EXAMPLES · Azure Kusto Graph · microsoft/azure-skills · Skills Docs

EXAMPLES · Azure Kusto Graph · microsoft/azure-skills · Skills Docs

#	Ask This	What It Does
1	“Use IRQL to get auth events in ValdyTimes and build a user-to-host graph”	`Get_Event_Authentication` -> `make-graph` -> `graph-match`
2	“Use IRQL to find failed logins, enrich with employee data, and build a graph showing roles”	IRQL enrichers -> `make-graph` with employee metadata on nodes
3	“Find the shortest auth path from external IPs to a mail server in ValdyTimes”	IRQL -> `make-graph` -> `graph-shortest-paths`
4	“Find DNS clusters of IPs and domains using connected components in ValdyTimes”	IRQL -> `make-graph` -> `graph-mark-components`
5	“Detect credential spray – users sharing failed-login hosts in ValdyTimes”	IRQL -> `make-graph` -> bidirectional `graph-match`
6	“Combine email, auth, and process data into one investigation graph in ValdyTimes”	Multi-IRQL sources -> union -> `make-graph`
7	“Graph outbound connections from IPs to domains in ValdyTimes using IRQL extractors”	`Get_Event_NetworkOutbound` -> `Extract_Event_Network_Domain` -> `make-graph`
8	“A malicious file appeared on hosts – graph the blast radius of processes on those hosts”	IRQL file creation -> victims -> `make-graph` -> variable-length `graph-match`

#	Ask This	What It Does
1	“Build a graph of users authenticating to hosts in AzureCrest”	`AuthenticationEvents` -> edges-first -> `make-graph`
2	“Build a graph showing which IPs authenticate as which users to which hosts in AzureCrest”	Three-entity IP -> User -> Host multi-hop graph
3	“Find users with more than 20 failed logins and the hosts they targeted in AzureCrest, as a graph”	`make-graph` -> `graph-match` with `where` constraint
4	“Find the shortest authentication path from any external IP to a critical server in AzureCrest”	`make-graph` -> `graph-shortest-paths`
5	“Find clusters of IPs and domains that communicate together in AzureCrest”	`PassiveDns` -> `make-graph` -> `graph-mark-components`
6	“Find pairs of users who both have failed logins to the same host in AzureCrest”	Bidirectional `graph-match` for credential spray detection
7	“Build an auth graph from AzureCrest and export nodes and edges as tables”	`make-graph` -> `graph-to-table`
8	“Build a graph of email senders and recipients in AzureCrest”	`Email` -> Sender -> Message -> Recipient graph
9	“Combine email, auth, and process data into one investigation graph in AzureCrest”	Multi-source union -> `make-graph`
10	“Visualize the AzureCrest authentication graph in Kusto Explorer”	`make-graph` without pipe – triggers KE graph window