chrishuber1/kustoforge

KustoForge is a desktop application for building queries in KQL, the query language used by Microsoft's security and monitoring services. Instead of writing queries by hand, you fill out a form: pick a service category and table, add filters, choose which columns to include, and set sorting and limits. The application generates valid KQL as you work, with a live preview that updates in real time and syntax highlighting. The application covers 52 tables across nine Microsoft service areas: Defender for Endpoint, Entra ID sign-in logs, Defender for Office 365 email data, Vulnerability Management, Microsoft Sentinel, Azure Monitor and Log Analytics, Application Insights, Azure Resource Graph, and Defender for Cloud Apps. Each table comes with column definitions and data type information, which the application uses to show only the operators that make sense for a given column. String columns get text-matching options, datetime columns get time-range operators, numeric columns get comparison operators, and so on. A query library feature lets you save the full state of a form, not just the generated query text, so you can reload a saved query and continue editing it. Keyboard shortcuts are available for copying the generated query, saving, and clearing the form. The interface uses a dark theme with Microsoft blue accents. The application is written in Python using PySide6, a set of Python bindings for the Qt graphical interface framework. You install it by cloning the repository and running pip to install dependencies, then launching the main script. There is also an option to install it as a package and run it from the command line. The project targets SOC analysts, security engineers, and cloud administrators who work with Microsoft's KQL-powered services and want to produce correctly structured queries without memorizing syntax.