Azure Data Explorer Kusto Analytics
Query, aggregate, and analyze Azure Data Explorer logs, telemetry, and time-series data with KQL.
The skill identifies subscription, cluster, database, table, and query inputs and mentions Viewer-level permissions; no malware or credential theft is evident. However, it supports query execution and resource operations without explicit user confirmation, data-flow disclosure, sensitive-data guidance, least-privilege scoping, or rollback information, so points are deducted.
The workflow, MCP parameters, CLI fallback conditions, and common errors are reasonably consistent and useful on the happy path. Static evidence lacks skill-specific tests, dependency versions, and reproducible key-path coverage; the CLI fallback also covers only some operations, so the score remains limited.
Activation terms and scenarios for logs, telemetry, time series, SIEM, and APM are clear. Boundaries, input/output constraints, permission prerequisites, Chinese-language support, and mainland-China network reachability are not adequately documented, so points are deducted.
The document has clear structure, metadata, version 1.1.1, MIT licensing, examples, parameter tables, best practices, and troubleshooting notes. It lacks a changelog, explicit maintenance owner/update path, installation and dependency guidance, fuller FAQs, and systematic known-limitations disclosure.
The KQL examples and MCP/CLI guidance are directly useful for retrieval, aggregation, time-series, joins, and schema discovery. Real tool calls, result usability, and claimed performance are not verified, and users must supply authentication and environment details, so only limited static effectiveness credit is warranted.
The skill text is auditable, and the repository includes generic CI, evaluation workflow, and harness tests. The supplied evidence does not show azure-kusto-specific tests, execution results, or independent corroboration of its key paths, so verifiability is low.
- KQL execution may expose sensitive logs or consume Azure resources; confirm target scope, permissions, and data-handling requirements first.
- MCP tools, Azure CLI, authentication, and REST API availability are not validated by the supplied skill evidence, so failures may still require user-side environment diagnosis.
- No Chinese examples or evidence of Azure-service reachability from mainland-China networks is provided.
What does this skill do, and when should you use it?
This skill helps agents work with Azure Data Explorer (Kusto/ADX) for log, telemetry, and time-series analysis. It covers resource discovery, table-schema inspection, KQL execution, and result analysis. The documented patterns include filtering, aggregation, joins, time bucketing, percentiles, visualization hints, and anomaly-oriented analysis. Use requires Azure access and either the documented Kusto MCP tools or the Azure CLI fallback path.
Lists Azure Data Explorer clusters and databases; retrieves a table schema; executes KQL against a selected database; applies filtering, aggregation, joins, time bucketing, percentiles, and rendering patterns; produces query columns, rows, statistics, and visualization hints; and provides Azure CLI or Kusto REST API fallback instructions when MCP operations time out, fail authentication, or are unavailable.
- An operations team needs recent application events and errors from an ADX cluster.
- An analyst needs event counts and distributions grouped by dimensions and hourly windows.
- An IoT team needs to inspect sensor telemetry, trends, and anomalous behavior.
- A security team needs to correlate critical logs with error events using a shared identifier.
- An APM team needs response-time percentiles and time-series charts from telemetry.
What are this skill's strengths and limitations?
- Covers the core workflow from cluster and database discovery through schema inspection and KQL execution.
- Includes concrete patterns for logs, telemetry, IoT, security analytics, and APM.
- Documents performance practices such as early filtering, bounded results, and time filters.
- Provides Azure CLI and REST API fallback guidance for unavailable MCP operations.
- Requires an Azure Data Explorer environment, subscription access, and authentication.
- MCP and REST-based operations require network access and can fail because of permissions, timeouts, or ingestion lag.
- The source provides no independent test coverage or detailed client-compatibility evidence for this individual skill.
- Its scope is Kusto/ADX; it is not documented as a general-purpose skill for other Azure data services.
How do you install this skill?
Install the collection with npx skills add microsoft/skills and select the needed skill in the wizard. In Copilot CLI, the documented alternative is /plugin marketplace add microsoft/skills followed by /plugin install azure-skills@skills. The source does not document a standalone azure-kusto installation command; the skill is located at .github/plugins/azure-skills/skills/azure-kusto/SKILL.md.
How do you use this skill?
In an agent with Azure access configured, use a request such as "Run a KQL query on my database to show events from the last hour" or "What tables are in my Kusto database?" Query operations generally require subscription, cluster, database, and query; schema operations also require table.