KQL Search

Query Details

Copilot Studio - Agent to MCP execution chains

Agent Mcp Execution Chains

Query

let lookback = 7d;
let Roots = AppDependencies
| where TimeGenerated > ago(lookback)
| where tostring(Properties["gen_ai.operation.name"]) == "invoke_agent"
| summarize Agent = take_any(tostring(Properties["gen_ai.agent.name"])),
    Conversation = take_any(tostring(Properties["gen_ai.conversation.id"])),
    User = take_any(coalesce(tostring(Properties["user.email"]), tostring(Properties["user.id"]))),
    Channel = take_any(tostring(Properties["microsoft.channel.name"])),
    RootSuccess = take_any(Success), RootTime = min(TimeGenerated) by OperationId;
let Tools = AppDependencies
| where TimeGenerated > ago(lookback)
| where tostring(Properties["gen_ai.operation.name"]) == "execute_tool"
| extend Tool = tostring(Properties["gen_ai.tool.name"]),
         ToolType = tostring(Properties["gen_ai.tool.type"])
| where Tool has "mcp" or ToolType has "mcp"
| summarize ToolCalls = count(), MCPTools = make_set(Tool, 20),
    ToolTypes = make_set(ToolType, 10), ToolFailures = countif(Success == false),
    LastToolCall = max(TimeGenerated) by OperationId;
Roots
| join kind=inner Tools on OperationId
| project RootTime, LastToolCall, OperationId, Agent, Conversation, User,
    Channel, MCPTools, ToolTypes, ToolCalls, ToolFailures, RootSuccess
| order by LastToolCall desc

Explanation

This query is designed to analyze and reconstruct interactions within a system called "Copilot Studio" over the past seven days. It focuses on linking two types of operations: "InvokeAgent" and "ExecuteTool," specifically those involving a component called "MCP."

Here's a simplified breakdown of what the query does:

  1. Data Collection: It looks at data from the past seven days (lookback = 7d) in a dataset called AppDependencies.

  2. Roots Extraction: It identifies "InvokeAgent" operations, collecting details like the agent's name, conversation ID, user information, channel name, success status, and the earliest time the operation was generated. This is grouped by a unique identifier called OperationId.

  3. Tools Extraction: It identifies "ExecuteTool" operations that involve "MCP" tools. It gathers information such as the tool name, type, the number of times the tool was called, any failures, and the latest time the tool was called. This is also grouped by OperationId.

  4. Data Joining: It combines the results from the "Roots" and "Tools" data based on the OperationId, ensuring that only matching records from both datasets are included.

  5. Output: The final output includes details such as the time of the first and last tool call, operation ID, agent, conversation, user, channel, tools used, tool types, number of tool calls, tool failures, and the success status of the root operation. The results are sorted by the most recent tool call.

  6. Purpose: This query helps in investigating and understanding the sequence of operations, user interactions, and tool usage within the Copilot Studio environment, particularly focusing on execution and discovery activities.

  7. Tags and Techniques: It is associated with specific tactics and techniques (like Execution and Discovery) and is tagged for use in Sentinel-As-Code, custom analysis, and tracing within the Copilot Studio and MCP context.