azure-kusto
Analyze Azure Data Explorer with KQL
Azure Data Explorer data can be hard to inspect without the right KQL structure and schema context. This skill helps Claude, Codex, and Claude Code build focused KQL queries, explore schemas, and troubleshoot ADX results.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "azure-kusto" from https://skillstore.io/skills/microsoft-azure-kusto.md and its manifest at https://skillstore.io/api/skills/microsoft-azure-kusto/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "azure-kusto". Show failed login events from the past day and group them by account.
Expected outcome:
A time-bounded KQL query with account grouping, a summary of expected columns, and guidance to limit returned rows.
Using "azure-kusto". Why is my Kusto query returning no rows?
Expected outcome:
A troubleshooting checklist covering time ranges, table names, filter values, permissions, and data ingestion delay.
Using "azure-kusto". Find latency spikes in telemetry for the last 12 hours.
Expected outcome:
A percentile-based time series query plan and an explanation of how to interpret the latency trend.
Security Audit
SafeMost static findings are false positives caused by Markdown backticks around KQL examples, KQL functions, parameter names, and MCP tool names. The documented Azure CLI and REST fallbacks are retained as medium and low operational risks because they can run external commands and send KQL query content to Azure Data Explorer. No evidence of prompt injection, malicious exfiltration, or hidden destructive behavior was found.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
⚙️ External commands (39)
🌐 Network access (1)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/microsoft-azure-kusto/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/microsoft-azure-kusto?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/microsoft-azure-kusto?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/microsoft-azure-kusto/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/microsoft-azure-kusto.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
microsoft. (2026). azure-kusto security audit report (audit version 8) [Author version 0.0.0-placeholder]. Skillstore. https://skillstore.io/skills/microsoft-azure-kusto/audits/8BibTeX citation
@techreport{microsoft-microsoft-azure-kusto-2026,
author = {microsoft},
title = {azure-kusto security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/microsoft-azure-kusto/audits/8},
note = {Author version 0.0.0-placeholder}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "azure-kusto security audit report (audit version 8)"
version: "0.0.0-placeholder"
type: report
authors:
- name: "microsoft"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/microsoft-azure-kusto/audits/8"
identifiers:
- type: other
value: "skillstore:microsoft-azure-kusto:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Investigate Production Logs
Create focused KQL queries for recent errors, grouped events, and correlated log messages.
Explore Telemetry Schemas
List available Kusto databases and inspect table schemas before writing analysis queries.
Analyze Security Events
Aggregate security telemetry by time, severity, source, and correlation identifiers.
Try These Prompts
Query my Azure Data Explorer database for the last 100 events from [table] during the past hour. Use a time filter and return the most useful columns.
Create a KQL query that counts events in [table] by [category column] and 15 minute time bins for the last 24 hours.
Review this KQL query for performance issues. Add early filters, reduce projected columns, and explain each change before running it.
Use schema discovery, then build a KQL query that joins [events table] and [logs table] on a correlation identifier for critical errors in the last 6 hours.
Best Practices
- Start with schema discovery before writing queries for unfamiliar tables.
- Use time filters and result limits for every exploratory query.
- Project only required columns before sharing or exporting results.
Avoid
- Running broad queries without a time range or row limit.
- Using production credentials without confirming the target subscription and database.
- Pasting sensitive KQL results into unrelated tickets or prompts.
Frequently Asked Questions
What is Azure Data Explorer?
Does this skill require Azure credentials?
Can it modify my Kusto database?
Can I use it for security investigations?
What happens if an MCP Kusto tool is unavailable?
How should I control query cost and size?
Developer Details
Author
microsoftLicense
MIT
Author version
v0.0.0-placeholder
Skillstore revision
r1
Repository
https://github.com/microsoft/github-copilot-for-azure/tree/main/plugin/skills/azure-kusto/Ref
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Maintenance freshness
7/18/2026
Usage
8 downloads · 130 views
File structure
📄 SKILL.md