Skill210 repo starsupdated 2d ago

azure-kusto

**ANALYSIS SKILL** — Query and analyze data in Azure Data Explorer (Kusto/ADX) using KQL. WHEN: "KQL queries", "Kusto database queries", "Azure Data Explorer", "ADX clusters", "time series data", "IoT telemetry", "anomaly detection". DO NOT USE FOR: App Insights / Log Analytics troubleshooting (azure-diagnostics), cost analysis (azure-cost-optimization).

View source Repository: apex

Install in Claude Code

Copy

git clone --depth 1 https://github.com/jonathan-vella/apex /tmp/azure-kusto && cp -r /tmp/azure-kusto/.github/skills/azure-kusto ~/.claude/skills/azure-kusto

Then start a new Claude Code session; the skill loads automatically.

Definition

SKILL.md

# Azure Data Explorer (Kusto) Query & Analytics

Execute KQL queries against Azure Data Explorer for fast, scalable big-data
analytics on log, telemetry, and time-series data.

## Prerequisites

- **Azure CLI** authenticated (`az login`) with a subscription containing Kusto resources
- **RBAC**: `AllDatabasesViewer` on the cluster, or `Database Viewer` per database
- **Azure MCP server** configured in `.vscode/mcp.json` for the `mcp_azure-mcp_kusto`
  namespace; CLI fallback in
  [`references/fallback-strategy.md`](references/fallback-strategy.md)

## Steps

1. **Discover resources** — list clusters and databases in the subscription
2. **Explore schema** — `kusto_table_schema_get` for table structure
3. **Query data** — `kusto_query` with a KQL expression
4. **Analyse results** — aggregate, visualise, export

## Query Patterns Quick Reference

| Pattern               | Use For                            |
| --------------------- | ---------------------------------- |
| Basic Data Retrieval  | Quick inspection, recent events    |
| Aggregation Analysis  | Counting, distribution, top-N      |
| Time Series Analytics | Performance monitoring, trends     |
| Join and Correlation  | Root-cause analysis, event tracing |
| Schema Discovery      | Data model exploration             |

For full KQL syntax, examples, best practices, and performance tips, read
[`references/query-patterns.md`](references/query-patterns.md).

## Rules

- Always include a time-range filter (`where Timestamp > ago(...)`) on time-series tables
- Use `take`/`limit` for exploratory queries
- Filter early (`where` before `join` / `summarize`)
- Use `summarize` for aggregations; `bin()` for time bucketing
- Use `project` to select only needed columns

## MCP Tools

| Tool                     | Purpose                                                 |
| ------------------------ | ------------------------------------------------------- |
| `kusto_cluster_list`     | List Kusto clusters in a subscription                   |
| `kusto_database_list`    | List databases in a cluster                             |
| `kusto_query`            | Execute KQL against a database                          |
| `kusto_table_schema_get` | Retrieve table schema                                   |

Required parameters: `subscription`, `cluster`, `database`, `query` (or `table`).
Optional: `resource-group`, `tenant`.

For CLI fallback (timeouts, auth failures), read
[`references/fallback-strategy.md`](references/fallback-strategy.md).

## Reference Index

| Reference                         | When to Load                                             |
| --------------------------------- | -------------------------------------------------------- |
| `references/query-patterns.md`    | KQL patterns, examples, best practices, common functions |
| `references/fallback-strategy.md` | CLI commands and REST API fallback when MCP tools fail   |

More from this repository

appinsights-instrumentationSkill

Guidance for instrumenting webapps with Azure Application Insights. Provides telemetry patterns, SDK setup, and configuration references. WHEN: how to instrument app, App Insights SDK, telemetry patterns, what is App Insights, Application Insights guidance, instrumentation examples, APM best practices.

azure-aiSkill

Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.

azure-aigatewaySkill

Configure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbreak detection, add Azure OpenAI backend, add AI Foundry model, test AI gateway, LLM policies, configure AI backend, token metrics, AI cost control, convert API to MCP, import OpenAPI to gateway.

azure-diagramsSkill

ROUTING SKILL — delegates to specialized diagram skills. USE FOR: any diagram request when the caller does not know which tool to use. Routes to drawio, python-diagrams, or mermaid based on diagram type.

azure-hosted-copilot-sdkSkill

Build and deploy GitHub Copilot SDK apps to Azure. WHEN: build copilot app, create copilot app, copilot SDK, @github/copilot-sdk, scaffold copilot project, copilot-powered app, deploy copilot app, host on azure, azure model, BYOM, bring your own model, use my own model, azure openai model, DefaultAzureCredential, self-hosted model, copilot SDK service, chat app with copilot, copilot-sdk-service template, azd init copilot, CopilotClient, createSession, sendAndWait, GitHub Models API.

azure-messagingSkill

Troubleshoot and resolve issues with Azure Messaging SDKs for Event Hubs and Service Bus. Covers connection failures, authentication errors, message processing issues, and SDK configuration problems. WHEN: event hub SDK error, service bus SDK issue, messaging connection failure, AMQP error, event processor host issue, message lock lost, send timeout, receiver disconnected, SDK troubleshooting, azure messaging SDK, event hub consumer, service bus queue issue, topic subscription error, enable logging event hub, service bus logging, eventhub python, servicebus java, eventhub javascript, servicebus dotnet, event hub checkpoint, event hub not receiving messages, service bus dead letter.

copilot-customizationSkill

Authoritative reference for VS Code Copilot customization mechanisms: instructions, prompt files, custom agents, agent skills, MCP servers, hooks, and plugins. Use when deciding which customization type to use, creating new .instructions.md/.prompt.md/.agent.md/SKILL.md/mcp.json files from scratch, or debugging why a customization is not loading. DO NOT USE FOR: routine file edits where the format is already known.

count-registrySkill

Provides canonical entity counts from count-manifest.json. Use when agents need to reference how many agents, skills, instructions, or validators exist. Prevents hard-coded counts. WHEN: agent count, skill count, how many agents, how many skills, entity inventory, project statistics.