Build transient and persistent graphs from tabular data using KQL graph operators. This skill translates natural language into the edges-first graph construction pattern and graph query operators.
\nUse this skill when the user:
\nmake-graph)graph-match, graph-shortest-paths, graph-to-table, graph-mark-componentsNot a natural-language-to-KQL converter. The input should generally be a working KQL query whose results the user wants converted to a graph, plus a natural-language description of the desired graph structure. Basic NL source requests are supported only when they map directly to a known table with obvious columns. For general NL-to-KQL conversion, use a dedicated query-generation skill (available separately).
\nComplementary skills:
\nazure-kusto-irql -- composable security query primitives that produce the tabular inputs for graphsazure-kusto-irql-graph -- IRQL's Lift_To_Graph JSON mapping system for richly-typed, icon-decorated graphs in Kusto ExplorerThe fundamental pattern for building graphs in Kusto:
\n1. Define your EDGES -> src --> dest, with relationship type/properties\n2. Define your NODE LOOKUPS -> display names, types, properties for each node ID\n3. Union edge types -> if you have multiple relationship types\n4. Union node lookups -> if you have multiple node types\n5. Call make-graph -> edges | make-graph Source --> Target with nodes on nodeId\nThis is how to think in make-graph. Edges are the relationships you care about. Nodes are lookup tables that give those IDs a face -- display names, types, properties.
make-graph -- Build a graph from tablesEdges | make-graph SourceId --> TargetId with Nodes on NodeId\nEdges: tabular source where each row is an edgeSourceId --> TargetId: columns containing source and target node IDswith Nodes on NodeId: optional node property table joined by IDwith Nodes1 on Id1, Nodes2 on Id2graph-match -- Find patternsG | graph-match (a)-[e]->(b) where <constraints> project <output>\nPattern notation:
\n| Element | \nNamed | \nAnonymous | \n
|---|---|---|
| Node | \n(n) | \n() | \n
| Edge left->right | \n-[e]-> | \n--> | \n
| Edge right->left | \n<-[e]- | \n<-- | \n
| Any direction | \n-[e]- | \n-- | \n
| Variable length | \n-[e*1..5]-> | \n-[*1..5]-> | \n
Multi-hop patterns: (a)-[e1]->(b)-[e2]->(c)\nStar patterns: (a)--(center)--(b), (c)--(center)--(d)\nCycles control: cycles = all | none | unique_edges (default: unique_edges)
graph-shortest-paths -- Find shortest pathsG | graph-shortest-paths (start)-[e*1..20]->(end)\n where start.name == \"Alice\" and end.name == \"Server01\"\n project Path = e, Length = array_length(e)\noutput = any (default, one path per pair) or output = all (all equal-length shortest paths)graph-to-table -- Export graph to tablesG | graph-to-table nodes // export nodes\nG | graph-to-table edges // export edges\nG | graph-to-table nodes as N, edges as E // export both\nG | graph-to-table nodes with_node_id=Id // include node hash ID\nG | graph-to-table edges with_source_id=Src with_target_id=Tgt // include edge endpoint IDs\ngraph-mark-components -- Find connected componentsG | graph-mark-components with_component_id=ComponentId\n | graph-to-table nodes\n | summarize Members = make_list(name) by ComponentId\nAssigns a ComponentId to each node. Nodes in the same connected component share the same ID.
graph() function -- Query persistent graphsgraph(\"MyGraphModel\") // latest snapshot\ngraph(\"MyGraphModel\", \"Snapshot_2025_01\") // specific snapshot\ngraph(\"MyGraphModel\", true) // transient from model definition\nCreated dynamically during query execution. No setup required. Ideal for ad-hoc analysis, exploration, and prototyping.
