Build and query Kusto graphs from natural language. Covers transient graphs (make-graph), persistent graph models/snapshots, pattern matching (graph-match), shortest paths, connected components, and graph-to-table export. Generates the edges-first thinking: define edges, define node lookups, union,

Kusto Graph Semantics Build transient and persistent graphs from tabular data using KQL graph operators. This skill translates natural language into the edges first graph construction pattern and graph query operators. Activation Triggers Use this skill when the user: Wants to build a graph from tabular data ( make graph ) Asks to find patterns, paths, or relationships in data Mentions graph match , graph shortest paths , graph to table , graph mark components Wants to create a persistent graph model or snapshot Says "build a graph", "find the shortest path", "find connected components", "show relationships" Asks about transient vs persistent graphs Not a natural language to KQL converter. The input should generally be a working KQL query whose results the user wants converted to a graph, plus a natural language description of the desired graph structure. Basic NL source requests are supported only when they map directly to a known table with obvious columns. For general NL to KQL conversion, use a dedicated query generation skill (available separately). Complementary skills: azure kusto irql composable security query primitives that produce the tabular inputs for graphs azure kusto irql graph IRQL's Lift To Graph JSON mapping system for richly typed, icon decorated graphs in Kusto Explorer The Edges First Approach The fundamental pattern for building graphs in Kusto: This is how to think in make graph . Edges are the relationships you care about. Nodes are lookup tables that give those IDs a face display names, types, properties. Graph Operators Reference make graph Build a graph from tables Edges : tabular source where each row is an edge SourceId TargetId : columns containing source and target node IDs with Nodes on NodeId : optional node property table joined by ID Supports multiple node tables: with Nodes1 on Id1, Nodes2 on Id2 Nodes appearing in edges but missing from the node table get empty properties graph match Find patterns Pattern notation: Element Named Anonymous Node (n) () Edge left right [e] Edge right left < [e] < Any direction [e] Variable length [e 1..5] [ 1..5] Multi hop patterns: (a) [e1] (b) [e2] (c) Star patterns: (a) (center) (b), (c) (center) (d) Cycles control: cycles = all none unique edges (default: unique edges ) graph shortest paths Find shortest paths Requires at least one variable length edge output = any (default, one path per pair) or output = all (all equal length shortest paths) Variable length edge properties returned as dynamic arrays graph to table Export graph to tables graph mark components Find connected components Assigns a ComponentId to each node. Nodes in the same connected component share the same ID. graph() function Query persistent graphs Transient Graphs Created dynamically during query execution. No setup required. Ideal for ad hoc analysis, exploration, and prototyping. Template: Basic two entity graph Template: Multi relationship graph Persistent Graphs For large scale, reusable graphs. Stored in database metadata. Support snapshots for historical comparison. Safety: Creating or altering graph models and snapshots modifies the database. Always show the exact command and confirm with the user before executing .create or alter graph model or .make graph snapshot . Step 1: Create a graph model Step 2: Create a snapshot Step 3: Query the snapshot Management commands Safety: All control commands below modify or delete database objects. Never execute .drop , .create or alter graph model , or .make graph snapshot automatically. Always show the exact command, cluster, database, and affected object, then require explicit user confirmation before execution. Transient vs Persistent: When to Use Which Factor Transient ( make graph ) Persistent ( graph() ) Setup None inline in query Create model + snapshot Lifetime Query execution only Stored in database metadata Data freshness Always current Snapshot at creation time Scale Limited by query memory Enterprise scale Reuse Rebuilt every query Shared across users/queries Best for Ad hoc hunts, prototyping Production workflows, dashboards Security & Threat Hunting Examples Authentication graph: who logged into what from where Lateral movement detection: users sharing compromised hosts Shortest attack path Connected components: find isolated clusters Visualize in Kusto Explorer End a query at make graph (without piping to graph match ) to trigger Kusto Explorer's interactive graph visualization window: To flatten back to a table for dashboards or export, pipe through graph match project or graph to table . Using with IRQL When working with security data, consider using IRQL selectors ( Get ) from the azure kusto irql skill as the data source. IRQL gives you a unified schema without memorizing raw table names or column mappings. For rich visualization with icons and node folding, the azure kusto irql graph skill's Lift To Graph is the faster path. Approach Best For Raw make graph (this skill) Full control, persistent models, shortest paths, connected components, custom schemas Lift To Graph ( azure kusto irql graph ) Quick icon decorated visualization in Kusto Explorer, node folding IRQL Get make graph IRQL's unified schema as input, then raw graph operators for analysis IRQL Get Lift To Graph Graph Render View Fastest path from question to visual graph Note: Lift To Graph , Graph Render View , and Graph Fold By Property are stored functions, not built in operators. They are pre deployed on the kc7001 example cluster but may need deployment on other clusters. See azure kusto irql graph/references/DEPLOY IRQL FUNCTIONS.md for function definitions and deployment instructions. Example: IRQL selectors make graph shortest path IRQL handles the data retrieval; make graph handles the graph analysis. This finds the shortest path from an external IP to a mail server through auth events: Example: IRQL selectors make graph connected components Find clusters of IPs and domains that are interconnected potential C2 infrastructure: Example: IRQL + make graph integration See [references/EXAMPLES.md](references/EXAMPLES.md) for multi source investigation graphs combining IRQL selectors with make graph , and Lift To Graph visual graph examples. Practical Usage Scenarios See [references/SCENARIOS.md](references/SCENARIOS.md) for full worked examples including: Reachability analysis (shortest paths to critical assets) Network segmentation validation (connected components) Blast radius of compromised accounts (variable length path matching) Persistent graph models for SOC teams (graph model + snapshots) MCP Tools Used Tool Purpose kusto query Execute KQL queries including make graph , graph match , and management commands kusto table schema get Discover table columns before building edge/node projections kusto cluster list List available ADX clusters kusto database list List databases in a cluster Opening Queries in Kusto Explorer (Windows Only) Optional convenience feature. The default workflow is to output the KQL in chat and let the user copy it into Kusto Explorer or the VS Code Kusto extension manually. Auto launch is opt in only. Default: Output KQL in Chat Always output the complete KQL with Step 1 (connect) and Step 2 (query) clearly labeled: Then immediately below, output an ADX Web Explorer version that appends graph to table nodes as N, edges as E since ADX Web Explorer cannot render make graph directly: This ensures the output works in both Kusto Explorer (graph visualization) and ADX Web Explorer (tabular results) without the user having to modify anything. Optional: Save and Launch If the user asks to save or open the query in Kusto Explorer, follow the procedure in [references/KUSTO EXPLORER LAUNCH.md](references/KUSTO EXPLORER LAUNCH.md). Key rules: Always use ask user to confirm before writing files or launching executables Always display the file contents in chat so the user can review before opening Never use shell interpolation or here strings — write files via Set Content / Add Content Never encode queries into browser URLs On macOS/Linux, save the .kql file and suggest the VS Code Kusto extension or ADX Web Explorer For make graph visualization (the graph window), the query must end at make graph — do not pipe to graph match . Kusto Explorer only opens the graph visualization window when the output is a graph object, not a table.

azure-kusto-graph