This repository was archived by the owner on Jun 15, 2026. It is now read-only.

PythonModule.md

Latest commit

History

History
81 lines (51 loc) · 2.37 KB

PythonModule.md

File metadata and controls

81 lines (51 loc) · 2.37 KB
Raw

Real-Time KQL for Python

Contents

Download & Setup

In an Administrator Command Prompt, Anaconda Prompt, or any elevated terminal window of your choosing, run:

pip install realtimekql

Using a virtual environment of some sort is not required, but is recommended.

Usage

Real-Time KQL is broken up into three parts: the output, the query, and the input.

The Output

Real-Time KQL for Python has a PythonOutput class that allows you to customize what happens to events when they are outputted. The simplest usage of the PythonOutput class is to instantiate it with no parameters. This will print events to console in JSON format:

>>> from realtimekql import *
>>> o = PythonOutput()

To customize the output, you can pass in any Python function that takes a dictionary as the only parameter to the PythonOutput class. For example, this function stores events in a list to use them later:

>>> events = []
>>> def storeEvents(event):
... events.append(event)
...
>>> from realtimekql import *
>>> o = PythonOutput(storeEvents)

The PythonAdxOutput class allows you to ingest data to an Azure Data Explorer (Kusto) table through queued ingestion. The class can be instantiated as follows:

>>> from realtimekql import *
>>> o = PythonAdxOutput("YourCluster.kusto.windows.net", "YourDatabase", "YourTable", "YourClientId", "YourClientSecret", "YourAuthorityId", resetTable=True)

The Query

You can optionally pass a .kql query into Real-Time KQL to filter, transform, and enrich your events before they even reach the output stage.

The Input

Real-Time KQL supports various real-time and file input sources. Each input class takes a unique set of arguments, an instance of one of the output classes, as well as an optional path to a query file. This prints real-time Etw TCP events to console in JSON format:

>>> from realtimekql import *
>>> o = PythonOutput()
>>> e = EtwSession("tcp", o)
>>> e.Start()

Here are all the supported input options and how to use them:

EtwSession(sessionName, o, q)
EtlFileReader(filePath, o, q)
WinlogRealTime(logName, o, q)
EvtxFileReader(filePath, o, q)
CsvFileReader(filePath, o, q)

The variables o and q represent the output part and the query part respectively. The query part is optional and can be left out.

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content

This repository was archived by the owner on Jun 15, 2026. It is now read-only.

PythonModule.md
Latest commit
History
History
81 lines (51 loc) · 2.37 KB
PythonModule.md
File metadata and controls
81 lines (51 loc) · 2.37 KB
Raw
Real-Time KQL for Python
Contents
Download & Setup
In an Administrator Command Prompt, Anaconda Prompt, or any elevated terminal window of your choosing, run:
pip install realtimekql

Using a virtual environment of some sort is not required, but is recommended.
Usage
Real-Time KQL is broken up into three parts: the output, the query, and the input.
The Output
Real-Time KQL for Python has a PythonOutput class that allows you to customize what happens to events when they are outputted. The simplest usage of the PythonOutput class is to instantiate it with no parameters. This will print events to console in JSON format:
>>> from realtimekql import *
>>> o = PythonOutput()

To customize the output, you can pass in any Python function that takes a dictionary as the only parameter to the PythonOutput class. For example, this function stores events in a list to use them later:
>>> events = []
>>> def storeEvents(event):
... events.append(event)
...
>>> from realtimekql import *
>>> o = PythonOutput(storeEvents)

The PythonAdxOutput class allows you to ingest data to an Azure Data Explorer (Kusto) table through queued ingestion. The class can be instantiated as follows:
>>> from realtimekql import *
>>> o = PythonAdxOutput("YourCluster.kusto.windows.net", "YourDatabase", "YourTable", "YourClientId", "YourClientSecret", "YourAuthorityId", resetTable=True)

The Query
You can optionally pass a .kql query into Real-Time KQL to filter, transform, and enrich your events before they even reach the output stage.
The Input
Real-Time KQL supports various real-time and file input sources. Each input class takes a unique set of arguments, an instance of one of the output classes, as well as an optional path to a query file. This prints real-time Etw TCP events to console in JSON format:
>>> from realtimekql import *
>>> o = PythonOutput()
>>> e = EtwSession("tcp", o)
>>> e.Start()

Here are all the supported input options and how to use them:
EtwSession(sessionName, o, q)
EtlFileReader(filePath, o, q)
WinlogRealTime(logName, o, q)
EvtxFileReader(filePath, o, q)
CsvFileReader(filePath, o, q)

The variables o and q represent the output part and the query part respectively. The query part is optional and can be left out.