\n// 1. Define edges\nlet edges = <SourceTable>\n | summarize <aggregations> by SourceCol, TargetCol;\n// 2. Define node lookups\nlet source_nodes = edges\n | distinct SourceCol\n | project nodeId = SourceCol, label = SourceCol, nodeType = \"<SourceType>\";\nlet target_nodes = edges\n | distinct TargetCol\n | project nodeId = TargetCol, label = TargetCol, nodeType = \"<TargetType>\";\nlet all_nodes = union source_nodes, target_nodes;\n// 3. Build and query the graph\nedges\n| make-graph SourceCol --> TargetCol with all_nodes on nodeId\n| graph-match (s)-[e]->(t)\n where <constraints>\n project Source = s.label, Target = t.label, <edge properties>\n// Multiple edge types -> union them with a common schema\nlet auth_edges = AuthEvents\n | project Source = username, Target = hostname, edgeType = \"authenticates\", ts = timestamp;\nlet net_edges = NetworkEvents\n | project Source = src_ip, Target = url, edgeType = \"connects\", ts = timestamp;\nlet all_edges = union auth_edges, net_edges;\n// Node lookups from all sources\nlet user_nodes = Employees | project nodeId = username, label = name, nodeType = \"User\";\nlet host_nodes = AuthEvents | distinct hostname | project nodeId = hostname, label = hostname, nodeType = \"Host\";\nlet all_nodes = union user_nodes, host_nodes;\nall_edges\n| make-graph Source --> Target with all_nodes on nodeId\nFor large-scale, reusable graphs. Stored in database metadata. Support snapshots for historical comparison.
\n\n\nSafety: Creating or altering graph models and snapshots modifies the database. Always show the exact command and confirm with the user before executing
\n.create-or-alter graph_modelor.make graph_snapshot.
.create-or-alter graph_model SecurityGraph\n{\n \"Schema\": {\n \"Nodes\": {\n \"User\": {\"name\": \"string\", \"role\": \"string\"},\n \"Host\": {\"hostname\": \"string\"},\n \"IP\": {\"ip\": \"string\"}\n },\n \"Edges\": {\n \"AuthenticatesTo\": {\"timestamp\": \"datetime\", \"result\": \"string\"},\n \"ConnectsFrom\": {\"timestamp\": \"datetime\"}\n }\n },\n \"Definition\": {\n \"Steps\": [\n {\n \"Kind\": \"AddNodes\",\n \"Query\": \"Employees | project name, role\",\n \"NodeIdColumn\": \"name\",\n \"Labels\": [\"User\"]\n },\n {\n \"Kind\": \"AddNodes\",\n \"Query\": \"AuthenticationEvents | distinct hostname | project hostname\",\n \"NodeIdColumn\": \"hostname\",\n \"Labels\": [\"Host\"]\n },\n {\n \"Kind\": \"AddEdges\",\n \"Query\": \"AuthenticationEvents | project username, hostname, timestamp, result\",\n \"SourceColumn\": \"username\",\n \"TargetColumn\": \"hostname\",\n \"Labels\": [\"AuthenticatesTo\"]\n }\n ]\n }\n}\n.make graph_snapshot SecurityGraph Snapshot_2025_07\ngraph(\"SecurityGraph\")\n| graph-match (user)-[auth]->(host)\n where user.role == \"Admin\" and auth.result == \"Failed Login\"\n project User = user.name, Host = host.hostname, Time = auth.timestamp\n\n\nSafety: All control commands below modify or delete database objects. Never execute
\n.drop,.create-or-alter graph_model, or.make graph_snapshotautomatically. Always show the exact command, cluster, database, and affected object, then require explicit user confirmation before execution.
