What problem does it solve? Azure support engineers and SREs need to root-cause VM restarts, disk failures, allocation errors, storage throttling, and network connectivity issues, but the telemetry is scattered across dozens of internal Kusto clusters with no obvious starting point. This Skill turns natural-language incident descriptions into a structured KQL investigation with evidence-backed RCA. ## Core Features & Use Cases - Scenario routing playbooks: 24 playbooks (A–L, core + deep) route intents like VM restart RCA, cant-start/stop, deployment failure, VMSS, disk lifecycle, agent/extension, IMDS/MSI/Serial Console, storage account, and Azure Files to the right clusters and tables. - Curated KQL catalogs and dashboard guides: 15 cluster-organized query catalogs plus reverse-engineered KQL from 162 ASI dashboard pages (2300+ panel queries) with symptom-keyed investigation guides. - Investigation state machine and guardrails: An S0–S6 loop (identify, route, run, interpret, branch, expand, report) with query budgets, permission matrix, error recovery, and parallel batch execution via scripts/kusto_runner.py. - Use Case: A customer reports a VM rebooted at 2 AM. The Skill resolves VM identity via LogContainerSnapshot, checks service healing, live migration, and host update tables across AzureCM and VMInsight, then produces an evidence-ledger RCA distinguishing platform-triggered from customer-triggered restart. ## Quick Start Ask the assistant to investigate why your Azure VM restarted last night using Kusto, providing the subscription ID, VM name, and approximate time window.
