Tools · Triage collection and timelines · 07 / 24
Chainsaw and Hayabusa: write the false positive beside the hit
A Chainsaw or Hayabusa hit means a rule matched one event. Close it as a false positive only with the matched field, the expected reason, an owner, and a re-check date.
A hit is a match
Both tools emit a rule title, a time, a computer, and a few fields from the event. That row means the rule’s conditions were true for that event. It does not mean the title’s everyday English is a finished account of what happened, and it does not mean the event is unwanted.
The event id and the fields under the title are the evidence. The title is the name of the test that fired. Quote the test name, then quote the field that satisfied it.
The note that sits on the same line
A false-positive note is not the word “benign” by itself. Write the rule title, the event id, the field values that matched, why this host is expected to do that, the name of the team that owns the behavior, and the date you will look again. Store it in the case file next to the hit so a later rule run does not reopen the same row as if it were new.
If you cannot name the owner and the expected path or task, you do not have a false positive yet. You have an open hit.
hit: Scheduled task created (rule title as printed) event: 4698 computer: ACCT-04 matched: TaskName \Microsoft\Windows\SoftwareCenter\DailyInventory note: expected lab inventory task owner: desktop-engineering recheck: 2027-02-01 disposition: false positive
What stays open
A match in a user-writable directory, a task name nobody recognizes, or a parent process you cannot place stays open. “We see this a lot” is not an owner. The re-check date without a reason is not an owner either.
Record the rule-set version on the sheet, because a later update can add a title you have not reviewed. The note applies to the version you ran.
Worked case: the inventory task
Hayabusa marks a high row, and Chainsaw groups a hit under a scheduled-task rule, both for 4698 on ACCT-04. The task name is the lab’s DailyInventory task, created when the image was provisioned, and desktop engineering documents that task. The matched field is the task name, not a surprise binary.
The case line uses the note above and does not promote the rule title into a finding. A second hit the same hour names a task under a user profile with no owner. That one stays open, with the event id and the task path quoted, and no false-positive label.
Diagram
Closing a hit versus parking a label
A false positive is a documented match, not a shrug.
Contains. Rule title, event id, matched fields
Also. Expected reason, owner, re-check date
Effect. The next reader sees why it was closed
Contains. The rule’s name
Also. No owner and no field quote
Effect. Looks decided, and cannot be checked
Check yourself
1. What does a Chainsaw or Hayabusa hit establish by itself?
2. Which set is enough to mark a false positive?
3. A task path sits in a user profile and no team claims it. What do you write?