{"id":"24795d24-07fc-4803-956a-a76cecbb8e67","shortId":"ZSu8x4","kind":"skill","title":"azure-kusto","tagline":"Query and analyze data in Azure Data Explorer (Kusto/ADX) using KQL for log analytics, telemetry, and time series analysis. WHEN: KQL queries, Kusto database queries, Azure Data Explorer, ADX clusters, log analytics, time series data, IoT telemetry, anomaly detection.","description":"# Azure Data Explorer (Kusto) Query & Analytics\n\nExecute KQL queries and manage Azure Data Explorer resources for fast, scalable big data analytics on log, telemetry, and time series data.\n\n## Skill Activation Triggers\n\n**Use this skill immediately when the user asks to:**\n- \"Query my Kusto database for [data pattern]\"\n- \"Show me events in the last hour from Azure Data Explorer\"\n- \"Analyze logs in my ADX cluster\"\n- \"Run a KQL query on [database]\"\n- \"What tables are in my Kusto database?\"\n- \"Show me the schema for [table]\"\n- \"List my Azure Data Explorer clusters\"\n- \"Aggregate telemetry data by [dimension]\"\n- \"Create a time series chart from my logs\"\n\n**Key Indicators:**\n- Mentions \"Kusto\", \"Azure Data Explorer\", \"ADX\", or \"KQL\"\n- Log analytics or telemetry analysis requests\n- Time series data exploration\n- IoT data analysis queries\n- SIEM or security analytics tasks\n- Requests for data aggregation on large datasets\n- Performance monitoring or APM queries\n\n## Overview\n\nThis skill enables querying and managing Azure Data Explorer (Kusto), a fast and highly scalable data exploration service optimized for log and telemetry data. Azure Data Explorer provides sub-second query performance on billions of records using the Kusto Query Language (KQL).\n\nKey capabilities:\n- **Query Execution**: Run KQL queries against massive datasets\n- **Schema Exploration**: Discover tables, columns, and data types\n- **Resource Management**: List clusters and databases\n- **Analytics**: Aggregations, time series, anomaly detection, machine learning\n\n## Core Workflow\n\n1. **Discover Resources**: List available clusters and databases in subscription\n2. **Explore Schema**: Retrieve table structures to understand data model\n3. **Query Data**: Execute KQL queries for analysis, filtering, aggregation\n4. **Analyze Results**: Process query output for insights and reporting\n\n## Query Patterns\n\n### Pattern 1: Basic Data Retrieval\nFetch recent records from a table with simple filtering.\n\n**Example KQL**:\n```kql\nEvents\n| where Timestamp > ago(1h)\n| take 100\n```\n\n**Use for**: Quick data inspection, recent event retrieval\n\n### Pattern 2: Aggregation Analysis\nSummarize data by dimensions for insights and reporting.\n\n**Example KQL**:\n```kql\nEvents\n| summarize count() by EventType, bin(Timestamp, 1h)\n| order by count_ desc\n```\n\n**Use for**: Event counting, distribution analysis, top-N queries\n\n### Pattern 3: Time Series Analytics\nAnalyze data over time windows for trends and patterns.\n\n**Example KQL**:\n```kql\nTelemetry\n| where Timestamp > ago(24h)\n| summarize avg(ResponseTime), percentiles(ResponseTime, 50, 95, 99) by bin(Timestamp, 5m)\n| render timechart\n```\n\n**Use for**: Performance monitoring, trend analysis, anomaly detection\n\n### Pattern 4: Join and Correlation\nCombine multiple tables for cross-dataset analysis.\n\n**Example KQL**:\n```kql\nEvents\n| where EventType == \"Error\"\n| join kind=inner (\n    Logs\n    | where Severity == \"Critical\"\n) on CorrelationId\n| project Timestamp, EventType, LogMessage, Severity\n```\n\n**Use for**: Root cause analysis, correlated event tracking\n\n### Pattern 5: Schema Discovery\nExplore table structure before querying.