Copilot Studio - Connector latency / response-time anomaly
Agent Response Latency Anomaly
Query
let lookback = 7d;
AppDependencies
| where TimeGenerated > ago(lookback)
| where AppRoleName == "Microsoft Copilot Studio" or DependencyType == "Connector"
| make-series AvgDuration = avg(DurationMs) default = 0.0 on TimeGenerated step 1h by Target
| extend (Anomalies, Score, Baseline) = series_decompose_anomalies(AvgDuration, 2.5, -1, 'linefit')
| mv-expand TimeGenerated to typeof(datetime), AvgDuration to typeof(real),
Anomalies to typeof(long), Score to typeof(real), Baseline to typeof(real)
| where Anomalies != 0
| project TimeGenerated, Target, AvgDuration = round(AvgDuration, 0),
Baseline = round(Baseline, 0), Score = round(Score, 2), Anomalies
| order by abs(Score) descExplanation
This query is designed to identify unusual patterns in the response times of connectors used by Microsoft Copilot Studio. Here's a simple breakdown of what it does:
- Time Frame: It looks at data from the past 7 days.
- Data Source: It examines the
AppDependenciestable. - Filtering: It focuses on entries where the application role is "Microsoft Copilot Studio" or the dependency type is "Connector".
- Data Aggregation: It calculates the average response time (
DurationMs) for each target, broken down into hourly intervals. - Anomaly Detection: It uses a function called
series_decompose_anomaliesto detect anomalies in these average response times. Anomalies are significant deviations from the expected trend. - Data Expansion: It expands the data to include detailed information about each anomaly, such as the time it occurred, the target affected, and the anomaly score.
- Filtering Anomalies: It filters out any data points that are not anomalies.
- Presentation: It presents the results, showing the time, target, average duration, baseline, anomaly score, and anomaly status, sorted by the severity of the anomaly score.
The query helps identify potential issues like degraded backend performance, abuse-related throttling, or problems caused by unusually large or malformed payloads.
