FOR EVERY AZURE LOG ANALYTICS WORKSPACE

Query every workspace. Change nothing.

A read-only desktop IDE for KQL. Query app telemetry, server and container logs, sign-ins and security data across every workspace and tenant you can sign in to, from one window.

Download for Windows Mac, Linux and VS Code

Free · Windows, macOS and Linux · VS Code extension

slow-requests.kql · 3 workspaces · 2 tenants

AppRequests
| where TimeGenerated > ago(1h)
| summarize P95 = percentile(DurationMs, 95) by Name
| top 20 by P95

Workspace	Name	P95 (ms)
contoso-prod	POST /api/checkout	2,840
fabrikam-web	GET /search	1,915
contoso-prod	GET /api/orders	1,260

Sample data

Developers and SREs

Find slow endpoints, failed dependencies and exceptions in Application Insights without opening the portal.

AppRequests · AppExceptions

Platform and operations

Check heartbeats, performance counters, container logs and Azure activity across every subscription.

Heartbeat · Perf · AzureActivity

Security teams

Hunt across Sentinel workspaces and tenants, review Entra sign-ins, and test rule changes safely.

SigninLogs · SecurityAlert

Everything you reach for in the portal, without the portal.

A fast native editor for anyone who writes KQL against Log Analytics.

Every workspace, every tenant

Sign in with several accounts, pick workspaces across tenants, and run one query against all of them. Each row says where it came from.

IntelliSense that knows your schema

Completions, hover docs and error checks from your workspace’s real tables and columns, plus a table explorer to browse them.

Results you can work with

A fast grid with summarize-by-column, charts, a JSON viewer for dynamic fields, and CSV, Excel or clipboard export.

A query library

Built-in queries for App Insights, VMs, containers, Entra sign-ins and Sentinel, plus your own saved queries.

Ask AI, if you want it

Off by default. Turn it on, add your own API key, and describe what you need; the KQL is checked before it reaches the editor.

Desktop app and VS Code

The same features in a desktop app for Windows, macOS and Linux, and as a Visual Studio Code extension.

FOR MICROSOFT SENTINEL TEAMS

Know what a rule change does before you make it.

If your workspace runs Sentinel, load your analytics rules, edit the query, and replay both versions over past periods. See which alerts would disappear, which would be new and which stay the same, row by row.

Search and load rules from any connected workspace
Compare current and proposed queries side by side
Your rules are never changed. You copy the result when you're ready.

Multiple failed sign-ins followed by success Last 14 days · sample data

Current rule42alerts

Proposed31alerts

Unchanged28alerts

Change	Account	Time
Removed	svc-backup@contoso.com	Oct 12, 03:14
Added	kim@contoso.com	Oct 14, 22:41
Unchanged	ana@contoso.com	Oct 15, 09:02

Read-only. Always.

Nothing changes in Azure

Logvane only reads. A built-in guard blocks any request that could create, change or delete a resource or a rule.

Your sign-in, your permissions

It uses your own Microsoft account. Log Analytics Reader is all it needs, and no secrets are stored.

No telemetry

Queries go straight from your machine to Azure. Nothing is sent to us.

Download Logvane

Free to use. No account to create with us.

Windows app

Windows 10 or 11, x64. Signed with Azure Artifact Signing. Run the installer, or unzip the portable version and run it with no admin rights.

Download for Windows

Or the portable .zip

macOS app

macOS 14 or later. Open the disk image and drag Logvane to Applications. The first time, right-click it and choose Open.

Download for Apple silicon

Or the Intel version

Linux app

x64 or arm64. Install the .deb or .rpm, run the AppImage, or extract the .tar.gz anywhere.

Download .deb (x64)

x64: .rpm · AppImage · .tar.gz
arm64: .deb · .rpm · AppImage · .tar.gz

VS Code extension

Works in Visual Studio Code on Windows, macOS and Linux. In VS Code, open Extensions, choose … then Install from VSIX, and pick the file.

Download the .vsix

Questions

Do I need Microsoft Sentinel?

No. Logvane works with any Log Analytics workspace, including Application Insights and Azure Monitor. Only the rule impact features need Sentinel, because that’s where the rules live.

What permissions does it need?

Read access to the workspaces you want to query, such as the Log Analytics Reader role. Reading Sentinel rules needs Microsoft Sentinel Reader.

Why does Windows warn me about the download?

The app is signed, but SmartScreen can still flag new releases until enough people have downloaded them. Choose More info, then Run anyway.

Is it really free?

Yes. If you turn on Ask AI, it uses your own Anthropic or Azure Foundry key, so any AI costs are billed to you by that provider.

Does it update itself?

The app checks this site for a newer version and tells you when one is ready. It never installs anything without asking.

What does this site collect?

No cookies and no tracking. The site counts how many times each file is downloaded, without storing anything about who downloaded it.