Kusto/KQL — 18 Operations for AI Agents
KQL is how operators interrogate telemetry at cloud scale — Azure Monitor, Sentinel hunting, log analytics. act101 reads query pipelines as structure, so agents understand what a detection actually matches before they touch it.
This page is the canonical reference an AI coding agent uses to refactor, query, and analyze Kusto/KQL code through the act MCP server. 18 operations available: 0 refactor, 18 query, 0 analysis. Each operation is callable from Claude Code, Cursor, Codex, OpenCode, or any MCP-compatible agent host. Click any operation for a stable anchor link suitable for citation.
Worked Kusto/KQL examples
act101 reads a KQL file's let bindings — scalar values, tabular pipelines, or user-defined functions — as declarations, along with the source table your file's own top-level query starts from. The skeleton tags every let binding and the top-level table reference the same way, function, regardless of what the binding holds. symbols covers the same let bindings but not the top-level table reference — it has no rule for the file's own tabular expression — and reports every let binding's kind as variable, whether it holds a scalar duration or a full pipeline. The unit of structure in this grammar is the top-level statement: neither query descends into a let pipeline's own where/summarize/join stages. Each example below is the verbatim output of the command shown, run against the file shown. Query outputs are pretty-printed with the timing block omitted.
Read the elevator telemetry bindings and query source as a skeleton
elevator-telemetry.kql binds SlowCarThreshold to a 45-second duration, CarDoorFaults to a pipeline that counts fault codes per car, and RepeatOffenders to a further pipeline narrowing CarDoorFaults to cars with more than three faults, then joins the first two against the file's own top-level DoorSensorEvents query.
$ act query skeleton elevator-telemetry.kqlBefore
let SlowCarThreshold = 45s;
let CarDoorFaults = DoorSensorEvents
| where FaultCode != ""
| summarize FaultCount = count() by CarId;
let RepeatOffenders = CarDoorFaults
| where FaultCount > 3;
DoorSensorEvents
| where TravelTimeMs > SlowCarThreshold
| join kind=inner CarDoorFaults on CarId
| project CarId, TravelTimeMs, FaultCountOutput
{
"type": "Skeleton",
"declarations": [
{
"kind": "function",
"name": "SlowCarThreshold",
"range": {
"start": {
"file": "elevator-telemetry.kql",
"line": 1,
"column": 1,
"byte_offset": 0
},
"end": {
"file": "elevator-telemetry.kql",
"line": 1,
"column": 27,
"byte_offset": 26
}
},
"name_range": {
"start": {
"file": "elevator-telemetry.kql",
"line": 1,
"column": 5,
"byte_offset": 4
},
"end": {
"file": "elevator-telemetry.kql",
"line": 1,
"column": 21,
"byte_offset": 20
}
}
},
{
"kind": "function",
"name": "CarDoorFaults",
"range": {
"start": {
"file": "elevator-telemetry.kql",
"line": 2,
"column": 1,
"byte_offset": 28
},
"end": {
"file": "elevator-telemetry.kql",
"line": 4,
"column": 44,
"byte_offset": 134
}
},
"name_range": {
"start": {
"file": "elevator-telemetry.kql",
"line": 2,
"column": 5,
"byte_offset": 32
},
"end": {
"file": "elevator-telemetry.kql",
"line": 2,
"column": 18,
"byte_offset": 45
}
}
},
{
"kind": "function",
"name": "RepeatOffenders",
"range": {
"start": {
"file": "elevator-telemetry.kql",
"line": 5,
"column": 1,
"byte_offset": 136
},
"end": {
"file": "elevator-telemetry.kql",
"line": 6,
"column": 25,
"byte_offset": 196
}
},
"name_range": {
"start": {
"file": "elevator-telemetry.kql",
"line": 5,
"column": 5,
"byte_offset": 140
},
"end": {
"file": "elevator-telemetry.kql",
"line": 5,
"column": 20,
"byte_offset": 155
}
}
},
{
"kind": "function",
"name": "DoorSensorEvents",
"range": {
"start": {
"file": "elevator-telemetry.kql",
"line": 7,
"column": 1,
"byte_offset": 198
},
"end": {
"file": "elevator-telemetry.kql",
"line": 10,
"column": 42,
"byte_offset": 337
}
},
"name_range": {
"start": {
"file": "elevator-telemetry.kql",
"line": 7,
"column": 1,
"byte_offset": 198
},
"end": {
"file": "elevator-telemetry.kql",
"line": 7,
"column": 17,
"byte_offset": 214
}
}
}
]
}The skeleton reports four function declarations: SlowCarThreshold, CarDoorFaults, and RepeatOffenders for the three let bindings, and DoorSensorEvents for the table the file's own top-level query starts from.
List the three let bindings as symbols
The file has exactly three let bindings — one scalar, two pipelines — and one top-level query with no binding of its own.
$ act query symbols elevator-telemetry.kqlBefore
let SlowCarThreshold = 45s;
let CarDoorFaults = DoorSensorEvents
| where FaultCode != ""
| summarize FaultCount = count() by CarId;
let RepeatOffenders = CarDoorFaults
| where FaultCount > 3;
DoorSensorEvents
| where TravelTimeMs > SlowCarThreshold
| join kind=inner CarDoorFaults on CarId
| project CarId, TravelTimeMs, FaultCountOutput
{
"type": "Symbols",
"symbols": [
{
"name": "SlowCarThreshold",
"kind": "variable",
"range": {
"start": {
"file": "elevator-telemetry.kql",
"line": 1,
"column": 5,
"byte_offset": 4
},
"end": {
"file": "elevator-telemetry.kql",
"line": 1,
"column": 21,
"byte_offset": 20
}
},
"visibility": "unknown"
},
{
"name": "CarDoorFaults",
"kind": "variable",
"range": {
"start": {
"file": "elevator-telemetry.kql",
"line": 2,
"column": 5,
"byte_offset": 32
},
"end": {
"file": "elevator-telemetry.kql",
"line": 2,
"column": 18,
"byte_offset": 45
}
},
"visibility": "unknown"
},
{
"name": "RepeatOffenders",
"kind": "variable",
"range": {
"start": {
"file": "elevator-telemetry.kql",
"line": 5,
"column": 5,
"byte_offset": 140
},
"end": {
"file": "elevator-telemetry.kql",
"line": 5,
"column": 20,
"byte_offset": 155
}
},
"visibility": "unknown"
}
]
}symbols reports exactly SlowCarThreshold, CarDoorFaults, and RepeatOffenders, all kind: variable, dropping the top-level DoorSensorEvents reference that skeleton listed.
Query
18 query tools, the same on every supported language. Descriptions live in the shared reference: /docs/query-tools.
callers control_flow data_flow definition diagnostics effect_closure effect_summary fix_auto get_type graph import_organize interface mutations references repo_outline skeleton symbols symbols_batch