract_Node_*, Enrich_Node_*, and Enrich_Graph_* calls. Accepts a supplied query or limited basic natural-language source request; it is not a general natural-language-to-KQL/IRQL skill. WHEN: Lift_To_Graph, Graph_Render_View, Graph_Fold_By_Property, IRQL graph enrichment, graph mapping for existing query results, icon-decorated graph, fold graph nodes. Use azure-kusto-graph for native make-graph analysis, graph-match, shortest paths, components, or persistent graphs.
Source retrieved:
- Source repository
- microsoft/skills
- SKILL.md
.github/plugins/azure-kusto-graph-skills/skills/azure-kusto-irql-graph/SKILL.md- Repository stars
- 3,157
- Repository updated
- 2026-10-31
- Categories
- Cloud
- Last collected
License: License file needs review
Workflow excerpts are reading aids, not executable instructions from Codez. No third-party Skill was run to produce this page.
The purpose and workflow passages below are upstream material, organized and translated for reading. They are distinct from the separately labeled Codez editorial analysis.
What this Skill does
Apply IRQL graph functions to KQL or IRQL query results for Kusto Explorer visualization. Generates Lift_To_Graph mappings and composes Graph_Render_View, Graph_Fold_By_Property, Extract_Node_*, Enrich_Node_*, and Enrich_Graph_* calls. Accepts a supplied query or limited basic natural-language source request; it is not a general natural-language-to-KQL/IRQL skill. WHEN: Lift_To_Graph, Graph_Render_View, Graph_Fold_By_Property, IRQL graph enrichment, graph mapping for existing query results, icon-decorated graph, fold graph nodes. Use azure-kusto-graph for native make-graph analysis, graph-match, shortest paths, components, or persistent graphs.
How the upstream workflow works
Process execution graph: User -> Process -> ParentProcess
Input query: Get_Event_Process_All | where ProcessCommandLine has "powershell" | take 300 Graph request: "Visualize process, parent process, host, and user relationships."
IRQL Graph Functions -- Query Results to Visualization
Apply the IRQL graph function family to tabular results. Given a KQL or IRQL query and the user's graph description, generate a Lift_To_Graph mapping and compose only the stored graph functions needed to visualize, fold, extract, or enrich the graph in Kusto Explorer. The source query does not need to use IRQL.
Scope and Routing
If a request mixes visualization and native graph analysis, use this skill for the lift/render portion and azure-kusto-graph for operator semantics. Do not replace graph-lift functions with a hand-built edges-first graph unless the user asks for native graph operators.
.show functions
| where Name in~ ("Lift_To_Graph", "Graph_Render_View", "Graph_Fold_By_Property")
| project NameRequirements and setup
Environment
Databases: ValdyTimes, JoJosHospital (graph functions pre-deployed) Rendering: Kusto Explorer desktop app (make-graph visualization window)
Limits and quality checks
No separate limits passage was selected from this file. This does not mean the Skill is safe for every input or environment. Review the complete source and validate your own result.
Start with a safe trial
- Check the supported host and the repository installation instructions. Keep the Skill directory and its referenced scripts, assets and documentation together; SKILL.md alone may omit dependencies.
- Give the agent your real input, desired output and acceptance criteria. Invocation syntax and available tools depend on the host; this site does not assume a universal install command.
- Try the source workflow in a disposable project or on a copy. Review operations that change files, remote services or billable resources before allowing them.
- Validate the output against the source quality checks and your own requirements. A successful trigger or a high repository Star count does not establish a correct result.
Read further in the source
- IRQL Graph Functions -- Query Results to Visualization
- Scope and Routing
- Input Contract
- Activation Triggers
- Environment
- Function Preflight
Lift_To_Graph(T, mappingJson)Graph_Render_View(T)Graph_Fold_By_Property(T, NodeType, PropertyName)- Graph Extraction and Enrichment Functions
- Mapping JSON Schema
- Icon Repository
- Mapping Generation Rules
- Function Selection
- Examples
- Authentication graph: IP -> AuthEvent -> User -> Host
- Email graph: Sender -> Message -> Recipient
- Suspicious domain investigation (end-to-end)
- Process execution graph: User -> Process -> ParentProcess
- Query Results -> Mapping Translation
- Opening Queries in Kusto Explorer (Windows Only)
Related Skills
Translation and scope
This reading guide selects passages from the pinned upstream SKILL.md. Translation is assisted. It is not a complete manual or a claim of tested compatibility. Read the original and its referenced files before use.
This introduction refers to the pinned version below; current repository activity and collection time are shown separately.
- Pinned source
- Read the original ↗
- Source retrieved
- Source commit
00d66a64919edca5bca2c673373444e36a4b5461- Source SHA-256
0de50b51c08581507b497152b4fc7ac02d2c72a12dfc33c6a9782b3131abcd66