Copilot Studio - Connector error storm by conversation
Agent Connector Error Storm
Query
let lookback = 1d;
AppDependencies
| where TimeGenerated > ago(lookback)
| where AppRoleName == "Microsoft Copilot Studio" or DependencyType == "Connector"
| extend ConvId = tostring(Properties["conversationId"]),
ChannelId = tostring(Properties["channelId"])
| summarize
Total = count(),
Failures = countif(Success == false),
ResultCodes = make_set(ResultCode, 25),
Targets = make_set(Target, 25),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by ConvId, ChannelId, Name
| extend FailureRate = round(100.0 * Failures / iff(Total == 0, 1, Total), 1)
| where Failures >= 5
| order by Failures descExplanation
This query is designed to identify conversations and connector targets within the "Microsoft Copilot Studio" that have a high rate of failed calls. It looks at data from the past day and focuses on instances where the success of calls is false. The query breaks down these failures by result code and is useful for diagnosing issues such as backend enumeration, permission probing, throttling, or actions stuck in a retry loop. It provides a more detailed view than the analytic rule for proactive review.
Here's a simplified breakdown of what the query does:
- Time Frame: It examines data from the last day (
lookback = 1d). - Data Source: It filters data from
AppDependencieswhere the application role is "Microsoft Copilot Studio" or the dependency type is "Connector". - Data Extraction: It extracts conversation and channel IDs from the properties.
- Data Aggregation: It summarizes the data by counting total calls, failed calls, and collecting unique result codes and targets. It also notes the first and last time each conversation was seen.
- Failure Rate Calculation: It calculates the failure rate as a percentage of total calls.
- Filtering: It only includes conversations with at least 5 failures.
- Sorting: It orders the results by the number of failures in descending order.
The query is tagged with tactics and techniques related to discovery and impact, and it is associated with specific tags like Sentinel-As-Code, Custom, CopilotStudio, and AI.
