azure-kusto-graph

Build and query Kusto graphs from tabular data using KQL graph operators.

3.0k|341|Updated Jan 16, 2026
One-click install
npx skills add https://github.com/microsoft/skills --skill azure-kusto-graph
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: azure-kusto-graph
Source: https://github.com/microsoft/skills/tree/main/.github/plugins/azure-kusto-graph-skills/skills/azure-kusto-graph
Command: npx skills add https://github.com/microsoft/skills --skill azure-kusto-graph

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Analysts working in Azure Data Explorer often need to model relationships in tabular data—such as who logged into which host or which IPs communicate together—but writing correct KQL graph queries requires knowing the edges-first construction pattern and operators like make-graph and graph-match. This Skill translates natural-language requests into correct transient and persistent Kusto graph queries.

Core Features & Use Cases

  • Transient Graph Construction: Generates the edges-first make-graph pattern (define edges, define node lookups, union, make-graph) from existing KQL query results.
  • Graph Query Operators: Produces graph-match pattern queries, graph-shortest-paths, graph-mark-components for connected components, and graph-to-table exports.
  • Persistent Graph Models: Creates graph models and snapshots with safety guardrails requiring user confirmation before any database-modifying command.
  • Use Case: A security analyst asks to find the shortest attack path from an external IP to a database server; the Skill generates a make-graph query over authentication events piped to graph-shortest-paths, ready to run in Kusto Explorer or ADX Web Explorer.

Quick Start

Ask the agent to build a graph of users authenticating to hosts from your Kusto table and find the shortest path between two entities.

Frequently Asked Questions about azure-kusto-graph

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a graph from Kusto table data in KQL?

Use the edges-first pattern: define an edges table with source and target columns, define node lookup tables with IDs and properties, union them, then pipe edges into make-graph Source --> Target with nodes on nodeId. The result can be queried with graph-match or visualized in Kusto Explorer.

How to find the shortest path between two nodes in Kusto?

Use graph-shortest-paths with a variable-length edge pattern such as (start)-[e*1..10]->(end) after building a graph with make-graph. Filter start and end nodes in the where clause and project array_length(e) for the path length.

What is the difference between transient and persistent graphs in Kusto?

Transient graphs are built inline with make-graph during query execution and suit ad-hoc analysis. Persistent graphs use graph models and snapshots stored in database metadata, offering enterprise scale and reuse across queries but requiring setup commands.

Can I visualize a Kusto graph in Kusto Explorer?

Yes. End the query at make-graph without piping to graph-match, and Kusto Explorer opens its interactive graph visualization window. For ADX Web Explorer, append graph-to-table nodes as N, edges as E since it cannot render graph objects.

Does this skill convert natural language directly to KQL?

No. It expects a working KQL query or known table as input plus a natural-language description of the desired graph structure. For general natural-language-to-KQL conversion, a dedicated query-generation skill should be used instead.

Why does graph-match return duplicate or unexpected results?

By default graph-match uses cycles = unique_edges, which can still produce repeated node visits. Set cycles = none to prevent node revisits, and add distinct or explicit node inequality constraints like u1.nodeId != u2.nodeId for bidirectional patterns.