Kustodian

A desktop KQL workbench for Microsoft Graph, Defender advanced hunting and Azure Resource Graph. One query language, completion that knows the schema, and results right beside your query.

Why

Graph has no query language: answering "which apps have expired credentials?" means paging, $filter quirks and per-object calls. Kustodian fetches Graph data and runs real KQL over it locally, and shows exactly which requests it will send before it sends them. Hunting and Resource Graph queries go straight to their services, in the same editor.

Features

• Three sources, one editor: Graph (beta), Defender hunting via security/runHuntingQuery, and Azure Resource Graph.
• Schema-aware KQL: completion and errors from each source's schema, including nested and mv-expanded fields.
• Explain: see the Graph requests, $filter and permissions a query needs, without sending anything.
• Results: virtualized grid, charts, JSON and diagnostics; compare two runs; export to CSV, JSON or Markdown.
• Workflow: tabs that survive restarts, {name} parameters, snippets, saved queries, history and a command palette.
• Raw Graph requests, like Graph Explorer, with responses you can open as KQL tabs.
• Light and dark themes, and keyboard shortcuts for every action.