≈744 tokens on demand. Your agent reads this file only when SKILL.md points to it.
Try It Out -- azure-kusto-graph
Paste any of these into Copilot Chat to see the skill in action.
Cluster: https://kc7001.eastus.kusto.windows.net
ValdyTimes (IRQL as data source -> graph operators)
| # |
Ask This |
What It Does |
| 1 |
"Use IRQL to get auth events in ValdyTimes and build a user-to-host graph" |
Get_Event_Authentication -> make-graph -> graph-match |
| 2 |
"Use IRQL to find failed logins, enrich with employee data, and build a graph showing roles" |
IRQL enrichers -> make-graph with employee metadata on nodes |
| 3 |
"Find the shortest auth path from external IPs to a mail server in ValdyTimes" |
IRQL -> make-graph -> graph-shortest-paths |
| 4 |
"Find DNS clusters of IPs and domains using connected components in ValdyTimes" |
IRQL -> make-graph -> graph-mark-components |
| 5 |
"Detect credential spray -- users sharing failed-login hosts in ValdyTimes" |
IRQL -> make-graph -> bidirectional graph-match |
| 6 |
"Combine email, auth, and process data into one investigation graph in ValdyTimes" |
Multi-IRQL sources -> union -> make-graph |
| 7 |
"Graph outbound connections from IPs to domains in ValdyTimes using IRQL extractors" |
Get_Event_NetworkOutbound -> Extract_Event_Network_Domain -> make-graph |
| 8 |
"A malicious file appeared on hosts -- graph the blast radius of processes on those hosts" |
IRQL file creation -> victims -> make-graph -> variable-length graph-match |
AzureCrest (raw KQL -> graph operators)
| # |
Ask This |
What It Does |
| 1 |
"Build a graph of users authenticating to hosts in AzureCrest" |
AuthenticationEvents -> edges-first -> make-graph |
| 2 |
"Build a graph showing which IPs authenticate as which users to which hosts in AzureCrest" |
Three-entity IP -> User -> Host multi-hop graph |
| 3 |
"Find users with more than 20 failed logins and the hosts they targeted in AzureCrest, as a graph" |
make-graph -> graph-match with where constraint |
| 4 |
"Find the shortest authentication path from any external IP to a critical server in AzureCrest" |
make-graph -> graph-shortest-paths |
| 5 |
"Find clusters of IPs and domains that communicate together in AzureCrest" |
PassiveDns -> make-graph -> graph-mark-components |
| 6 |
"Find pairs of users who both have failed logins to the same host in AzureCrest" |
Bidirectional graph-match for credential spray detection |
| 7 |
"Build an auth graph from AzureCrest and export nodes and edges as tables" |
make-graph -> graph-to-table |
| 8 |
"Build a graph of email senders and recipients in AzureCrest" |
Email -> Sender -> Message -> Recipient graph |
| 9 |
"Combine email, auth, and process data into one investigation graph in AzureCrest" |
Multi-source union -> make-graph |
| 10 |
"Visualize the AzureCrest authentication graph in Kusto Explorer" |
make-graph without pipe -- triggers KE graph window |
