KQL Event Viewer App

Official public release repository for KQL Event Viewer desktop installers and user documentation.

KQL Event Viewer applies a Windows Event Viewer style workflow to KQL-backed data so analysts can browse, filter, and investigate quickly before writing custom queries.

In short: this app helps teams investigate faster by reducing blank-screen query authoring for common investigation flows while still keeping full KQL control available.

For the full project announcement and background, read: https://www.techchat.blog/2026/04/18/introducing-kql-event-viewer/

Two Ways to Use KQL Event Viewer

Before choosing setup details, pick one of these options:

1. Desktop app (recommended for most users)

• Download and run the Windows installer from this public repository.

2. VS Code extension

• Use the extension panel inside VS Code while reusing the same runtime base (run.py, api/, web/).

Before opening the app (desktop or extension), complete Azure access prerequisites:

1. Sign in to the target Azure tenant/account used for your Sentinel or Log Analytics workspace.
2. Complete MFA prompts.
3. If your organization uses Privileged Identity Management (PIM), activate the required role(s) first.

This avoids startup or query failures caused by missing or inactive tenant access.

Option 1: Desktop App Install and Run

Use the installer published from this public repository:

Install steps:

1. Click the button above or go to the Releases page and download the latest KQLEventViewer-Setup-<version>.exe.
2. Run the installer.
3. Launch KQL Event Viewer App from Start Menu or desktop shortcut.

Option 2: VS Code Extension

VS Code Extension Quick Test

Use this simple flow:

1. Get a local copy of this repository (GUI first)

• Option A: GitHub Desktop -> File -> Clone repository -> AndrewBlumhardt/KQL-Event-Viewer-App
• Option B: Download ZIP from this repo page (Code -> Download ZIP) and extract it
• Option C (PowerShell): git clone https://github.com/AndrewBlumhardt/KQL-Event-Viewer-App.git

2. Install the VSIX manually (GUI)

• In VS Code, open the Extensions view from the left sidebar.
• Select the ... menu in the Extensions panel.
• Select Install from VSIX....
• Browse to the vscode-extension folder inside your cloned copy.
• Select: kql-event-viewer-extension-0.0.2.vsix.

3. Open the cloned folder in VS Code

• In VS Code, select File -> Open Folder...
• Select the KQL-Event-Viewer-App folder (the one that contains run.py)
• This is required so the extension can find the app runtime

4. Run the extension command

• Open Command Palette (Ctrl+Shift+P)
• Run KQL Event Viewer: Open

Make this easier next time:

• Set a keyboard shortcut for KQL Event Viewer: Open from File -> Preferences -> Keyboard Shortcuts.
• After first use, it appears in Command Palette recent history, so you can type KQL and press Enter.

The extension now auto-detects the app runtime from your opened VS Code workspace. If your app files are elsewhere, set kqlEventViewer.appRootPath to that folder.

Useful extension settings:

• kqlEventViewer.autoStartServerOnOpen (default true)
• kqlEventViewer.stopServerOnPanelClose (default false)
• kqlEventViewer.startupTimeoutMs (default 20000)
• kqlEventViewer.appRootPath (default empty, optional override)

Unsigned Installer Notice (Current)

This installer is currently unsigned. Because of that, Windows Defender SmartScreen may show warnings such as "isn't commonly downloaded" or "Publisher: Unknown".

This is expected for an unsigned installer and does not automatically mean the file is malicious.

Install safely using this checklist:

1. Only download from this official public release repository: https://github.com/AndrewBlumhardt/KQL-Event-Viewer-App/releases
2. Confirm the file name matches the release version exactly.
3. If Edge shows "isn't commonly downloaded": select Keep, then Keep anyway.
4. If SmartScreen shows "Windows protected your PC": select More info, then Run anyway.

Safety and Trust Guidance

• This project is open and reviewable in the main development repository: https://github.com/AndrewBlumhardt/KQL-Event-Viewer
• Releases are built from that codebase and published by the maintainer of this repository.
• If you prefer, you can build from source yourself before running.
• A signed installer is planned for a future release when certificate funding is available.

What the installer includes:

• Installs to Program Files
• Registers in Windows Apps and Features
• Includes uninstall support
• Supports periodic in-place upgrades via newer installer versions

First Launch and Operation

1. Startup workspace setup

• The startup screen helps you sign in and select your cloud, subscription, and workspace.
• You can save multiple connection profiles and remove old ones at any time.

2. Workspace and table loading

• After connect, the app retrieves tables from your selected workspace and chosen time range.
• Time range defaults to 24 hours and can be changed.
• Table loading is staged for responsiveness: fast initial rows, then continued loading to your selected cap.

3. Investigation workflow

• Favorite tables can be pinned and re-used between sessions.
• Search supports filter mode and highlight mode.
• Timeline and quick query shaping tools help reduce large result sets.
• Row detail pane supports rapid keyboard navigation and copy-out workflows.

4. Local preferences

• Table layouts, column settings, and connection preferences are saved locally for convenience.
• New users start with no saved connections.

Privacy and Telemetry

• No default tenant, subscription, or workspace IDs are hardcoded in this repository.
• Saved connections are user-local preferences only.
• The app can send sanitized usage telemetry to help track adoption and version distribution.
• Telemetry is designed to avoid customer content and query results.
• Shared telemetry focuses on usage metadata such as app version, cloud type, timezone, and anonymous/session identifiers used for aggregate counting.
• You can review the telemetry payload in the app and disable telemetry from the Overview page at any time.

Security Notes

• The app is designed for local use and runs on loopback by default.
• Authentication is delegated to Azure CLI context.
• No Log Analytics keys are required to be stored in source.

License

Source-available license terms are in LICENSE. Enterprise and commercial usage requires a separate written license.

Public vs Development Repositories

This repository is the public desktop release channel and user documentation set.

Main development repository:

• https://github.com/AndrewBlumhardt/KQL-Event-Viewer

Additional docs in this repository:

• docs/windows-installer.md
• docs/public-release-workflow.md

About the Developer

Andrew Blumhardt is a security engineer focused on Microsoft Sentinel, Azure cloud security, and threat intelligence tooling. KQL Event Viewer was built to make KQL-backed investigation more accessible by combining a familiar Event Viewer style workflow with modern cloud log exploration.

• GitHub: github.com/AndrewBlumhardt
• LinkedIn: linkedin.com/in/andrewblumhardt

Developed with assistance from GitHub Copilot and ChatGPT.