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content

This repository was archived by the owner on Jun 15, 2026. It is now read-only.

PythonModule.md
Latest commit
History
History
81 lines (51 loc) · 2.37 KB
PythonModule.md
File metadata and controls
81 lines (51 loc) · 2.37 KB
Raw
Real-Time KQL for Python
Contents
Download & Setup
In an Administrator Command Prompt, Anaconda Prompt, or any elevated terminal window of your choosing, run:
pip install realtimekql

Using a virtual environment of some sort is not required, but is recommended.
Usage
Real-Time KQL is broken up into three parts: the output, the query, and the input.
The Output
Real-Time KQL for Python has a PythonOutput class that allows you to customize what happens to events when they are outputted. The simplest usage of the PythonOutput class is to instantiate it with no parameters. This will print events to console in JSON format:
>>> from realtimekql import *
>>> o = PythonOutput()

To customize the output, you can pass in any Python function that takes a dictionary as the only parameter to the PythonOutput class. For example, this function stores events in a list to use them later:
>>> events = []
>>> def storeEvents(event):
... events.append(event)
...
>>> from realtimekql import *
>>> o = PythonOutput(storeEvents)

The PythonAdxOutput class allows you to ingest data to an Azure Data Explorer (Kusto) table through queued ingestion. The class can be instantiated as follows:
>>> from realtimekql import *
>>> o = PythonAdxOutput("YourCluster.kusto.windows.net", "YourDatabase", "YourTable", "YourClientId", "YourClientSecret", "YourAuthorityId", resetTable=True)

The Query
You can optionally pass a .kql query into Real-Time KQL to filter, transform, and enrich your events before they even reach the output stage.
The Input
Real-Time KQL supports various real-time and file input sources. Each input class takes a unique set of arguments, an instance of one of the output classes, as well as an optional path to a query file. This prints real-time Etw TCP events to console in JSON format:
>>> from realtimekql import *
>>> o = PythonOutput()
>>> e = EtwSession("tcp", o)
>>> e.Start()

Here are all the supported input options and how to use them:
EtwSession(sessionName, o, q)
EtlFileReader(filePath, o, q)
WinlogRealTime(logName, o, q)
EvtxFileReader(filePath, o, q)
CsvFileReader(filePath, o, q)

The variables o and q represent the output part and the query part respectively. The query part is optional and can be left out.

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content

This repository was archived by the owner on Jun 15, 2026. It is now read-only.

PythonModule.md
Latest commit
History
History
81 lines (51 loc) · 2.37 KB
PythonModule.md
File metadata and controls
81 lines (51 loc) · 2.37 KB
Raw
Real-Time KQL for Python
Contents
Download & Setup
In an Administrator Command Prompt, Anaconda Prompt, or any elevated terminal window of your choosing, run:
pip install realtimekql

Using a virtual environment of some sort is not required, but is recommended.
Usage
Real-Time KQL is broken up into three parts: the output, the query, and the input.
The Output
Real-Time KQL for Python has a PythonOutput class that allows you to customize what happens to events when they are outputted. The simplest usage of the PythonOutput class is to instantiate it with no parameters. This will print events to console in JSON format:
>>> from realtimekql import *
>>> o = PythonOutput()

To customize the output, you can pass in any Python function that takes a dictionary as the only parameter to the PythonOutput class. For example, this function stores events in a list to use them later:
>>> events = []
>>> def storeEvents(event):
... events.append(event)
...
>>> from realtimekql import *
>>> o = PythonOutput(storeEvents)

The PythonAdxOutput class allows you to ingest data to an Azure Data Explorer (Kusto) table through queued ingestion. The class can be instantiated as follows:
>>> from realtimekql import *
>>> o = PythonAdxOutput("YourCluster.kusto.windows.net", "YourDatabase", "YourTable", "YourClientId", "YourClientSecret", "YourAuthorityId", resetTable=True)

The Query
You can optionally pass a .kql query into Real-Time KQL to filter, transform, and enrich your events before they even reach the output stage.
The Input
Real-Time KQL supports various real-time and file input sources. Each input class takes a unique set of arguments, an instance of one of the output classes, as well as an optional path to a query file. This prints real-time Etw TCP events to console in JSON format:
>>> from realtimekql import *
>>> o = PythonOutput()
>>> e = EtwSession("tcp", o)
>>> e.Start()

Here are all the supported input options and how to use them:
EtwSession(sessionName, o, q)
EtlFileReader(filePath, o, q)
WinlogRealTime(logName, o, q)
EvtxFileReader(filePath, o, q)
CsvFileReader(filePath, o, q)

The variables o and q represent the output part and the query part respectively. The query part is optional and can be left out.