\n\n**Tools**: `kusto_table_schema_get`\n\n**Use for**: Understanding data model, query planning\n\n## Key Data Fields\n\nWhen executing queries, common field patterns:\n- **Timestamp**: Time of event (datetime) - use `ago()`, `between()`, `bin()` for time filtering\n- **EventType/Category**: Classification field for grouping\n- **CorrelationId/SessionId**: For tracing related events\n- **Severity/Level**: For filtering by importance\n- **Dimensions**: Custom properties for grouping and filtering\n\n## Result Format\n\nQuery results include:\n- **Columns**: Field names and data types\n- **Rows**: Data records matching query\n- **Statistics**: Row count, execution time, resource utilization\n- **Visualization**: Chart rendering hints (timechart, barchart, etc.)\n\n## KQL Best Practices\n\n**🟢 Performance Optimized:**\n- Filter early: Use `where` before joins and aggregations\n- Limit result size: Use `take` or `limit` to reduce data transfer\n- Time filters: Always filter by time range for time series data\n- Indexed columns: Filter on indexed columns first\n\n**🔵 Query Patterns:**\n- Use `summarize` for aggregations instead of `count()` alone\n- Use `bin()` for time bucketing in time series\n- Use `project` to select only needed columns\n- Use `extend` to add calculated fields\n\n**🟡 Common Functions:**\n- `ago(timespan)`: Relative time (ago(1h), ago(7d))\n- `between(start .. end)`: Range filtering\n- `startswith()`, `contains()`, `matches regex`: String filtering\n- `parse`, `extract`: Extract values from strings\n- `percentiles()`, `avg()`, `sum()`, `max()`, `min()`: Aggregations\n\n## Best Practices\n\n- Always include time range filters to optimize query performance\n- Use `take` or `limit` for exploratory queries to avoid large result sets\n- Leverage `summarize` for aggregations instead of client-side processing\n- Store frequently-used queries as functions in the database\n- Use materialized views for repeated aggregations\n- Monitor query performance and resource consumption\n- Apply data retention policies to manage storage costs\n- Use streaming ingestion for real-time analytics (< 1 second latency)\n- Integrate with Azure Monitor for operational insights\n\n## MCP Tools Used\n\n| Tool | Purpose |\n|------|---------|\n| `kusto_cluster_list` | List all Azure Data Explorer clusters in a subscription |\n| `kusto_database_list` | List all databases in a specific Kusto cluster |\n| `kusto_query` | Execute KQL queries against a Kusto database |\n| `kusto_table_schema_get` | Retrieve schema information for a specific table |\n\n**Required Parameters**:\n- `subscription`: Azure subscription ID or display name\n- `cluster`: Kusto cluster name (e.g., \"mycluster\")\n- `database`: Database name\n- `query`: KQL query string (for query operations)\n- `table`: Table name (for schema operations)\n\n**Optional Parameters**:\n- `resource-group`: Resource group name (for listing operations)\n- `tenant`: Azure AD tenant ID\n\n## Fallback Strategy: Azure CLI Commands\n\nIf Azure MCP Kusto tools fail, timeout, or are unavailable, use Azure CLI commands as fallback.\n\n### CLI Command Reference\n\n| Operation | Azure CLI Command |\n|-----------|-------------------|\n| List clusters | `az kusto cluster list --resource-group <rg-name>` |\n| List databases | `az kusto database list --cluster-name <cluster> --resource-group <rg-name>` |\n| Show cluster | `az kusto cluster show --name <cluster> --resource-group <rg-name>` |\n| Show database | `az kusto database show --cluster-name <cluster> --database-name <db> --resource-group <rg-name>` |\n\n### KQL Query via Azure CLI\n\nFor queries, use the Kusto REST API or direct cluster URL:\n```bash\naz rest --method post \\\n  --url \"https://<cluster>.