Hayabusa: the Computer column is not the folder name

Computer is inside the event

A Hayabusa row has a Computer column taken from the event. That is the name the log recorded. The directory where you saved the EVTX files is a label you chose, often the host you thought you collected. The tool does not check that the folder and the column agree.

A copied log can sit in the wrong folder. A forwarded event can name a different computer than the machine whose disk you imaged. The column is still the column.

The filename is a third label

Security.evtx does not include a hostname. The folder and the Computer column are how you place it. If you only have the folder, say the computer name was not read from the row. Do not treat the parent directory as if it were the column.

What to file

File the folder, the Computer value, and the event id. If they disagree, write “disagree” and cite the Computer value for any sentence about which machine logged the event. Cite the folder so someone can find the file. Do not edit the CSV to make the column match the directory.

Worked case: WS-07’s folder, ACCT-04’s event

EVTX files live in cases/WS-07/evtx. A Hayabusa row from that folder shows Computer ACCT-04, channel Security, event 4624. A draft says WS-07 recorded the logon because of the path.

The note quotes the folder as the place the file was stored and ACCT-04 as the Computer value. The logon sentence uses ACCT-04. The file can still be found under the WS-07 directory. The path is not rewritten, and the column is not overwritten.

folder: cases/WS-07/evtx
Computer: ACCT-04
Channel: Security  EventID: 4624
agree: no
sentence about the logon: ACCT-04
folder cited only so the file can be found