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content

This repository was archived by the owner on Jun 15, 2026. It is now read-only.

PythonModule.md
Latest commit
History
History
81 lines (51 loc) · 2.37 KB
PythonModule.md
File metadata and controls
81 lines (51 loc) · 2.37 KB
Raw
Real-Time KQL for Python
Contents
Download & Setup
In an Administrator Command Prompt, Anaconda Prompt, or any elevated terminal window of your choosing, run:
pip install realtimekql

Using a virtual environment of some sort is not required, but is recommended.
Usage
Real-Time KQL is broken up into three parts: the output, the query, and the input.
The Output
Real-Time KQL for Python has a PythonOutput class that allows you to customize what happens to events when they are outputted. The simplest usage of the PythonOutput class is to instantiate it with no parameters. This will print events to console in JSON format:
>>> from realtimekql import *
>>> o = PythonOutput()

To customize the output, you can pass in any Python function that takes a dictionary as the only parameter to the PythonOutput class. For example, this function stores events in a list to use them later:
>>> events = []
>>> def storeEvents(event):
... events.append(event)
...
>>> from realtimekql import *
>>> o = PythonOutput(storeEvents)

The PythonAdxOutput class allows you to ingest data to an Azure Data Explorer (Kusto) table through queued ingestion. The class can be instantiated as follows:
>>> from realtimekql import *
>>> o = PythonAdxOutput("YourCluster.kusto.windows.net", "YourDatabase", "YourTable", "YourClientId", "YourClientSecret", "YourAuthorityId", resetTable=True)

The Query
You can optionally pass a .kql query into Real-Time KQL to filter, transform, and enrich your events before they even reach the output stage.
The Input
Real-Time KQL supports various real-time and file input sources. Each input class takes a unique set of arguments, an instance of one of the output classes, as well as an optional path to a query file. This prints real-time Etw TCP events to console in JSON format:
>>> from realtimekql import *
>>> o = PythonOutput()
>>> e = EtwSession("tcp", o)
>>> e.Start()

Here are all the supported input options and how to use them:
EtwSession(sessionName, o, q)
EtlFileReader(filePath, o, q)
WinlogRealTime(logName, o, q)
EvtxFileReader(filePath, o, q)
CsvFileReader(filePath, o, q)

The variables o and q represent the output part and the query part respectively. The query part is optional and can be left out.

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content

This repository was archived by the owner on Jun 15, 2026. It is now read-only.

PythonModule.md
Latest commit
History
History
81 lines (51 loc) · 2.37 KB
PythonModule.md
File metadata and controls
81 lines (51 loc) · 2.37 KB
Raw
Real-Time KQL for Python
Contents
Download & Setup
In an Administrator Command Prompt, Anaconda Prompt, or any elevated terminal window of your choosing, run:
pip install realtimekql

Using a virtual environment of some sort is not required, but is recommended.
Usage
Real-Time KQL is broken up into three parts: the output, the query, and the input.
The Output
Real-Time KQL for Python has a PythonOutput class that allows you to customize what happens to events when they are outputted. The simplest usage of the PythonOutput class is to instantiate it with no parameters. This will print events to console in JSON format:
>>> from realtimekql import *
>>> o = PythonOutput()

To customize the output, you can pass in any Python function that takes a dictionary as the only parameter to the PythonOutput class. For example, this function stores events in a list to use them later:
>>> events = []
>>> def storeEvents(event):
... events.append(event)
...
>>> from realtimekql import *
>>> o = PythonOutput(storeEvents)

The PythonAdxOutput class allows you to ingest data to an Azure Data Explorer (Kusto) table through queued ingestion. The class can be instantiated as follows:
>>> from realtimekql import *
>>> o = PythonAdxOutput("YourCluster.kusto.windows.net", "YourDatabase", "YourTable", "YourClientId", "YourClientSecret", "YourAuthorityId", resetTable=True)

The Query
You can optionally pass a .kql query into Real-Time KQL to filter, transform, and enrich your events before they even reach the output stage.
The Input
Real-Time KQL supports various real-time and file input sources. Each input class takes a unique set of arguments, an instance of one of the output classes, as well as an optional path to a query file. This prints real-time Etw TCP events to console in JSON format:
>>> from realtimekql import *
>>> o = PythonOutput()
>>> e = EtwSession("tcp", o)
>>> e.Start()

Here are all the supported input options and how to use them:
EtwSession(sessionName, o, q)
EtlFileReader(filePath, o, q)
WinlogRealTime(logName, o, q)
EvtxFileReader(filePath, o, q)
CsvFileReader(filePath, o, q)

The variables o and q represent the output part and the query part respectively. The query part is optional and can be left out.

