Save Query
save_querySave a verified KQL query as a reusable named query to avoid re-creating custom searches. The query is tested; only successful runs are saved.
Instructions
Persist a WORKING KQL query as a reusable named query so it never has to be figured out again. Call this after you answer a non-standard question with a custom search query. The query is run once to verify it works; if it errors it is NOT saved.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kql | Yes | KQL starting with 'default | ...' | |
| name | Yes | short snake_case name | |
| roles | No | optional role(s) this query serves: sre, soc, claude, ops | |
| since | No | Time window e.g. '15m ago', '1h ago', '2d ago'. | |
| description | Yes | what the query answers |