SCENARIOS

let auth_edges = AuthenticationEvents
    | where result == "Successful Login"
    | project Source = username, Target = hostname, edgeType = "LoggedInto";
let net_edges = NetworkFlows
    | where dst_port in (1433, 3306, 5432)  // DB ports
    | project Source = src_host, Target = dst_host, edgeType = "NetworkAccess";
let all_edges = union auth_edges, net_edges;
let nodes = union
    (all_edges | distinct Source | project nodeId = Source),
    (all_edges | distinct Target | project nodeId = Target);
all_edges
| make-graph Source --> Target with nodes on nodeId
| graph-shortest-paths (user)-[path*1..5]->(db)
    where db.nodeId == "DB-SERVER-PROD"
    project
        User = user.nodeId,
        PathLength = array_length(path),
        Route = path.Target
| order by PathLength asc

let edges = NetworkFlows
    | summarize Bytes = sum(bytes) by Source = src_ip, Target = dst_ip;
let nodes = union
    (edges | distinct Source | project nodeId = Source),
    (edges | distinct Target | project nodeId = Target);
edges
| make-graph Source --> Target with nodes on nodeId
| graph-mark-components with_component_id = Segment
| graph-to-table nodes
| summarize Hosts = make_list(nodeId), Size = count() by Segment
| order by Size desc

let edges = union
    (AuthenticationEvents | project Source = username, Target = hostname),
    (FileCreationEvents | project Source = username, Target = hostname);
let nodes = union
    (edges | distinct Source | project nodeId = Source),
    (edges | distinct Target | project nodeId = Target);
edges
| make-graph Source --> Target with nodes on nodeId
| graph-match (compromised)-[e*1..3]->(reached)
    where compromised.nodeId == "jsmith"
    project
        Depth = array_length(e),
        ReachedEntity = reached.nodeId
| summarize ReachedEntities = make_set(ReachedEntity) by Depth

// Step 1: Define the model (run once, requires Database Admin)
.create-or-alter graph_model SOC_Graph
{
  "Schema": {
    "Nodes": {
      "User": {"username": "string", "role": "string"},
      "Host": {"hostname": "string"},
      "IP":   {"ip": "string"}
    },
    "Edges": {
      "AuthTo": {"result": "string", "timestamp": "datetime"},
      "FromIP": {"timestamp": "datetime"}
    }
  },
  "Definition": {
    "Steps": [
      {"Kind": "AddNodes", "Query": "Employees | project username, role", "NodeIdColumn": "username", "Labels": ["User"]},
      {"Kind": "AddNodes", "Query": "AuthenticationEvents | distinct hostname | project hostname", "NodeIdColumn": "hostname", "Labels": ["Host"]},
      {"Kind": "AddEdges",
       "Query": "AuthenticationEvents | project username, hostname, result, timestamp",
       "SourceColumn": "username",
       "TargetColumn": "hostname",
       "Labels": ["AuthTo"]}
    ]
  }
}

## MCP Tools Used