azure-kusto

Execute KQL queries on Azure Data Explorer for log and telemetry analysis.

Updated Apr 10, 2026
One-click install
npx skills add https://github.com/attentiondotnet/azure-skills --skill azure-kusto-attentiondotnet
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: azure-kusto
Source: https://github.com/attentiondotnet/azure-skills/tree/main/.github/plugins/azure-skills/skills/azure-kusto
Command: npx skills add https://github.com/attentiondotnet/azure-skills --skill azure-kusto-attentiondotnet

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Users need to quickly query and analyze large volumes of log, telemetry, and time‑series data stored in Azure Data Explorer without writing complex KQL themselves.

Core Features & Use Cases

  • KQL Query Execution: Run powerful KQL queries against massive datasets.
  • Schema Exploration: List tables, columns, and data types in a cluster.
  • Resource Management: Discover clusters and databases in a subscription.
  • Analytics Patterns: Perform aggregations, time‑series analysis, and anomaly detection.
  • Use Case Example: An engineer can retrieve the last hour of error events from an ADX cluster to investigate a service outage.

Quick Start

Ask the assistant to run a KQL query that returns the top 10 error events from the last hour in my Azure Data Explorer database.

Frequently Asked Questions about azure-kusto

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run KQL queries on Azure Data Explorer to analyze log and telemetry data?

To run KQL queries on Azure Data Explorer, you need Azure subscription credentials to execute queries against your ADX clusters for retrieving and analyzing log, telemetry, and time-series data.

What is the best way to explore table schemas in an Azure Data Explorer cluster?

Exploring table schemas in an Azure Data Explorer cluster involves listing available tables, columns, and data types using the kusto_table_schema_get MCP tool to understand your database structure before querying.

Can I use Azure CLI to query telemetry and time-series data if MCP tools are unavailable?

Yes, you can query telemetry and time-series data using Azure CLI as an optional fallback when the primary kusto_query MCP tool is unavailable for executing KQL queries on your ADX cluster.

Do I need Azure subscription credentials to investigate security events in ADX?

Yes, Azure subscription credentials are required to access and investigate security events, as the Skill needs authentication to query the Azure Data Explorer clusters where your security logs are stored.

How does time-series anomaly detection work with Azure Data Explorer logs?

Time-series anomaly detection with Azure Data Explorer logs works by executing specific KQL query patterns that perform aggregations and identify anomalies across massive datasets stored in your ADX clusters.

What are the limitations of using KQL for IoT telemetry analysis in Azure Data Explorer?

KQL for IoT telemetry analysis in Azure Data Explorer requires proper cluster access and relies on MCP tools or Azure CLI fallback, meaning query execution depends on available authentication methods and network connectivity.