Security-hunting queries built from IRQL functions.
What it does
Creates composable security-hunting queries from existing IRQL selectors, extractors, and enrichers.
When to use it
Use when the user explicitly requests IRQL or a hunting pipeline using known IRQL functions, not for generic security queries.
How to use it
Give it an IRQL hunting request; it returns the complete query in chat with connection and query steps labeled.
Uses
AD
Latest review
What you need · 1
Requires a target database with IRQL functions already deployed; the skill does not deploy base selectors.
Access · 1
This skill
Kusto
Read
Inspects your Kusto database