azure-kusto-graph-skills — Claude Code plugin: install
Adds skills for Kusto graph analysis, IRQL incident-response pipelines, and graph views in Azure Data Explorer.
/plugin marketplace add microsoft/skills
/plugin install azure-kusto-graph-skills@skillsWhat azure-kusto-graph-skills does
This plugin adds three skills for Azure Data Explorer. azure-kusto-graph works with KQL graph operators such as make-graph and graph-match, and covers shortest paths, connected components, and persistent models. azure-kusto-irql assembles incident-response pipelines from Get_*, Extract_*, and Enrich_* functions.
azure-kusto-irql-graph turns query results into Lift_To_Graph mappings and Graph_Render_View visualizations. The plugin starts the Azure MCP Server through npx, which inherits the local .npmrc settings. Install it only on trusted devices because a compromised .npmrc can make npx execute malicious code.
The track-telemetry hook fetches and caches the pinned ghcfa-telem executable when needed, checking its SHA-256 digest before extraction. Set AZURE_MCP_COLLECT_TELEMETRY=false in the agent process environment to opt out.
What it helps with
- build graphs from Azure Data Explorer data
- find shortest paths and connected components with KQL
- compose IRQL incident-response pipelines
- map query results into
Lift_To_Graphstructures - render graph results through
Graph_Render_View
Example prompts for the agent
- Build a Kusto graph with
make-graphand find the shortest paths between these nodes. - Compose an IRQL incident-response pipeline with
Get_*,Extract_*, andEnrich_*. - Turn this query result into
Lift_To_Graphmappings and produce aGraph_Render_Viewvisualization.
How to install azure-kusto-graph-skills
Plugin marketplace
/plugin marketplace add microsoft/skills/plugin install azure-kusto-graph-skills@skillsStep by step, with commands for each platform: Claude Code plugins: marketplaces, installing, and building your own
Questions about azure-kusto-graph-skills
How do I install azure-kusto-graph-skills in Claude Code?
Run /plugin marketplace add microsoft/skills, then run /plugin install azure-kusto-graph-skills@skills.
What does azure-kusto-graph-skills do?
It adds skills for Kusto graph analysis, IRQL incident-response pipelines, and graph visualization in Azure Data Explorer.
How can I disable telemetry for the plugin?
Set AZURE_MCP_COLLECT_TELEMETRY=false in the environment of the process running the agent.
Source text
azure-kusto-graph-skills · MIT
# Azure Kusto Graph Skills Kusto graph analysis, IRQL security hunting pipelines, and graph visualization skills for Azure Data Explorer. ## Security > [!WARNING] > The `azure-kusto-graph-skills` plugin uses `npx` to download and run the Azure MCP Server, inheriting the local environment's `.npmrc` configuration. Install this plugin only on trusted devices. A compromised `.npmrc` configuration could cause `npx` to download and execute malicious code, potentially resulting in remote code execution. ## Telemetry The `track-telemetry` hook installs a pinned native `ghcfa-telem` release asset when needed, verifies its platform-specific SHA-256 digest before extraction, and caches the executable for reuse. To opt out of telemetry collection, set `AZURE_MCP_COLLECT_TELEMETRY=false` in the environment of the process running the agent. ## Skills - **azure-kusto-graph** — Build and query graphs using KQL graph operators (make-graph, graph-match, shortest paths, connected components, persistent models) - **azure-kusto-irql** — Compose IRQL incident response pipelines using Get_*, Extract_*, and Enrich_* functions - **azure-kusto-irql-graph** — Generate Lift_To_Graph mappings and Graph_Render_View visualizations from query results
© Microsoft · MIT · microsoft/skills