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content

This repository was archived by the owner on Jun 15, 2026. It is now read-only.

PythonModule.md
Latest commit
History
History
81 lines (51 loc) · 2.37 KB
PythonModule.md
File metadata and controls
81 lines (51 loc) · 2.37 KB
Raw
Real-Time KQL for Python
Contents
Download & Setup
In an Administrator Command Prompt, Anaconda Prompt, or any elevated terminal window of your choosing, run:
pip install realtimekql

Using a virtual environment of some sort is not required, but is recommended.
Usage
Real-Time KQL is broken up into three parts: the output, the query, and the input.
The Output
Real-Time KQL for Python has a PythonOutput class that allows you to customize what happens to events when they are outputted. The simplest usage of the PythonOutput class is to instantiate it with no parameters. This will print events to console in JSON format:
>>> from realtimekql import *
>>> o = PythonOutput()

To customize the output, you can pass in any Python function that takes a dictionary as the only parameter to the PythonOutput class. For example, this function stores events in a list to use them later:
>>> events = []
>>> def storeEvents(event):
... events.append(event)
...
>>> from realtimekql import *
>>> o = PythonOutput(storeEvents)

The PythonAdxOutput class allows you to ingest data to an Azure Data Explorer (Kusto) table through queued ingestion. The class can be instantiated as follows:
>>> from realtimekql import *
>>> o = PythonAdxOutput("YourCluster.kusto.windows.net", "YourDatabase", "YourTable", "YourClientId", "YourClientSecret", "YourAuthorityId", resetTable=True)

The Query
You can optionally pass a .kql query into Real-Time KQL to filter, transform, and enrich your events before they even reach the output stage.
The Input
Real-Time KQL supports various real-time and file input sources. Each input class takes a unique set of arguments, an instance of one of the output classes, as well as an optional path to a query file. This prints real-time Etw TCP events to console in JSON format:
>>> from realtimekql import *
>>> o = PythonOutput()
>>> e = EtwSession("tcp", o)
>>> e.Start()

Here are all the supported input options and how to use them:
EtwSession(sessionName, o, q)
EtlFileReader(filePath, o, q)
WinlogRealTime(logName, o, q)
EvtxFileReader(filePath, o, q)
CsvFileReader(filePath, o, q)

The variables o and q represent the output part and the query part respectively. The query part is optional and can be left out.

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content

This repository was archived by the owner on Jun 15, 2026. It is now read-only.

PythonModule.md
Latest commit
History
History
81 lines (51 loc) · 2.37 KB
PythonModule.md
File metadata and controls
81 lines (51 loc) · 2.37 KB
Raw
Real-Time KQL for Python
Contents
Download & Setup
In an Administrator Command Prompt, Anaconda Prompt, or any elevated terminal window of your choosing, run:
pip install realtimekql

Using a virtual environment of some sort is not required, but is recommended.
Usage
Real-Time KQL is broken up into three parts: the output, the query, and the input.
The Output
Real-Time KQL for Python has a PythonOutput class that allows you to customize what happens to events when they are outputted. The simplest usage of the PythonOutput class is to instantiate it with no parameters. This will print events to console in JSON format:
>>> from realtimekql import *
>>> o = PythonOutput()

To customize the output, you can pass in any Python function that takes a dictionary as the only parameter to the PythonOutput class. For example, this function stores events in a list to use them later:
>>> events = []
>>> def storeEvents(event):
... events.append(event)
...
>>> from realtimekql import *
>>> o = PythonOutput(storeEvents)

The PythonAdxOutput class allows you to ingest data to an Azure Data Explorer (Kusto) table through queued ingestion. The class can be instantiated as follows:
>>> from realtimekql import *
>>> o = PythonAdxOutput("YourCluster.kusto.windows.net", "YourDatabase", "YourTable", "YourClientId", "YourClientSecret", "YourAuthorityId", resetTable=True)

The Query
You can optionally pass a .kql query into Real-Time KQL to filter, transform, and enrich your events before they even reach the output stage.
The Input
Real-Time KQL supports various real-time and file input sources. Each input class takes a unique set of arguments, an instance of one of the output classes, as well as an optional path to a query file. This prints real-time Etw TCP events to console in JSON format:
>>> from realtimekql import *
>>> o = PythonOutput()
>>> e = EtwSession("tcp", o)
>>> e.Start()

Here are all the supported input options and how to use them:
EtwSession(sessionName, o, q)
EtlFileReader(filePath, o, q)
WinlogRealTime(logName, o, q)
EvtxFileReader(filePath, o, q)
CsvFileReader(filePath, o, q)

The variables o and q represent the output part and the query part respectively. The query part is optional and can be left out.