KQL Tool README

This extension provides syntax highlighting, code snippets, and formatting for KQL (Kusto Query Language). Bundled with Webpack

Note: Color highlighting and formatting settings will be automatically added to settings.json when the extension is activated.

You can change the predefined colors and the formatter via settings.json

{
  "scope": "variable.system.kql",
  "settings": {
    "foreground": "#7FDBFF",
    "fontStyle": "bold"
  }
},
{
  "scope": "keyword.logical.kql",
  "settings": {
    "foreground": "#d22020",
    "fontStyle": "bold"
  }
},
{
  "scope": "keyword.clause.kql",
  "settings": {
    "foreground": "#887fff",
    "fontStyle": "bold"
  }
},
{
  "scope": "keyword.operator.symbol.kql",
  "settings": {
    "foreground": "#ef25ce",
    "fontStyle": "bold"
  }
},
{
  "scope": "variable.other.kql",
  "settings": {
    "foreground": "#FFA07A"
  }
},
{
  "scope": "builtin.function.kql",
  "settings": {
    "foreground": "#DDA0DD"
  }
},
{
  "scope": "builtin.aggregation_function.kql",
  "settings": {
    "foreground": "##1E90FF",
  }
},
{
  "scope": "keyword.define.kql",
  "settings": {
    "foreground": "#90EE90",
    "fontStyle": "bold"
  }
},
{
  "scope": "keyword.flowcontrol.kql",
  "settings": {
    "foreground": "#3d31ec",
    "fontStyle": "bold"
  }
},
{
  "scope": "keyword.query.kql",
  "settings": {
    "foreground": "#FFD580"
  }
},
{
  "scope": "type.data.kql",
  "settings": {
    "foreground": "#B0E0E6"
  }
},
{
  "scope": "constant.numeric.kql",
  "settings": {
    "foreground": "#87CEFA"
  }
},
{
  "scope": "comment.singleline.kql, comment.block.kql",
  "settings": {
    "foreground": "#A9A9A9",
    "fontStyle": "italic"
  }
},
{
  "scope": "string.doublequote.kql, string.singlequote.kql",
  "settings": {
    "foreground": "#66FF66",
    "fontStyle": "bold"
  }
},
{
  "scope": "string.verbatim.doublequote.kql, string.verbatim.singlequote.kql",
  "settings": {
    "foreground": "#228B22"
  }
}

  "[kql]": {
    "editor.defaultFormatter": "fangweij.kql-tools-vscode",
    "editor.formatOnSave": true
  },

Code Snippets

I created severval customized code snippets => try typing "inv"

Diagnostics

Reference

Microsoft Learn: KQL Quick Reference

Microsoft Learn: deviceprocessevents table

Microsoft Sentinel security alert schema reference

Feel free to open an issue or send a pull request to help improve this extension 🙂.