Skip to content

Home

Hayabusa is a Windows event log fast forensics timeline generator and threat hunting tool created by Yamato Security. Written in memory-safe Rust, multi-threaded for speed, and the only open-source tool with full support for the Sigma specification — including v2 correlation rules.

Get Started Command Reference View on GitHub

Why Hayabusa?

  • Blazing fast

    Written in memory-safe Rust with full multi-threading to parse mountains of .evtx files and produce a single timeline as quickly as possible.

  • Full Sigma support

    The only open-source tool with complete support for the Sigma spec, including v2 correlation rules, backed by 4,000+ curated detection rules.

  • DFIR timelines

    Consolidates events from one host or thousands into a single CSV / JSON / JSONL forensics timeline ready for analysis.

  • Enterprise-wide hunting

    Run live on a single system, collect logs for offline analysis, or hunt across the enterprise with the Velociraptor Hayabusa artifact.

  • Rich analysis output

    Metrics, logon summaries, keyword pivoting, HTML reports, and a detection frequency timeline to surface what matters fast.

  • Plays well with others

    Import results straight into Elastic Stack, Timesketch, Timeline Explorer, or slice JSON with jq.

See it in action

Hayabusa DFIR timeline creation

Browse the Screenshots gallery for terminal output, the HTML results summary, and analysis in LibreOffice, Timeline Explorer and Timesketch.