<region>.kusto.windows.net/v1/rest/query\" \\\n  --body \"{ \\\"db\\\": \\\"<database>\\\", \\\"csl\\\": \\\"<kql-query>\\\" }\"\n```\n\n### When to Fallback\n\nSwitch to Azure CLI when:\n- MCP tool returns timeout error (queries > 60 seconds)\n- MCP tool returns \"service unavailable\" or connection errors\n- Authentication failures with MCP tools\n- Empty response when database is known to have data\n\n## Common Issues\n\n- **Access Denied**: Verify database permissions (Viewer role minimum for queries)\n- **Query Timeout**: Optimize query with time filters, reduce result set, or increase timeout\n- **Syntax Error**: Validate KQL syntax - common issues: missing pipes, incorrect operators\n- **Empty Results**: Check time range filters (may be too restrictive), verify table name\n- **Cluster Not Found**: Check cluster name format (exclude \".kusto.windows.net\" suffix)\n- **High CPU Usage**: Query too broad - add filters, reduce time range, limit aggregations\n- **Ingestion Lag**: Streaming data may have 1-30 second delay depending on ingestion method\n\n## Use Cases\n\n- **Log Analytics**: Application logs, system logs, audit logs\n- **IoT Analytics**: Sensor data, device telemetry, real-time monitoring\n- **Security Analytics**: SIEM data, threat detection, security event correlation\n- **APM**: Application performance metrics, user behavior, error tracking\n- **Business Intelligence**: Clickstream analysis, user analytics, operational KPIs","tags":["azure","kusto","skills","microsoft","agent-skills"],"capabilities":["skill","source-microsoft","skill-azure-kusto","topic-agent-skills"],"categories":["azure-skills"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/microsoft/azure-skills/azure-kusto","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add microsoft/azure-skills","source_repo":"https://github.com/microsoft/azure-skills","install_from":"skills.sh"}},"qualityScore":"0.950","qualityRationale":"deterministic score 0.95 from registry signals: · indexed on github topic:agent-skills · official publisher · 1014 github stars · SKILL.md body (8,223 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-05-18T18:53:16.851Z","embedding":null,"createdAt":"2026-04-18T20:23:26.933Z","updatedAt":"2026-05-18T18:53:16.851Z","lastSeenAt":"2026-05-18T18:53:16.851Z","tsv":"'-30':1056 '/v1/rest/query':935 '1':264,307,732,1055 '100':329 '1h':327,360,635 '2':274,339 '24h':396 '3':284,376 '4':294,420 '5':462 '50':402 '5m':408 '60':953 '7d':637 '95':403 '99':404 'access':979 'activ':72 'ad':834 'add':625,1042 'adx':32,105,152 'aggreg':132,177,255,293,340,567,602,660,687,709,1048 'ago':326,395,497,630,634,636 'alon':606 'alway':581,663 'analysi':22,159,167,291,341,370,416,431,457,1103 'analyt':17,35,48,63,156,172,254,379,731,1066,1074,1084,1105 'analyz':6,101,295,380 'anomali':41,258,417 'api':922 'apm':184,1092 'appli':716 'applic':1067,1093 'ask':81 'audit':1071 'authent':963 'avail':268 'avg':398,656 'avoid':680 'az':867,876,888,898,928 'azur':2,9,29,43,54,98,128,149,193,211,737,752,793,833,839,843,853,862,914,944 'azure-kusto':1 'barchart':553 'bash':927 'basic':308 'behavior':1097 'best':556,661 'big':61 'billion':221 'bin':358,406,499,608 'bodi':936 'broad':1041 'bucket':611 'busi':1100 'calcul':626 'capabl':231 'case':1064 'caus':456 'chart':141,549 'check':1015,1029 'classif':504 'cli':840,854,858,863,915,945 'clickstream':1102 'client':691 'client-sid':690 'cluster':33,106,131,251,269,748,755,769,799,801,866,869,881,887,890,903,925,1026,1030 'cluster-nam':880,902 'column':244,530,591,595,621 'combin':424 'command':841,855,859,864 'common':488,628,977,1007 