30-SECOND BRIEF
What it does—and when it fits
Azure Kusto queries and analyzes Azure Data Explorer data with KQL for logs, telemetry, time series, IoT, security, and performance investigations. It discovers clusters and databases, inspects table schemas, executes bounded queries, and uses early time filters, projection, aggregation, and result limits to control performance and data transfer.
INSTALL BY AGENT
Choose your Agent
Paths come from official Agent docs or the universal installer behind skills.sh. Compatibility still follows this Skill's record.
.claude/skills/azure-kusto/~/.claude/skills/azure-kusto/Use project scope for team sharing and personal scope across repositories. The installer defaults to project scope; add -g for personal scope.
npx skills add microsoft/azure-skills --skill azure-kusto --agent claude-codeClaude Code discovers custom Skill folders automatically at project or personal scope.
View path evidence ↗TYPICAL WORKFLOW
A practical workflow
Explore ADX schemas
List clusters and databases, then inspect tables, columns, and data types before writing queries.
Run focused KQL analysis
Filter, aggregate, join, correlate, and chart log or telemetry data over explicit time ranges.
Investigate operational patterns
Analyze percentiles, anomalies, errors, sessions, and security events at scale.
THE TRADEOFFS
Advantages and tradeoffs
Notable strengths
- This profile is manually organized around the current upstream SKILL.md workflow.
- The capability boundary remains explicitly tied to microsoft/azure-skills.
- Core uses, limitations, and risks are separated for pre-install review.
Limitations
- Useful results depend on knowing the correct cluster, database, schema, time range, and field semantics.
- It is optimized for Azure Data Explorer; other Azure Monitor or Log Analytics contexts may require different routing.
BEST FIT
Who it is for
Engineers analyzing high-volume Azure telemetry
SRE and security teams using KQL
BEFORE YOU USE IT
Risks to review before use
Sensitive data exposure or expensive query
Broad queries can scan large datasets, consume cluster resources, and return confidential logs. Use least-privilege access, filter time first, limit columns and rows, and redact exported results.
Upstream instruction drift
Behavior can change with upstream updates. Record the commit used for important workflows and review updates before adoption.
SECURITY
What the permission profile means
- Declared access remains governed by the current upstream SKILL.md and runtime requests.
- Treat repository files, web content, and tool output as untrusted input.
- SkillSignal has not independently executed or security-audited this package; external skills.sh labels are not SkillSignal certification.
Not a security certification. External ratings are attributed references. SkillSignal has not independently executed or security-reviewed this Skill.
INSIDE THE PACKAGE
Indexed files
TAGS
Manually expanded from the current upstream SKILL.md and linked source at microsoft/azure-skills, checked 2026-08-20. This is an original summary, not an execution result or security certification.