DPE incident dashboard

Kusto query to run

Run this in the Kusto Web UI against icmdataro.centralus.kusto.windows.net / IcMDataWarehouse. Then copy the result grid (Ctrl+A, Ctrl+C) and paste it into the dashboard.

let starttm = datetime("2025-07-01 00:00");
let endtm = datetime("2026-03-31 23:59:59");
let icmteam = dynamic(["CLOUDNET\\EEECloudnetSev2","CLOUDNET\\NetworkingNinjas"]);
let IcMList =( cluster('icmdataro.centralus.kusto.windows.net').database('IcMDataWarehouse').IncidentHistory 
| where ChangeDate between (starttm .. endtm) 
| project ChangedBy=toupper(ChangedBy),ChangeCategories,OwningTeamName,ChangeDate,IncidentId,OwningContactAlias=toupper(OwningContactAlias)
| where OwningTeamName in (icmteam) 
| join kind=leftouter  (  cluster('icmdataro.centralus.kusto.windows.net').database('IcMDataWarehouse').IncidentHistory  
| where ChangeDate between (starttm .. endtm)  | summarize min(Severity) by IncidentId ) on $left.IncidentId==$right.IncidentId 
| join kind=leftouter (  cluster('icmdataro.centralus.kusto.windows.net').database('IcMDataWarehouse').IncidentHistory  
| where ChangeDate between (starttm .. endtm)  
| project ChangedBy=toupper(ChangedBy),ChangeCategories,OwningTeamName,ChangeDate,IncidentId,OwningContactAlias=toupper(OwningContactAlias), IncidentSubType, IncidentType  
| where ChangeCategories contains "AssignTeam" 
| where isnotempty( OwningTeamName) 
| order by ChangeDate asc ) on $left.IncidentId==$right.IncidentId 
| distinct IncidentId); 
// base query 
let IcMTeamName = dynamic(["EEECloudnetSev2","NetworkingNinjas","VMControlPlaneExperts"]);//,"WASU"]);
let basequery = cluster('icmdataro.centralus.kusto.windows.net').database('IcMDataWarehouse').IncidentsSnapshotV2 //Incidents 
| where IncidentId in (IcMList)  
| distinct SupportTicketId,IncidentId,CreateDate, ModifiedDate, ImpactStartDate,MitigateDate,TTM=datetime_diff("Hour",MitigateDate,CreateDate),TTR=datetime_diff("Hour",ResolveDate,CreateDate), Severity
//OwningTeamName,OwningTenantName, 
| join kind=inner (cluster('icmdataro.centralus.kusto.windows.net').database('IcmDataWarehouse').IncidentHistory  
| where isnotempty(OwningTeamName) and ChangeDate between (starttm .. endtm)  
| order by ChangeDate asc, IncidentId  
| distinct ChangeDate, IncidentId, OwningTeamName  
| summarize TransferSet=make_list(strcat(ChangeDate," -> ",toupper(OwningTeamName))) by IncidentId  
| where (TransferSet has_any (IcMTeamName))  
| extend IcMTeam = case( TransferSet contains "EEECloudnetSev2" and TransferSet contains "VMControlPlaneExperts", "DPE+VCPE",  
                         TransferSet contains "EEECloudnetSev2" and TransferSet contains "NetworkingNinjas", "DPE+NIT",  
                         TransferSet contains "VMControlPlaneExperts" and TransferSet contains "NetworkingNinjas", "VCPE+NIT",  
                         TransferSet contains "VMControlPlaneExperts" and TransferSet contains "NetworkingNinjas" and TransferSet contains "EEECloudnetSev2", "VCPE+DPE+NIT",  
                         TransferSet contains "VMControlPlaneExperts", "VCPE",  TransferSet contains "EEECloudnetSev2", "DPE", 
                         TransferSet contains "NetworkingNinjas", "NIT",  "Other") 
| project TransferCount=array_length(TransferSet)-1, IncidentId,IcMTeam, TransferSet  ) on $left.IncidentId == $right.IncidentId ;// base query // KPIs 
basequery

Data handling statement

This dashboard accepts query results pasted by the user into a transient in-page text area, parses them in browser memory, and renders visualizations. The pasted text is not written to disk, not stored in browser storage (no localStorage, sessionStorage, cookies, or service-worker cache), and not sent to any server. The text area is cleared from the DOM immediately after parsing. The optional Export action generates a Markdown report client-side and is only persisted if the user explicitly chooses a destination via the browser's Save dialog.

This is functionally equivalent to the user viewing the same results in the Kusto Web UI; access control remains enforced at Kusto. No AI or agentic processing of the data is performed — rendering is purely deterministic JavaScript executed in the user's browser tab.

DPE incident dashboard

Kusto query to run

Data handling statement

Filters

Incidents over time

Severity breakdown

Top transfer destinations

Team distribution

Filtered incidents