Skip to content

Usage

Preparing the Hayabusa CSV

Run Hayabusa with the verbose profile to create the CSV timeline (recommended):

hayabusa csv-timeline -d <EVTX_DIR> -o hayabusa-results.csv -p verbose -w

When you need the full, unabbreviated field information of each event, use the all-field-info-verbose profile instead:

hayabusa csv-timeline -d <EVTX_DIR> -o hayabusa-results.csv -p all-field-info-verbose -w

Profile differences that matter to Mecha Hayabusa (verified against Hayabusa 3.8.0 output):

Profile Detail columns Field names in detail columns
verbose (recommended) Details + ExtraFieldInfo Abbreviated (e.g. Cmdline, Proc, SrcIP)
all-field-info-verbose AllFieldInfo Original event field names (e.g. CommandLine, NewProcessName, SourceIp)

Notes:

  • The detail-parsing tools (parse_details_field, extract_iocs, decode_powershell_commands, analyze_mitre_tactics) parse the Details column by default. When analyzing an all-field-info-verbose CSV, pass detail_source="AllFieldInfo".
  • Both profiles include the MitreTactics / MitreTags columns required by analyze_mitre_tactics and correlate_lateral_movement.

How to execute（HTTP）

uv sync
uv run server.py --transport http --port 9999

Endpoint:

http://127.0.0.1:9999/mcp

By default the server may only read CSV files under the directory it was started in. To allow other locations, pass one or more --dataset-root options (repeatable); paths outside every allowed root — including symlink targets — are rejected:

uv run server.py --transport http --port 9999 --dataset-root /path/to/logs

Install the investigate Skill

The /investigate skill used by the prompt below ships in this repository under skill/. Copy both the English and Japanese skill directories into your Claude skills directory so Claude Code can find them:

mkdir -p ~/.claude/skills
cp -r skill/investigate ~/.claude/skills/
cp -r skill/investigate_jp ~/.claude/skills/

The skill's helper scripts (state.py, report.py, and the chart generators) are then available at ~/.claude/skills/investigate/scripts/, which is where the skill expects them.

How to add to Claude

claude mcp add --transport http hayabusa http://127.0.0.1:9999/mcp

Confirmation:

claude mcp list

Prompt example:

Use investigate Skill

Use Mecha Hayabusa to read hayabusa-results.csv and build an intrusion timeline and report.

Image

Results

Image

An HTML report will be generated. See the "samples" folder for an example.

Image

Image

Image

Ask additional investigation and explanation

What happened in ACC-09?

Image