Yamato-Security/hayabusa

Health v2 · maintenance only

Adoption not part of the score

3324 stars · 291 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Hayabusa is a fast, Rust-based Windows event log analysis tool that generates forensic timelines and performs threat hunting using Sigma detection rules, including full support for Sigma v2 correlation rules. It is developed by Yamato Security and widely used in DFIR and incident response workflows.

Use cases

• generate a forensics timeline from Windows event logs
• hunt for threats in Windows security event logs
• run Sigma detection rules against evtx files
• analyze Windows event logs during incident response
• detect lateral movement and suspicious logon activity
• quickly triage a compromised Windows endpoint
• convert Windows event logs into a readable attack timeline

When to choose

• you need fast, local analysis of Windows event logs without a SIEM
• you want full Sigma rule support including correlation rules
• you are performing DFIR triage and need a timeline quickly
• you want a memory-safe, cross-platform CLI written in Rust

When to avoid

• you need real-time continuous monitoring or alerting from a central SIEM
• you need to analyze non-Windows log sources
• you require a GUI-driven investigation platform

Facets

cli-tool · maturity active

security search-engine developer-tools security windows windows cli rust sigma-rules dfir incident-response event-log-analysis timeline-generation detection-rules mitre-attack threat-hunting forensics linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Yamato-Security/hayabusa")