IRQL -- Incident Response Query Language Compose IRQL function pipelines from selector, extractor, and enricher building blocks. IRQL wraps raw KQL security tables behind intent-revealing, composable functions so analysts (and LLMs) can express hunts without memorizing schemas, cluster locations, or join keys. Activation Triggers Use this skill when the user: - Explicitly mentions IRQL, , , or functions - Says "use IRQL" or "write an IRQL query" - Requests a composable hunting pipeline using known IRQL selectors Do not activate for generic security queries (e.g. "find failed logins") unless t…