What it does
Hayabusa analyzes Windows event logs using detection rules and produces timelines in CSV, JSON or JSONL formats.
Hayabusa turns Windows event-log collections into a timeline that can be reviewed in other analysis tools. Its README describes Sigma support, local analysis and collecting logs for offline work. Choose the log sources and time window around the investigation, then review matching detections in context. A rule hit is a lead, so retain the underlying event and explain any filtering. Its export formats make it useful when another team needs to continue the analysis in Timesketch or a data-analysis environment.
The README distinguishes the AGPLv3 application license from the Detection Rule License 1.1 used for rules. Keep both in view when redistributing a packaged workflow or modifying rule collections; one open-source label does not describe the whole bundle.
Strengths
- Windows event-log detection and timeline output
- Several export formats
Best for
- Defenders triaging Windows event-log evidence
Sources
- 🦅 About (Oct 26, 2026)