Setting the file. One moment.
Chapter 02 · Azure Kusto Irql Graph
Subchapter 2.2
references/EXAMPLES.mdMarkdown4 KBView on GitHub
Paste any of these into Copilot Chat to see the skill in action.
Cluster: https://kc7001.eastus.kusto.windows.net
Supply the source KQL/IRQL pipeline with the graph description. The skill maps the query’s output columns; it does not normally author the underlying investigation query.
Use this skill for Lift_To_Graph, rendering, folding, and IRQL graph extraction/enrichment functions. Use azure-kusto-graph for native make-graph, graph-match, paths, components, graph models, and snapshots.
Before trying the prompts on another database, verify Lift_To_Graph and Graph_Render_View with .show functions; also verify Graph_Fold_By_Property or enrichers when a prompt uses them. Deploy missing definitions from references/DEPLOY_IRQL_FUNCTIONS.md.
| # | Ask This | What It Does |
|---|---|---|
| 1 | “Given `Get_Event_Authentication_All | take 200`, create a graph showing users authenticating to hosts” |
| 2 | “Given `Get_Event_Authentication_All | where Result == ‘Failed Login’ |
| 3 | “Given `Get_Email_All | take 300`, visualize email flow between senders and recipients” |
| 4 | “Given `Get_Email_All | take 400`, graph emails and collapse messages by verdict” |
| 5 | “Given `Get_Event_Process_All | where ProcessCommandLine has ‘powershell’ |
| 6 | “Given my query returning ClientIp, DomainName, and EnvTime, graph outbound connections and label IPs with employee names” | Network mapping -> Enrich_Node_Ip_Employee -> render |
| 7 | “Create a graph mapping for file creation events showing which user created which file on which host” | Open-ended – Copilot generates a new mapping JSON |
| 8 | “Use the known outbound-network selector to graph connections to raisinkanes.com and show who’s behind each IP” | Basic source fallback -> filter -> Lift_To_Graph -> enrich -> fold -> render |
| # | Ask This | What It Does |
|---|---|---|
| 1 | “Given `Email | take 400`, create a graph showing email flow between senders and recipients” |
| 2 | “Graph emails in AzureCrest and collapse messages by verdict” | Email mapping -> Graph_Fold_By_Property("EmailMessage", "verdict") |
| 3 | “Given `AuthenticationEvents | take 200`, create a Lift_To_Graph visualization of users authenticating to hosts” |
| 4 | “Show IPs connecting to hosts through auth events in AzureCrest, with user nodes” | 4-entity auth mapping: SrcIp -> AuthEvent -> Host + User |
| 5 | “Show process execution trees for hosts running powershell in AzureCrest” | Raw ProcessEvents -> Process -> Parent + Host + User |
| 6 | “Graph outbound network connections from IPs to domains in AzureCrest” | Raw OutboundNetworkEvents -> IP -> Domain mapping |
| 7 | “Create a graph of file creation events in AzureCrest showing users, files, and hosts” | Raw FileCreationEvents -> User + File + Host mapping |
| 8 | “Graph DNS lookups in AzureCrest and fold IPs by domain” | PassiveDns -> IP -> Domain mapping -> fold by domain |