Centralized KQL management with MITRE ATT&CK mapping, PICERL phases, team sharing, and passkey authentication. Built for Microsoft Defender and Azure Sentinel analysts.
SigninLogs | where TimeGenerated > ago(1h) | where ResultType == "50126" | summarize FailedAttempts = count(), TargetedUsers = dcount(UserPrincipalName), Locations = make_set(Location) by IPAddress | where TargetedUsers > 5 and FailedAttempts > 20 | order by FailedAttempts desc // Password spray pattern detected
Built for analysts who live in KQL. Not a generic note app — purpose-built for detection engineering.
Tag queries with tactics and techniques. Filter your library by ATT&CK coverage gaps.
Map queries to Prepare, Identify, Contain, Eradicate, Recover, Lessons Learned phases.
Scoped to teams. Personal and shared folders. Three roles: Admin, Analyst, Viewer.
WebAuthn/FIDO2 only — no passwords, no OAuth dependencies. Works offline once enrolled.
Full KQL syntax highlighting powered by Monaco (VS Code's editor). Auto-complete, bracket matching.
Multi-stage Dockerfile included. Single docker compose up to deploy.
Critical / High / Medium / Low / Info severity per query. Filter by severity in the library.
AES-256-GCM on all sensitive fields. scrypt key derivation. Session tokens stored as HMAC hashes.
Hierarchical folders, personal vs team scope. Bulk JSON import for migrating existing libraries.
See at a glance which ATT&CK tactics your query library covers — and where you have blind spots.
Public demo instance with pre-loaded sample queries. No sign-up required — use the demo login button.
Docker Compose or bare Node.js. SQLite included — no external database required.
# Clone and configure $ git clone https://github.com/vinsk0h/KQLab $ cd KQLab $ cp .env.example .env # Generate secrets (run twice) $ npm run keygen # Start production instance $ docker compose up -d # → http://localhost:3000
# Requirements: Node.js ≥ 18 $ git clone https://github.com/vinsk0h/KQLab $ cd KQLab $ npm install $ cp .env.example .env # Fill .env then start $ npm start # → http://localhost:3000