/azure-kusto-graph

name: azure-kusto-graph
description: "Build and query Kusto graphs from natural language. Covers transient graphs (make-graph), persistent graph models/snapshots, pattern matching (graph-match), shortest paths, connected components, and graph-to-table export. Generates the edges-first thinking: define edges, define node lookups, union, make-graph. WHEN: make-graph, graph-match, graph-shortest-paths, graph-to-table, graph-mark-components, persistent graph, graph model, graph snapshot, build a graph from data, find paths between nodes, pattern matching in graph, connected components, transient graph, Kusto graph, KQL graph."
license: MIT
metadata:
  author: Microsoft
  version: "0.0.0-placeholder"

Kusto Graph Semantics

Build transient and persistent graphs from tabular data using KQL graph operators. This skill translates natural language into the edges-first graph construction pattern and graph query operators.

Activation Triggers

Use this skill when the user:

• Wants to build a graph from tabular data (`make-graph`)
• Asks to find patterns, paths, or relationships in data
• Mentions `graph-match`, `graph-shortest-paths`, `graph-to-table`, `graph-mark-components`
• Wants to create a persistent graph model or snapshot
• Says "build a graph", "find the shortest path", "find connected components", "show relationships"
• Asks about transient vs persistent graphs

**Not a natural-language-to-KQL converter.** The input should generally be a working KQL query whose results the user wants converted to a graph, plus a natural-language description of the desired graph structure. Basic NL source requests are supported only when they map directly to a known table with obvious columns. For general NL-to-KQL conversion, use a dedicated query-generation skill (available separately).

**Complementary skills:**

• `azure-kusto-irql` -- composable security query primitives that produce the tabular inputs for graphs
• `azure-kusto-irql-graph` -- IRQL's `Lift_To_Graph` JSON mapping system for richly-typed, icon-decorated graphs in Kusto Explorer

The Edges-First Approach

The fundamental pattern for building graphs in Kusto:

1. Define your EDGES       -> src --> dest, with relationship type/properties
2. Define your NODE LOOKUPS -> display names, types, properties for each node ID
3. Union edge types         -> if you have multiple relationship types
4. Union node lookups       -> if you have multiple node types
5. Call make-graph          -> edges | make-graph Source --> Target with nodes on nodeId

This is how to think in `make-graph`. Edges are the relationships you care about. Nodes are lookup tables that give those IDs a face -- display names, types, properties.

Graph Operators Reference

`make-graph` -- Build a graph from tables

Edges | make-graph SourceId --> TargetId with Nodes on NodeId

• `Edges`: tabular source where each row is an edge
• `SourceId --> TargetId`: columns containing source and target node IDs
• `with Nodes on NodeId`: optional node property table joined by ID
• Supports multiple node tables: `with Nodes1 on Id1, Nodes2 on Id2`
• Nodes appearing in edges but missing from the node table get empty properties

`graph-match` -- Find patterns

G | graph-match (a)-[e]->(b) where <constraints> project <output>

Pattern notation:

| Element | Named | Anonymous | |---|---|---| | Node | `(n)` | `()` | | Edge left->right | `-[e]->` | `-->` | | Edge right->left | `<-[e]-` | `<--` | | Any direction | `-[e]-` | `--` | | Variable length | `-[e*1..5]->` | `-[*1..5]->` |

Multi-hop patterns: `(a)-[e1]->(b)-[e2]->(c)` Star patterns: `(a)--(center)--(b), (c)--(center)--(d)` Cycles control: `cycles = all | none | unique_edges` (default: `unique_edges`)

`graph-shortest-paths` -- Find shortest paths

G | graph-shortest-paths (start)-[e*1..20]->(end)
      where start.name == "Alice" and end.name == "Server01"
      project Path = e, Length = array_length(e)

• Requires at least one variable-length edge
• `output = any` (default, one path per pair) or `output = all` (all equal-length shortest paths)
• Variable-length edge properties returned as dynamic arrays

`graph-to-table` -- Export graph to tables

G | graph-to-table nodes                                     // export nodes
G | graph-to-table edges                                     // export edges
G | graph-to-table nodes as N, edges as E                    // export both
G | graph-to-table nodes with_node_id=Id                     // include node hash ID
G | graph-to-table edges with_source_id=Src with_target_id=Tgt  // include edge endpoint IDs

`graph-mark-components` -- Find connected components

G | graph-mark-components with_component_id=ComponentId
  | graph-to-table nodes
  | summarize Members = make_list(name) by ComponentId

Assigns a `ComponentId` to each node. Nodes in the same connected component share the same ID.

`graph()` function -- Query persistent graphs

graph("MyGraphModel")                              // latest snapshot
graph("MyGraphModel", "Snapshot_2025_01")           // specific snapshot
graph("MyGraphModel", true)                         // transient from model definition

Transient Graphs

Created dynamically during query execution. No setup required. Ideal for ad-hoc analysis, exploration, and prototyping.

Template: Basic two-entity graph

// 1. Define edges
let edges = <SourceTable>
    | summarize <aggregations> by SourceCol, TargetCol;
// 2. Define node lookups
let source_nodes = edges
    | distinct SourceCol
    | project nodeId = SourceCol, label = SourceCol, nodeType = "<SourceType>";
let target_nodes = edges
    | distinct TargetCol
    | project nodeId = TargetCol, label = TargetCol, nodeType = "<TargetType>";
let all_nodes = union source_nodes, target_nodes;
// 3. Build and query the graph
edges
| make-graph SourceCol --> TargetCol with all_nodes on nodeId
| graph-match (