.show graph_models // list all models\n.show graph_model SecurityGraph // show model details\n.show graph_snapshots SecurityGraph // list snapshots\n.drop graph_snapshot SecurityGraph Snapshot_2025_07 // delete a snapshot (CONFIRM FIRST)\n.drop graph_model SecurityGraph // delete model and all snapshots (CONFIRM FIRST)\n| Factor | \nTransient (make-graph) | \nPersistent (graph()) | \n
|---|---|---|
| Setup | \nNone -- inline in query | \nCreate model + snapshot | \n
| Lifetime | \nQuery execution only | \nStored in database metadata | \n
| Data freshness | \nAlways current | \nSnapshot at creation time | \n
| Scale | \nLimited by query memory | \nEnterprise-scale | \n
| Reuse | \nRebuilt every query | \nShared across users/queries | \n
| Best for | \nAd-hoc hunts, prototyping | \nProduction workflows, dashboards | \n
let auth_edges = AuthenticationEvents\n | summarize\n logins = count(),\n fails = countif(result == \"Failed Login\")\n by src_ip, username, hostname;\nlet ip_nodes = auth_edges | distinct src_ip\n | project nodeId = src_ip, label = src_ip, nodeType = \"IP\";\nlet user_nodes = auth_edges | distinct username\n | project nodeId = username, label = username, nodeType = \"User\";\nlet host_nodes = auth_edges | distinct hostname\n | project nodeId = hostname, label = hostname, nodeType = \"Host\";\nlet all_nodes = union ip_nodes, user_nodes, host_nodes;\n// IP -> User edges\nlet ip_user = auth_edges\n | project Source = src_ip, Target = username, logins, fails;\n// User -> Host edges\nlet user_host = auth_edges\n | project Source = username, Target = hostname, logins, fails;\nunion ip_user, user_host\n| make-graph Source --> Target with all_nodes on nodeId\n| graph-match (ip)-[e1]->(user)-[e2]->(host)\n where e2.fails > 20\n project\n IP = ip.label,\n User = user.label,\n Host = host.label,\n Failures = e2.fails\n| order by Failures desc\n// Pattern: (user1)-[auth1]->(host)<-[auth2]-(user2)\n// Two users both failing on the same host = possible credential spray\nlet edges = AuthenticationEvents\n | summarize fails = countif(result == \"Failed Login\"), logins = count()\n by username, hostname;\nlet nodes = union\n (edges | distinct username | project nodeId = username, nodeType = \"User\"),\n (edges | distinct hostname | project nodeId = hostname, nodeType = \"Host\");\nedges\n| make-graph username --> hostname with nodes on nodeId\n| graph-match (u1)-[e1]->(h)<-[e2]-(u2)\n where u1.nodeId != u2.nodeId and e1.fails > 10 and e2.fails > 10\n project\n User1 = u1.nodeId, User2 = u2.nodeId,\n SharedHost = h.nodeId,\n User1Fails = e1.fails, User2Fails = e2.fails\n| distinct User1, SharedHost, User2, User1Fails, User2Fails\n| order by User1Fails + User2Fails desc\nlet edges = SecurityEvents\n | project Source = source_entity, Target = target_entity, action, timestamp;\nlet nodes = union\n (edges | distinct Source | project nodeId = Source),\n (edges | distinct Target | project nodeId = Target);\nedges\n| make-graph Source --> Target with nodes on nodeId\n| graph-shortest-paths (start)-[e*1..10]->(end)\n where start.nodeId == \"ExternalIP_1.2.3.4\" and end.nodeId == \"DatabaseServer\"\n project\n PathLength = array_length(e),\n Actions = e.action,\n Hops = e.Target\nlet edges = NetworkFlows\n | project Source = src_ip, Target = dst_ip;\nlet nodes = union\n (edges | distinct Source | project nodeId = Source),\n (edges | distinct Target | project nodeId = Target);\nedges\n| make-graph Source --> Target with nodes on nodeId\n| graph-mark-components with_component_id = ComponentId\n| graph-to-table nodes\n| summarize Members = make_list(nodeId), Size = count() by ComponentId\n| order by Size desc\nEnd a query at make-graph (without piping to graph-match) to trigger Kusto Explorer's interactive graph visualization window:
edges\n| make-graph Source --> Target with all_nodes on nodeId\n// <- stop here. Kusto Explorer renders the graph visually.\nTo flatten back to a table for dashboards or export, pipe through graph-match | project or graph-to-table.
When working with security data, consider using IRQL selectors (Get_*) from the azure-kusto-irql skill as the data source. IRQL gives you a unified schema without memorizing raw table names or column mappings. For rich visualization with icons and node folding, the azure-kusto-irql-graph skill's Lift_To_Graph is the faster path.
| Approach | \nBest For | \n
|---|---|
Raw make-graph (this skill) | \nFull control, persistent models, shortest paths, connected components, custom schemas | \n
Lift_To_Graph (azure-kusto-irql-graph) | \nQuick icon-decorated visualization in Kusto Explorer, node folding | \n
IRQL Get_* -> make-graph | \nIRQL's unified schema as input, then raw graph operators for analysis | \n
IRQL Get_* -> Lift_To_Graph -> Graph_Render_View | \nFastest path from question to visual graph | \n
\n\nNote:
\nLift_To_Graph,Graph_Render_View, andGraph_Fold_By_Propertyare stored functions, not built-in operators. They are pre-deployed on the kc7001 example cluster but may need deployment on other clusters. Seeazure-kusto-irql-graph/references/DEPLOY_IRQL_FUNCTIONS.mdfor function definitions and deployment instructions.
