Skip to main content

​
Execute cross-workspace KQL query

Action ID: tools.azure_log_analytics.execute_cross_workspace_kql_query Execute a KQL query across multiple Log Analytics workspaces for federated Azure Log Analytics queries. Reference: https://learn.microsoft.com/en-us/rest/api/loganalytics/dataaccess/query/execute

​
Secrets

Optional secrets:
  • azure_log_analytics_oauth: OAuth token AZURE_LOG_ANALYTICS_USER_TOKEN.
  • azure_log_analytics_oauth: OAuth token AZURE_LOG_ANALYTICS_SERVICE_TOKEN.

​
Input fields

​
additional_workspaces
array[string]
required
List of additional workspace IDs to query.
​
query
string
required
KQL query to execute across workspaces.
​
workspace_id
string
required
Primary Log Analytics workspace ID (GUID).
​
base_url
string
Base URL for the Azure Log Analytics API.Default: "https://api.loganalytics.io".Allowed values: https://api.loganalytics.io, https://api.loganalytics.us.
​
timespan
string | null
ISO8601 time period to limit query results (e.g., “P7D” for 7 days).Default: null.

​
Execute KQL query

Action ID: tools.azure_log_analytics.execute_kql_query Execute a KQL query against Azure Log Analytics workspace. Reference: https://learn.microsoft.com/en-us/rest/api/loganalytics/dataaccess/query/execute

​
Secrets

Optional secrets:
  • azure_log_analytics_oauth: OAuth token AZURE_LOG_ANALYTICS_USER_TOKEN.
  • azure_log_analytics_oauth: OAuth token AZURE_LOG_ANALYTICS_SERVICE_TOKEN.

​
Input fields

​
query
string
required
KQL query to execute (e.g., “SecurityIncident | take 10”).
​
workspace_id
string
required
Log Analytics workspace ID (GUID).
​
base_url
string
Base URL for the Azure Log Analytics API.Default: "https://api.loganalytics.io".Allowed values: https://api.loganalytics.io, https://api.loganalytics.us.
​
timespan
string | null
ISO8601 time period to limit query results (e.g., “P7D” for 7 days, “PT1H” for 1 hour).Default: null.