Azure Kusto Graph

Kusto Graph Semantics

Build transient and persistent graphs from tabular data using KQL graph operators. This skill translates natural language into the edges-first graph construction pattern and graph query operators.

Activation Triggers

Use this skill when the user:

• Wants to build a graph from tabular data (make-graph)
• Asks to find patterns, paths, or relationships in data
• Mentions graph-match, graph-shortest-paths, graph-to-table, graph-mark-components
• Wants to create a persistent graph model or snapshot
• Says "build a graph", "find the shortest path", "find connected components", "show relationships"
• Asks about transient vs persistent graphs

Not a natural-language-to-KQL converter. The input should generally be a working KQL query whose results the user wants converted to a graph, plus a natural-language description of the desired graph structure. Basic NL source requests are supported only when they map directly to a known table with obvious columns. For general NL-to-KQL conversion, use a dedicated query-generation skill (available separately).

Complementary skills:

• azure-kusto-irql -- composable security query primitives that produce the tabular inputs for graphs
• azure-kusto-irql-graph -- IRQL's Lift_To_Graph JSON mapping system for richly-typed, icon-decorated graphs in Kusto Explorer

The Edges-First Approach

The fundamental pattern for building graphs in Kusto:

1. Define your EDGES       -> src --> dest, with relationship type/properties
2. Define your NODE LOOKUPS -> display names, types, properties for each node ID
3. Union edge types         -> if you have multiple relationship types
4. Union node lookups       -> if you have multiple node types
5. Call make-graph          -> edges | make-graph Source --> Target with nodes on nodeId

This is how to think in make-graph. Edges are the relationships you care about. Nodes are lookup tables that give those IDs a face -- display names, types, properties.

Graph Operators Reference

make-graph -- Build a graph from tables

Edges | make-graph SourceId --> TargetId with Nodes on NodeId

• Edges: tabular source where each row is an edge
• SourceId --> TargetId: columns containing source and target node IDs
• with Nodes on NodeId: optional node property table joined by ID
• Supports multiple node tables: with Nodes1 on Id1, Nodes2 on Id2
• Nodes appearing in edges but missing from the node table get empty properties

graph-match -- Find patterns

G | graph-match (a)-[e]->(b) where <constraints> project <output>

Pattern notation:

Multi-hop patterns: (a)-[e1]->(b)-[e2]->(c) Star patterns: (a)--(center)--(b), (c)--(center)--(d) Cycles control: cycles = all | none | unique_edges (default: unique_edges)

graph-shortest-paths -- Find shortest paths

G | graph-shortest-paths (start)-[e*1..20]->(end)
      where start.name == "Alice" and end.name == "Server01"
      project Path = e, Length = array_length(e)

• Requires at least one variable-length edge
• output = any (default, one path per pair) or output = all (all equal-length shortest paths)
• Variable-length edge properties returned as dynamic arrays

graph-to-table -- Export graph to tables

G | graph-to-table nodes                                     // export nodes
G | graph-to-table edges                                     // export edges
G | graph-to-table nodes as N, edges as E                    // export both
G | graph-to-table nodes with_node_id=Id                     // include node hash ID
G | graph-to-table edges with_source_id=Src with_target_id=Tgt  // include edge endpoint IDs

graph-mark-components -- Find connected components

G | graph-mark-components with_component_id=ComponentId
  | graph-to-table nodes
  | summarize Members = make_list(name) by ComponentId

Assigns a ComponentId to each node. Nodes in the same connected component share the same ID.

graph() function -- Query persistent graphs

graph("MyGraphModel")                              // latest snapshot
graph("MyGraphModel", "Snapshot_2025_01")           // specific snapshot
graph("MyGraphModel", true)                         // transient from model definition

Transient Graphs

Created dynamically during query execution. No setup required. Ideal for ad-hoc analysis, exploration, and prototyping.

Template: Basic two-entity graph

// 1. Define edges
let edges = <SourceTable>
    | summarize <aggregations> by SourceCol, TargetCol;
// 2. Define node lookups
let source_nodes = edges
    | distinct SourceCol
    | project nodeId = SourceCol, label = SourceCol, nodeType = "<SourceType>";
let target_nodes = edges
    | distinct TargetCol
    | project nodeId = TargetCol, label = TargetCol, nodeType = "<TargetType>";
let all_nodes = union source_nodes, target_nodes;
// 3. Build and query the graph
edges
| make-graph SourceCol --> TargetCol with all_nodes on nodeId
| graph-match (s)-[e]->(t)
    where <constraints>
    project Source = s.label, Target = t.label, <edge properties>

Template: Multi-relationship graph

// Multiple edge types -> union them with a common schema
let auth_edges = AuthEvents
    | project Source = username, Target = hostname, edgeType = "authenticates", ts = timestamp;
let net_edges = NetworkEvents
    | project Source = src_ip, Target = url, edgeType = "connects", ts = timestamp;
let all_edges = union auth_edges, net_edges;
// Node lookups from all sources
let user_nodes = Employees | project nodeId = username, label = name, nodeType = "User";
let host_nodes = AuthEvents | distinct hostname | project nodeId = hostname, label = hostname, nodeType = "Host";
let all_nodes = union user_nodes, host_nodes;
all_edges
| make-graph Source --> Target with all_nodes on nodeId

Persistent Graphs

For large-scale, reusable graphs. Stored in database metadata. Support snapshots for historical comparison.

Safety: Creating or altering graph models and snapshots modifies the database. Always show the exact command and confirm with the user before executing .create-or-alter graph_model or .make graph_snapshot.

Step 1: Create a graph model

.create-or-alter graph_model SecurityGraph
{
  "Schema": {
    "Nodes": {
      "User": {"name": "string", "role": "string"},
      "Host": {"hostname": "string"},
      "IP":   {"ip": "string"}
    },
    "Edges": {
      "AuthenticatesTo": {"timestamp": "datetime", "result": "string"},
      "ConnectsFrom":    {"timestamp": "datetime"}
    }
  },
  "Definition": {
    "Steps": [
      {
        "Kind": "AddNodes",
        "Query": "Employees | project name, role",
        "NodeIdColumn": "name",
        "Labels": ["User"]
      },
      {
        "Kind": "AddNodes",
        "Query": "AuthenticationEvents | distinct hostname | project hostname",
        "NodeIdColumn": "hostname",
        "Labels": ["Host"]
      },
      {
        "Kind": "AddEdges",
        "Query": "AuthenticationEvents | project username, hostname, timestamp, result",
        "SourceColumn": "username",
        "TargetColumn": "hostname",
        "Labels": ["AuthenticatesTo"]
      }
    ]
  }
}

Step 2: Create a snapshot

.make graph_snapshot SecurityGraph Snapshot_2025_07

Step 3: Query the snapshot

graph("SecurityGraph")
| graph-match (user)-[auth]->(host)
    where user.role == "Admin" and auth.result == "Failed Login"
    project User = user.name, Host = host.hostname, Time = auth.timestamp

Management commands