# Azure Kusto Graph Skills

> Microsoft's skills for Azure Data Explorer: build Kusto graphs, compose IRQL threat hunts and turn results into visual graphs.

Microsoft's plugin for security investigations in Azure Data Explorer (Kusto). Its three skills teach your agent to turn KQL results into graphs, compose IRQL threat-hunting pipelines and render the results as graphs in Kusto Explorer. It also brings in the Azure MCP Server, which runs the queries.

What its skills cover
- azure-kusto-graph: build transient and persistent graphs with KQL's graph operators (make-graph, graph-match, shortest paths, connected components, graph models and snapshots)
- azure-kusto-irql: compose IRQL (Incident Response Query Language) pipelines from Get_*, Extract_* and Enrich_* functions, for hunts such as failed logins, phishing and process execution
- azure-kusto-irql-graph: write Lift_To_Graph mappings and Graph_Render_View calls that turn query results into icon-decorated graphs in Kusto Explorer

What you can do with it
- Find the shortest sign-in path from an external IP to a critical server
- Map the blast radius of a compromised account or a malicious file
- Find clusters of IPs and domains that communicate together
- Spot credential spraying: users with failed logins on the same host
- Build a persistent graph model so a SOC team can query without rebuilding it

How it connects
In Claude Code, run /plugin marketplace add microsoft/skills, then /plugin install azure-kusto-graph-skills@skills. The plugin starts the Azure MCP Server with npx (@azure/mcp), which runs your Kusto queries with your Azure credentials, so sign in to Azure first (for example with az login).

Good to know
- The skills work best on a KQL or IRQL query you already have. Microsoft says they aren't a general natural-language-to-KQL converter.
- IRQL functions must already be deployed on the target database. Microsoft's public example cluster (kc7001.eastus.kusto.windows.net, with the ValdyTimes and JoJosHospital databases) has them.
- The plugin includes a telemetry hook. Set AZURE_MCP_COLLECT_TELEMETRY=false to opt out.
- Microsoft advises installing it only on trusted devices, because npx inherits your .npmrc settings.

- Type: Plugin
- Made by: Microsoft
- Category: Security
- Formats: Claude plugins
- Version: 1.0.29
- Website: https://github.com/microsoft/github-copilot-for-azure
- Source: https://github.com/microsoft/skills/tree/main/.github/plugins/azure-kusto-graph-skills
- Page: https://pluginboard.ai/plugins/azure-kusto-graph-skills

## Works with

- Claude
- GitHub Copilot
- Claude Code
- OpenClaw

## Install

### Claude

In Claude (web or desktop): Customize → Plugins → Add → Add marketplace, enter microsoft/skills, then add azure-kusto-graph-skills

### Claude Code

In Claude Code:

```text
/plugin marketplace add microsoft/skills
/plugin install azure-kusto-graph-skills@skills
```

---
From Pluginboard (https://pluginboard.ai).