KQL Search

// Confirmed schema: LLMEventData.AISystemPlugin[].{Id, Name}
// Joins against the CopilotApprovedPlugins watchlist (any plugin NOT in
// the approved list AND newly seen / spiking is surfaced).
let baselineWindow = 14d;
let recentWindow = 1d;
let toolEvents =
    CopilotActivity
    | where TimeGenerated > ago(baselineWindow)
    | where RecordType == "CopilotInteraction"
    | mv-expand p = LLMEventData.AISystemPlugin
    | extend
        PluginId = tostring(p.Id),
        PluginName = tostring(p.Name),
        LowerPluginName = tolower(tostring(p.Name))
    | where isnotempty(PluginName);
let approved =
    _GetWatchlist('CopilotApprovedPlugins')
    | project ApprovedPlugin = tolower(tostring(column_ifexists('PluginName', '')))
    | where isnotempty(ApprovedPlugin);
let baseline =
    toolEvents
    | where TimeGenerated between (ago(baselineWindow) .. ago(recentWindow))
    | summarize BaselineCalls = count() by AgentId, AgentName, PluginName, LowerPluginName;
let recent =
    toolEvents
    | where TimeGenerated > ago(recentWindow)
    | summarize RecentCalls = count() by AgentId, AgentName, PluginName, LowerPluginName;
recent
| join kind=leftouter baseline on AgentId, PluginName
| extend BaselineCalls = coalesce(BaselineCalls, 0)
| extend
    IsNewPlugin = BaselineCalls == 0,
    SpikeRatio = iff(BaselineCalls > 0, todouble(RecentCalls) / todouble(BaselineCalls), todouble(RecentCalls))
| join kind=leftanti approved on $left.LowerPluginName == $right.ApprovedPlugin
| where IsNewPlugin or SpikeRatio >= 5.0
| order by IsNewPlugin desc, SpikeRatio desc, RecentCalls desc