KQL Search

Query Details

Foundry - Agent to MCP execution chains

Foundry Mcp Trace Chains

Query

let Roots = AppDependencies
| where isnotempty(tostring(Properties["gen_ai.agent.name"]))
| summarize Agent = take_any(tostring(Properties["gen_ai.agent.name"])),
    Model = take_any(tostring(Properties["gen_ai.request.model"])),
    ConvId = take_any(tostring(Properties["gen_ai.conversation.id"])),
    RootFailures = countif(Success == false), RootSpans = count()
    by OperationId;
let MCPTools = AppDependencies
| where isnotempty(tostring(Properties["gen_ai.tool.name"]))
| extend
    ToolName = tostring(Properties["gen_ai.tool.name"]),
    ToolType = tostring(Properties["gen_ai.tool.type"]),
    ToolDescription = tostring(Properties["gen_ai.tool.description"]),
    ServerLabel = coalesce(tostring(Properties["gen_ai.tool.server_label"]), tostring(Properties["mcp.server.label"]), tostring(Properties["server_label"])),
    ServerUrl = coalesce(tostring(Properties["gen_ai.tool.server_url"]), tostring(Properties["mcp.server.url"]), tostring(Properties["server_url"])),
    Operation = tostring(Properties["gen_ai.operation.name"])
| extend McpServer = coalesce(ServerUrl, ServerLabel, tostring(Target))
| where ToolType has "mcp" or Operation has "mcp" or ToolName has "mcp" or ToolDescription has "mcp" or McpServer has "mcp"
| extend McpServer = iff(isempty(McpServer), "(server metadata not emitted)", McpServer)
| summarize ToolCalls = count(), MCPTools = make_set(ToolName, 20),
    MCPServers = make_set(McpServer, 10), ToolFailures = countif(Success == false),
    SuccessfulCalls = countif(Success == true), ToolDurationMs = round(sum(DurationMs), 0),
    LastToolCall = max(TimeGenerated)
    by OperationId;
Roots
| join kind=inner MCPTools on OperationId
| project LastToolCall, OperationId, Agent, Model, ConvId, MCPServers,
    MCPTools, ToolCalls, SuccessfulCalls, ToolFailures, ToolDurationMs,
    RootSpans, RootFailures
| order by LastToolCall desc
| take 200

Explanation

This query is designed to analyze and correlate data from Foundry agent spans and MCP (Managed Control Plane) tool calls. Here's a simplified breakdown of what it does:

  1. Data Collection:

    • It collects data from AppDependencies to identify and summarize information about Foundry agents and MCP tools.

  2. Agent Information:

    • It extracts and summarizes details about agents, such as the agent's name, model, conversation ID, and counts of successful and failed operations, grouped by OperationId.

  3. MCP Tool Information:

    • It gathers details about MCP tools, including tool name, type, description, server information, and operation name.
    • It filters for entries related to MCP by checking if any of the tool attributes contain "mcp".
    • It summarizes the number of tool calls, unique tool names, unique servers, counts of successful and failed tool calls, total duration of tool calls, and the timestamp of the last tool call, grouped by OperationId.

  4. Data Correlation:

    • It joins the summarized agent and MCP tool data on OperationId to correlate them.
    • It projects relevant fields such as the last tool call time, operation ID, agent details, MCP server and tool details, and counts of calls and failures.

  5. Output:

    • The results are ordered by the time of the last tool call in descending order.
    • It limits the output to the top 200 entries.

  6. Purpose:

    • This query helps in reconstructing trace-level context for investigation, particularly focusing on execution and discovery tactics, and techniques like command and scripting interpreter (T1059) and cloud service discovery (T1580).

  7. Tags:

    • It is tagged with Sentinel-As-Code, Custom, Foundry, AI, and MCP, indicating its relevance to these areas.

In essence, this query is used to trace and analyze interactions between Foundry agents and MCP tools, providing insights into their operations and performance for security and operational investigations.