IRQL handles the data retrieval; make-graph handles the graph analysis. This finds the shortest path from an external IP to a mail server through auth events:
// IRQL provides unified columns (ClientIp, Hostname, Username, Result)\nlet auth = Get_Event_Authentication_All\n | where Result == \"Failed Login\";\nlet edges = auth\n | summarize Failures = count() by ClientIp, Hostname;\nlet nodes = union\n (edges | distinct ClientIp | project nodeId = ClientIp, nodeType = \"IP\"),\n (edges | distinct Hostname | project nodeId = Hostname, nodeType = \"Host\");\nedges\n| make-graph ClientIp --> Hostname with nodes on nodeId\n| graph-shortest-paths (src)-[e*1..5]->(dest)\n where src.nodeType == \"IP\" and dest.nodeId == \"MAIL-SERVER01\"\n project\n SourceIP = src.nodeId,\n PathLength = array_length(e),\n Hops = e.Hostname\nFind clusters of IPs and domains that are interconnected -- potential C2 infrastructure:
\nlet dns = Get_Dns_All;\nlet edges = dns | project Source = ClientIp, Target = Domain;\nlet nodes = union\n (edges | distinct Source | project nodeId = Source, nodeType = \"IP\"),\n (edges | distinct Target | project nodeId = Target, nodeType = \"Domain\");\nedges\n| make-graph Source --> Target with nodes on nodeId\n| graph-mark-components with_component_id = ComponentId\n| graph-to-table nodes\n| summarize\n IPs = make_set_if(nodeId, nodeType == \"IP\"),\n Domains = make_set_if(nodeId, nodeType == \"Domain\"),\n Size = count()\n by ComponentId\n| where Size > 3\n| order by Size desc\nSee references/EXAMPLES.md for multi-source investigation graphs combining IRQL selectors with make-graph, and Lift_To_Graph visual graph examples.
See references/SCENARIOS.md for full worked examples including:
\n| Tool | \nPurpose | \n
|---|---|
kusto_query | \nExecute KQL queries including make-graph, graph-match, and management commands | \n
kusto_table_schema_get | \nDiscover table columns before building edge/node projections | \n
kusto_cluster_list | \nList available ADX clusters | \n
kusto_database_list | \nList databases in a cluster | \n
\n\nOptional convenience feature. The default workflow is to output the KQL in chat and let the user copy it into Kusto Explorer or the VS Code Kusto extension manually. Auto-launch is opt-in only.
\n
Always output the complete KQL with Step 1 (connect) and Step 2 (query) clearly labeled:
\n// Step 1: Connect to your cluster (skip if already connected)\n// Example: uncomment to connect to the KC7 training cluster\n// #connect cluster('kc7001.eastus.kusto.windows.net').database('ValdyTimes')\n// Or replace with your own cluster:\n// #connect cluster('<YOUR_CLUSTER>').database('<YOUR_DATABASE>')\n\n// Step 2: Run the query below\n<KQL_QUERY ending at make-graph>\nThen immediately below, output an ADX Web Explorer version that appends | graph-to-table nodes as N, edges as E since ADX Web Explorer cannot render make-graph directly:
// ADX Web Explorer version (tabular output):\n<SAME_QUERY>\n| graph-to-table nodes as N, edges as E\nThis ensures the output works in both Kusto Explorer (graph visualization) and ADX Web Explorer (tabular results) without the user having to modify anything.
\nIf the user asks to save or open the query in Kusto Explorer, follow the procedure in references/KUSTO_EXPLORER_LAUNCH.md. Key rules:
\nask_user to confirm before writing files or launching executablesSet-Content/Add-Content.kql file and suggest the VS Code Kusto extension or ADX Web ExplorerFor make-graph visualization (the graph window), the query must end at make-graph — do not pipe to graph-match. Kusto Explorer only opens the graph visualization window when the output is a graph object, not a table.