What problem does it solve?
Analysts working in Azure Data Explorer often need to model relationships in tabular data—such as who logged into which host or which IPs communicate together—but writing correct KQL graph queries requires knowing the edges-first construction pattern and operators like make-graph and graph-match. This Skill translates natural-language requests into correct transient and persistent Kusto graph queries.
Core Features & Use Cases
- Transient Graph Construction: Generates the edges-first make-graph pattern (define edges, define node lookups, union, make-graph) from existing KQL query results.
- Graph Query Operators: Produces graph-match pattern queries, graph-shortest-paths, graph-mark-components for connected components, and graph-to-table exports.
- Persistent Graph Models: Creates graph models and snapshots with safety guardrails requiring user confirmation before any database-modifying command.
- Use Case: A security analyst asks to find the shortest attack path from an external IP to a database server; the Skill generates a make-graph query over authentication events piped to graph-shortest-paths, ready to run in Kusto Explorer or ADX Web Explorer.
Quick Start
Ask the agent to build a graph of users authenticating to hosts from your Kusto table and find the shortest path between two entities.