Basically Microsoft Graph Security API is a REST API that federates requests to different security products running in your tenant and aggregates the response back and returns the output in JSON format that can be then be sent to Kusto. The value here is aggregating data from multiple disparate security products and provide results in a unified schema. Basically you can send input (ODATA) queries to the API to talk to security products like Azure Security Center, Microsoft Defender ATP, Office 365 ATP, etc. Details are here which provides an overview of the API followed by the alerts schema. The API connects with alerts sources (security products) and not databases like Kusto.
