Graph Your Kusto Data with Natural Language

Where this fits

A developer is investigating why a recent deployment increased error rates. The relevant data is in Kusto: service dependencies, request logs, and alert metadata. Relationships are scattered across tables, and the question—"which services are upstream of the failing node?"—requires graph thinking. This skill turns that natural-language request into KQL graph operators. It follows the edges-first pattern: define edges, define node lookups, union, make-graph. Instead of manually assembling graph queries, the agent can build and explore both transient and persistent Kusto graphs from your table definitions.

Why agents benefit

• Translates table schemas into node and edge definitions automatically, so the agent doesn't need to ask you what "edge" means.
• Covers make-graph, graph-match, graph-shortest-paths, graph-mark-components, and graph-to-table export in one skill.
• Generates KQL for both transient graphs and persistent graph snapshots, supporting one-off investigations and repeatable graph models.
• Uses pattern matching to express subgraph shapes like "A depends on B, B depends on C, C fails" as graph-match queries.
• Emits edges-first KQL that is easier to review than a monolithic custom query.

Practical scenarios

Incident blast-radius analysis

Connect a failing service to upstream and downstream dependencies through request logs. Use graph-shortest-paths to find the fastest propagation route and graph-mark-components to identify every service in the same failure domain.

Support ticket routing optimization

Build a transient graph from ticket assignment history. Use graph-match to detect patterns like "ticket moves from tier 1 to tier 2 and back" and graph-to-table to export routing loops for dashboard reporting.

Persistent fraud graph snapshots

Create a persistent graph model from transaction tables, then snapshot it daily. Use graph-match to find circular payment patterns that are difficult to express in ordinary KQL and compare snapshots over time.

Add it to your agent workflow

Install with:

npx skills add microsoft/GitHub-Copilot-for-Azure --skill azure-kusto-graph

Then ask your agent something like: "Find the shortest path between user A and user B in the DeviceLoginEvents table." The skill produces Kusto graph queries modeled on this edges-first shape:

let edges = DeviceLoginEvents
| project Source = UserA, Target = UserB;
edges
| make-graph Source --> Target;
graph-shortest-paths(startNode = 'A', endNode = 'B')

You can then refine the generated query without starting from scratch.

Compare before adopting

Check what the repo actually provides: this skill is part of Microsoft's GitHub Copilot for Azure repository, currently MIT-licensed with 248 stars. The placeholder version in metadata signals it is early. Compare it with generic KQL-generation skills by testing graph-specific prompts. Look for maintenance freshness, examples, and whether it handles persistent graph entities or only transient graphs. Make sure it fits your existing Azure Data Explorer and agent workflow before relying on it.

Why it is worth tracking

Microsoft-authored and MIT-licensed, this skill targets a precise gap: graph querying in Kusto, which most general-purpose KQL skills ignore. It is worth tracking because the repository is under active GitHub visibility and the skill's edge-first design matches how Kusto graph queries should be structured. If you regularly explore relationships in Kusto data, evaluate this skill now. For an independent index of agent skills, see https://www.openagentskill.com/skills/microsoft-azure-kusto-graph.