'connect':961 'consumpt':715 'contain':644 'core':262 'correl':423,458,1091 'correlationid':447 'correlationid/sessionid':508 'cost':723 'count':355,363,368,543,605 'cpu':1037 'creat':137 'critic':445 'cross':429 'cross-dataset':428 'csl':938 'custom':519 'data':7,10,30,38,44,55,62,70,88,99,129,134,150,163,166,176,194,202,210,212,246,282,286,309,333,343,381,478,483,534,537,577,589,717,753,976,1052,1076,1086 'databas':27,86,112,119,253,271,703,760,764,778,805,806,875,878,897,900,906,971,982 'database-nam':905 'dataset':180,239,430 'datetim':495 'db':937 'delay':1058 'deni':980 'depend':1059 'desc':364 'detect':42,259,418,1088 'devic':1077 'dimens':136,345,518 'direct':924 'discov':242,265 'discoveri':464 'display':797 'distribut':369 'e.g':803 'earli':561 'empti':968,1013 'enabl':189 'end':640 'error':438,951,962,1003,1098 'etc':554 'event':92,323,336,353,367,435,459,494,512,1090 'eventtyp':357,437,450 'eventtype/category':503 'exampl':320,350,389,432 'exclud':1033 'execut':49,233,287,486,544,772 'explor':11,31,45,56,100,130,151,164,195,203,213,241,275,465,754 'exploratori':677 'extend':623 'extract':650,651 'fail':847 'failur':964 'fallback':837,857,941 'fast':59,198 'fetch':311 'field':484,489,505,531,627 'filter':292,319,502,515,524,560,580,582,592,642,648,667,995,1018,1043 'first':596 'format':526,1032 'found':1028 'frequent':696 'frequently-us':695 'function':629,700 'get':474,782 'group':507,522,825,827,873,885,895,910 'high':200,1036 'hint':551 'hour':96 'id':795,836 'immedi':77 'import':517 'includ':529,664 'incorrect':1011 'increas':1000 'index':590,594 'indic':146 'inform':785 'ingest':726,1049,1061 'inner':441 'insight':301,347,741 'inspect':334 'instead':603,688 'integr':735 'intellig':1101 'iot':39,165,1073 'issu':978,1008 'join':421,439,565 'key':145,230,482 'kind':440 'known':973 'kpis':1107 'kql':14,24,50,109,154,229,235,288,321,322,351,352,390,391,433,434,555,773,809,911,1005 'kusto':3,26,46,85,118,148,196,226,471,747,759,768,770,777,779,800,845,868,877,889,899,920 'kusto.windows.net':934,1034 'kusto.windows.net/v1/rest/query':933 'kusto/adx':12 'lag':1050 'languag':228 'larg':179,681 'last':95 'latenc':734 'learn':261 'leverag':684 'limit':568,574,675,1047 'list':126,250,267,749,750,761,762,830,865,870,874,879 'log':16,34,65,102,144,155,207,442,1065,1068,1070,1072 'logmessag':451 'machin':260 'manag':53,192,249,721 'massiv':238 'match':539,645 'materi':705 'max':658 'may':1019,1053 'mcp':742,844,947,955,966 'mention':147 'method':930,1062 'metric':1095 'min':659 'minimum':986 'miss':1009 'model':283,479 'monitor':182,414,710,738,1082 'multipl':425 'myclust':804 'n':373 'name':532,798,802,807,817,828,882,892,904,907,1025,1031 'need':620 'oper':740,814,820,831,861,1012,1106 'optim':205,559,669,991 'option':821 'order':361 'output':299 'overview':186 'paramet':791,822 'pars':649 'pattern':89,305,306,338,375,388,419,461,490,598 'percentil':400,655 'perform':181,219,413,558,671,712,1094 'permiss':983 'pipe':1010 'plan':481 'polici':719 'post':931 'practic':557,662 'process':297,693 'project':448,616 'properti':520 'provid':214 'purpos':746 'queri':4,25,28,47,51,83,110,168,185,190,218,227,232,236,285,289,298,304,374,469,480,487,527,540,597,670,678,698,711,771,774,808,810,813,912,917,952,988,989,992,1039 'quick':332 'rang':585,641,666,1017,1046 'real':729,1080 'real-tim':728,1079 'recent':312,335 'record':223,313,538 'reduc':576,996,1044 'refer':860 'regex':646 'relat':511,632 'render':409,550 'repeat':708 'report':303,349 'request':160,174 'requir':790 'resourc':57,248,266,546,714,824,826,872,884,894,909 'resource-group':823,871,883,893,908 'respons':969 'responsetim':399,401 'rest':921,929 'restrict':1022 