- Home
- Digital Forensics Software
- Hayabusa
Hayabusa
What it is
Hayabusa is a free tool for Windows event log forensics and threat hunting. It processes EVTX logs from one host or thousands into CSV, JSON, or JSONL timelines. Its analysis features include computer and event ID metrics, logon summaries, keyword pivoting, HTML summary reports, and MITRE ATT&CK mapping. Hayabusa supports the Sigma specification, including v2 correlation rules, and the project describes its curated rules as numbering over 4,000. The project says its multithreaded Rust implementation can provide up to a 5x speed improvement. The tool can run live on a Windows system, analyze collected logs offline, or hunt across endpoints through the Velociraptor Hayabusa artifact. Results can be imported into Elastic Stack, Timesketch, and Timeline Explorer; JSON can also be analyzed with jq. Special Windows live-response packages bundle the program, encoded rules, and configuration files to reduce files written to the system and help avoid antivirus false positives on YAML rules. Hayabusa runs on Linux, macOS, and Windows, but the project does not provide a Linux ARM MUSL binary because it does not run properly. The software uses AGPLv3; detection rules use Detection Rule License 1.1.
For and against
For
- Exports timelines as CSV, JSON, or JSONL
- Supports Sigma v2 correlation rules
- Includes MITRE ATT&CK mapping
- Can analyze collected logs offline
Against
- No Linux ARM MUSL binary is provided
- Mobile forensics is not supported
- Disk imaging is not supported
- Memory forensics is not supported
The verdict
Hayabusa is a free event-log analysis and threat-hunting tool with timeline exports and several investigation features. Its stated platform gap is Linux ARM MUSL, and it is not a mobile, disk-imaging, or memory-forensics tool.
Who it suits
Hayabusa suits analysts investigating Windows event logs or hunting across endpoints. It is available for Linux, macOS, and Windows, with live, offline, and Velociraptor-based workflows listed.
Plans and prices
Hayabusa
GNU AGPLv3 software · detection rules use DRL 1.1
Read 8 Oct 2026 · yamato-security.github.io
On the record
- Analysis features
- Features include computer and event ID metrics, logon summaries, keyword pivoting, HTML summary reports, and MITRE ATT&CK mapping.yamato-security.github.io · read 8 Oct 2026
- Detection rules
- The project homepage describes its curated detection rules as numbering over 4,000.yamato-security.github.io · read 8 Oct 2026
- Enterprise hunting
- Hayabusa can run live on one system, analyze collected logs offline, or hunt across endpoints with the Velociraptor Hayabusa artifact.yamato-security.github.io · read 8 Oct 2026
- Integrations
- The project documents importing results into Elastic Stack, Timesketch, and Timeline Explorer, and analyzing JSON with jq.yamato-security.github.io · read 8 Oct 2026
- Licensing
- Hayabusa is released under AGPLv3 and its detection rules under Detection Rule License 1.1; the project says internal, SaaS, and consulting use are allowed, with a request to open-source improvements made for SaaS use.yamato-security.github.io · read 8 Oct 2026
- Live response
- Special Windows live response packages bundle the binary, XOR-encoded rules, and configuration files to reduce files written to the system and help avoid antivirus false positives on YAML rule files.yamato-security.github.io · read 8 Oct 2026
- Platform limit
- The project says it does not provide a Linux ARM MUSL binary because it does not run properly.yamato-security.github.io · read 8 Oct 2026
- Purpose
- Hayabusa is a Windows event log forensics timeline generator and threat hunting tool.github.com · read 8 Oct 2026
- Security
- Hayabusa is written in Rust, which the project describes as memory-safe.yamato-security.github.io · read 8 Oct 2026
- Sigma support
- Hayabusa supports the Sigma specification, including v2 correlation rules.yamato-security.github.io · read 8 Oct 2026
- Speed
- The project says its Rust implementation is multi-threaded and can deliver up to a 5x speed improvement.yamato-security.github.io · read 8 Oct 2026
- Support
- The maintainers invite bug reports through GitHub and say the project is actively maintained and they are happy to fix reported bugs.yamato-security.github.io · read 8 Oct 2026
- Timeline output
- It consolidates events from one host or thousands into CSV, JSON, or JSONL timelines.yamato-security.github.io · read 8 Oct 2026
