Microsoft's skills for Azure Data Explorer: build Kusto graphs, compose IRQL threat hunts and turn results into visual graphs.
by Microsoft· SecurityUnclaimed · Yours? Claim it
4 images
About
Microsoft's plugin for security investigations in Azure Data Explorer (Kusto). Its three skills teach your agent to turn KQL results into graphs, compose IRQL threat-hunting pipelines and render the results as graphs in Kusto Explorer. It also brings in the Azure MCP Server, which runs the queries. What its skills cover - azure-kusto-graph: build transient and persistent graphs with KQL's graph operators (make-graph, graph-match, shortest paths, connected components, graph models and snapshots) - azure-kusto-irql: compose IRQL (Incident Response Query Language) pipelines from Get_*, Extract_* and Enrich_* functions, for hunts such as failed logins, phishing and process execution - azure-kusto-irql-graph: write Lift_To_Graph mappings and Graph_Render_View calls that turn query results into icon-decorated graphs in Kusto Explorer What you can do with it - Find the shortest sign-in path from an external IP to a critical server - Map the blast radius of a compromised account or a malicious file - Find clusters of IPs and domains that communicate together - Spot credential spraying: users with failed logins on the same host - Build a persistent graph model so a SOC team can query without rebuilding it How it connects In Claude Code, run /plugin marketplace add microsoft/skills, then /plugin install azure-kusto-graph-skills@skills. The plugin starts the Azure MCP Server with npx (@azure/mcp), which runs your Kusto queries with your Azure credentials, so sign in to Azure first (for example with az login). Good to know - The skills work best on a KQL or IRQL query you already have. Microsoft says they aren't a general natural-language-to-KQL converter. - IRQL functions must already be deployed on the target database. Microsoft's public example cluster (kc7001.eastus.kusto.windows.net, with the ValdyTimes and JoJosHospital databases) has them. - The plugin includes a telemetry hook. Set AZURE_MCP_COLLECT_TELEMETRY=false to opt out. - Microsoft advises installing it only on trusted devices, because npx inherits your .npmrc settings.
Once it’s added
“Find the shortest sign-in path from any external IP to a critical server.”
“Use IRQL to find failed logins, enrich them with employee data and show their roles.”
“Show me the blast radius of a compromised account.”
“Find clusters of IPs and domains that communicate together.”
“Find pairs of users who both have failed logins to the same host.”
“Turn these failed-login results into a graph in Kusto Explorer, folded by result.”
Before you add it
Reads only
Your Azure Data Explorer clusters, databases and table schemas, through the Azure MCP Server · Security data such as sign-ins, email, DNS and process events, with KQL and IRQL queries
Makes changes · your agent can ask first
Creates persistent graph models and snapshots when you ask (needs Database Admin) · Can deploy the IRQL graph functions to a database that lacks them
Each with its own page
From people who use it
Step by step
No reviews yet. Used Azure Kusto Graph Skills? Say how it went.
Write a reviewRuns on your machine.
Runs on your machine.
/plugin marketplace add microsoft/skills /plugin install azure-kusto-graph-skills@skills
Scanned and passed · checked 6 h ago
Plugins people install alongside Azure Kusto Graph Skills.
Nothing new reaches your agent until a person has looked at it.
Scanned on every change, and again when our rules improve.
Claude CodeSupported
OpenClawSupportedTell us and a person on the trust team will look at it. Or email [email protected].
Nobody has shared how they use Azure Kusto Graph Skills yet.
Security scan
Passed
Safe to install in every agent it supports. Claude plugins.
Plugins people install alongside Azure Kusto Graph Skills.
Anthropic's security review for Claude Code: flags injection, XSS, secrets and more as Claude edits, finishes a turn and commits.
Equips your coding agent with SAST, dependency scanning, a phased hardening workflow and STRIDE threat-modeling skills.
Alireza Rezvani's Claude Code hook that stops Claude before it writes common security anti-patterns, such as eval, pickle or SQL f-strings.
CrowdStrike's local MCP server for Falcon: your agent triages detections, looks up hosts and threat intel, and runs Next-Gen SIEM searches.