'result':296,525,528,569,682,997,1014 'retent':718 'retriev':277,310,337,783 'return':949,957 'role':985 'root':455 'row':536,542 'run':107,234 'scalabl':60,201 'schema':123,240,276,463,473,781,784,819 'second':217,733,954,1057 'secur':171,1083,1089 'select':618 'sensor':1075 'seri':21,37,69,140,162,257,378,588,614 'servic':204,958 'set':683,998 'sever':444,452 'severity/level':513 'show':90,120,886,891,896,901 'side':692 'siem':169,1085 'simpl':318 'size':570 'skill':71,76,188 'skill-azure-kusto' 'source-microsoft' 'specif':767,788 'start':639 'startswith':643 'statist':541 'storag':722 'store':694 'strategi':838 'stream':725,1051 'string':647,654,811 'structur':279,467 'sub':216 'sub-second':215 'subscript':273,758,792,794 'suffix':1035 'sum':657 'summar':342,354,397,600,685 'switch':942 'syntax':1002,1006 'system':1069 'tabl':114,125,243,278,316,426,466,472,780,789,815,816,1024 'take':328,572,673 'task':173 'telemetri':18,40,66,133,158,209,392,1078 'tenant':832,835 'threat':1087 'time':20,36,68,139,161,256,377,383,492,501,545,579,584,587,610,613,633,665,730,994,1016,1045,1081 'timechart':410,552 'timeout':848,950,990,1001 'timespan':631 'timestamp':325,359,394,407,449,491 'tool':470,743,745,846,948,956,967 'top':372 'top-n':371 'topic-agent-skills' 'trace':510 'track':460,1099 'transfer':578 'trend':386,415 'trigger':73 'type':247,535 'unavail':851,959 'understand':281,477 'url':926,932 'usag':1038 'use':13,74,224,330,365,411,453,475,496,562,571,599,607,615,622,672,697,704,724,744,852,918,1063 'user':80,1096,1104 'util':547 'valid':1004 'valu':652 'verifi':981,1023 'via':913 'view':706 'viewer':984 'visual':548 'window':384 'workflow':263","prices":[{"id":"5314e202-7e9d-4035-9517-acb9f83c87d9","listingId":"24795d24-07fc-4803-956a-a76cecbb8e67","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"microsoft","category":"azure-skills","install_from":"skills.sh"},"createdAt":"2026-04-18T20:23:26.933Z"}],"sources":[{"listingId":"24795d24-07fc-4803-956a-a76cecbb8e67","source":"github","sourceId":"microsoft/azure-skills/azure-kusto","sourceUrl":"https://github.com/microsoft/azure-skills/tree/main/skills/azure-kusto","isPrimary":false,"firstSeenAt":"2026-04-18T21:57:12.979Z","lastSeenAt":"2026-05-18T18:53:16.851Z"},{"listingId":"24795d24-07fc-4803-956a-a76cecbb8e67","source":"skills_sh","sourceId":"microsoft/azure-skills/azure-kusto","sourceUrl":"https://skills.sh/microsoft/azure-skills/azure-kusto","isPrimary":true,"firstSeenAt":"2026-04-18T20:23:26.933Z","lastSeenAt":"2026-05-07T22:40:11.844Z"}],"details":{"listingId":"24795d24-07fc-4803-956a-a76cecbb8e67","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"microsoft","slug":"azure-kusto","github":{"repo":"microsoft/azure-skills","stars":1014,"topics":["agent-skills"],"license":"mit","html_url":"https://github.com/microsoft/azure-skills","pushed_at":"2026-05-18T14:38:04Z","description":"Official agent plugin providing skills and MCP server configurations for Azure scenarios.","skill_md_sha":"76e6b1764da1d7352dd3d6056571751f4395c746","skill_md_path":"skills/azure-kusto/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/microsoft/azure-skills/tree/main/skills/azure-kusto"},"layout":"multi","source":"github","category":"azure-skills","frontmatter":{"name":"azure-kusto","license":"MIT","description":"Query and analyze data in Azure Data Explorer (Kusto/ADX) using KQL for log analytics, telemetry, and time series analysis. WHEN: KQL queries, Kusto database queries, Azure Data Explorer, ADX clusters, log analytics, time series data, IoT telemetry, anomaly detection."},"skills_sh_url":"https://skills.sh/microsoft/azure-skills/azure-kusto"},"updatedAt":"2026-05-18T18:53:16.851Z"}}