Graph operators

Learn how to use KQL graph operators.

Graph operators enable graph analysis of data by representing tabular data as a graph with nodes and edges, or by referencing persistent graph entities. This setup lets you use graph operations to study the connections and relationships between different data points.

Graph analysis can be performed using either transient graphs (created dynamically from tabular data using make-graph) or persistent graphs (referenced using the graph function). Once a graph is established, you can use graph operators such as graph-match, graph-shortest-paths, and graph-to-table to analyze relationships, find patterns, and transform results back into tabular form for further processing.

Supported graph operators

The following table describes the supported graph operators.

OperatorDescription
make-graphBuilds a graph from tabular data.
graphReferences a persisted graph entity and retrieves the latest or a specific snapshot.
graph-matchSearches for patterns in a graph.
graph-to-tableBuilds nodes or edges tables from a graph.
graph-shortest-pathsFinds the shortest paths from a given set of source nodes to a set of target nodes.
graph-mark-componentsFinds and marks all connected components.