Skip to main content

Ingext Skills: Ask Your Data in Plain English

Sysadmin
Sysadmin
Fluency Sysadmin

The first versioned release of Ingext Skills adds two skills that turn natural-language questions into validated, ready-to-run queries, with no query language required: ingext-kql for events in the data lake, and ingext-promql for platform health. Ten skills ship in this release, and all of them are open source.

ingext-kql: investigate events in the data lake​

Ask a question about your logs and get back a correct KQL query against sign-ins, audit logs, file activity and network traffic. For example:

  • "Top source IPs by denied FortiGate traffic in the last 24 hours"
  • "Sign-ins by country and client app — how many succeeded and how many failed?"
  • "Users with the most failed logins this week, and where from"
  • "Devices that haven't signed in for 90 days or more"
  • "Directory and role changes made by a given user"

Queries are checked against the table schemas and validated before you run them.

ingext-promql: measure platform health​

Ask about throughput, volume and reliability across the platform. For example:

  • "Events per second by component right now"
  • "Top source apps by ingest volume this hour"
  • "Which processors are throwing errors?"
  • "Data-lake ingest rate by index"
  • "Current queue depth by service"

Answers come only from the known metrics catalog, so the skill does not guess at metric names.

Getting the skills​

The skills, release notes and sources are in the ingext_skills repository. Each skill carries a version number; to check whether an installed skill is current, compare it with the released version in the repository. In Claude, installed skills are listed under Customize → Skills.

The skills work through the platform's MCP server. See MCP Server.