# Try It Out -- azure-kusto-irql

Paste any of these into **Copilot Chat** to see the skill in action.
Cluster: `https://kc7001.eastus.kusto.windows.net`

---

## ValdyTimes (IRQL functions: `Get_*`, `Extract_*`, `Enrich_*`)

| # | Ask This | What It Does |
|---|----------|--------------|
| 1 | "Find all failed logins in ValdyTimes" | Basic `Get_Event_Authentication` with filter |
| 2 | "Which sender domains are emailing executives?" | `Get_Email` -> `Extract_Email_Sender_Domain` -> `Enrich_Username_Employee` |
| 3 | "Show me users with more than 20 failed logins and their job roles" | `Get_Event_Authentication` -> `summarize` -> `Enrich_Username_Employee` |
| 4 | "Find powershell or rundll32 execution on any host" | `Get_Event_Process` with command-line filter |
| 5 | "What domains are being accessed by IPs with failed logins?" | Auth -> distinct IPs -> `Enrich_Ip_Domain` |
| 6 | "Find authentication from external IPs" | `Get_Event_Authentication_All` with RFC1918 exclusion |
| 7 | "A file called Raisin_Kane appeared on some hosts. What processes ran on those hosts?" | `Get_Event_FileCreation_All` -> victim hosts -> `Get_Event_Process` |
| 8 | "Which users are logging in from the most distinct IPs?" | `Get_Event_Authentication_All` -> `summarize dcount(ClientIp) by Username` |

## AzureCrest (raw KQL — no IRQL)

AzureCrest has no IRQL functions. In this environment, route to the `azure-kusto` skill to author raw KQL equivalents (do not use `azure-kusto-irql`).

| # | Ask This | What It Does |
|---|----------|--------------|
| 1 | "Find all failed logins in AzureCrest" | Raw `AuthenticationEvents` with `result` filter |
| 2 | "Which sender domains are emailing executives in AzureCrest?" | `Email` -> extract domain -> join `Employees` |
| 3 | "Show users with more than 20 failed logins and their roles in AzureCrest" | `AuthenticationEvents` -> `summarize` -> join `Employees` |
| 4 | "Find powershell execution across all hosts in AzureCrest" | `ProcessEvents` with `process_commandline` filter |
| 5 | "What domains are accessed by IPs with failed logins in AzureCrest?" | `AuthenticationEvents` -> distinct `src_ip` -> join `PassiveDns` |
| 6 | "Find authentication from external IPs in AzureCrest" | `AuthenticationEvents` with RFC1918 exclusion |