icm-investigator

To query ZTS logs for ICM incident investigations, you use reusable KQL templates like list-zts-icms.kql and get-icm-details.kql to extract ICM data and perform timeline analysis directly within Kusto clusters.

A standard ZTS ICM investigation report is assembled using centralized templates and reference playbooks, providing structured guidance for post-incident reporting, maintenance, and standardized environment analysis.

Yes, you need access to ICM Kusto clusters to fetch ICM data and execute the KQL templates required to query ZTS logs and assemble investigation reports across environments.

The best way to resolve environment targets during an ICM investigation is by using centralized cluster mapping references, which allow you to quickly identify and map targets across environments.

Yes, you can standardize post-incident reporting for ZTS ICMs by loading the provided investigation templates and reference playbooks from the references folder to ensure consistent reporting and maintenance.