Tools · Triage collection and timelines · 04 / 04
Hayabusa: a detection timeline and logon summary from Windows logs
Run Hayabusa over a triage folder of EVTX files to build a CSV timeline of rule hits at medium severity and above, then use logon-summary to see which accounts signed in and from where.
How Hayabusa differs from Chainsaw
Both read EVTX directly and apply Sigma-style rules. Hayabusa’s output is a single timeline across all logs, sorted by time, with severity levels and MITRE tags, designed to feed spreadsheet review or Timesketch. It also ships summary commands for logons, event ID counts, and computers.
A filtered timeline
update-rules pulls the current rule set. csv-timeline writes one row per hit; -m sets the minimum level, -p chooses a column profile, and --UTC keeps timestamps comparable with other sources. In recent versions -w skips the interactive rule-selection wizard.
hayabusa update-rules hayabusa csv-timeline -d /cases/HB-114/WS-07/evtx -o /cases/HB-114/WS-07/hayabusa.csv \ -m medium -p standard --UTC -w Timestamp,Computer,Channel,EventID,Level,RuleTitle,Details 2026-10-28 09:12:44.210 +00:00,WS-07.lab,Sec,4688,med,Proc Exec (PwSh Hidden Window),Cmdline: powershell -nop -w hidden -f C:\Users\Public\u.ps1 ¦ User: kim 2026-10-28 09:14:10.006 +00:00,WS-07.lab,Sys,7045,high,Svc Installed (Susp Path),Svc: OneDriveSyncHelper ¦ Path: C:\Users\Public\u.exe
Who signed in
logon-summary counts successful and failed logons per account, logon type, and source. In this lab case it shows kim with an interactive logon at 08:57 and one network logon from 10.8.0.31, a file server, at 09:20. The second logon widens the scope: the file server now needs the same review.
hayabusa logon-summary -d /cases/HB-114/WS-07/evtx --UTC Successful logons: Count Target Account Target Computer Logon Type Source Computer Source IP 1 kim WS-07 2 - Interactive - - 1 kim WS-07 3 - Network FS-01 10.8.0.31
Worked review discipline
Sort the timeline by level and read every high row, then read every row within ten minutes of them regardless of level. A medium rule for hidden PowerShell is weak alone and strong beside a high-severity service in a user-writable path two minutes later. Record which rule set version produced the timeline, because a later rule update can add or remove rows.
Diagram
Hayabusa commands used in a triage pass
Each answers a different first question.
- update-rules
Which detections am I running? Pin the version in the notes.
- csv-timeline -m medium
What looks suspicious, in time order?
- logon-summary
Which accounts signed in, how, and from where?
- eid-metrics
Which event IDs dominate these logs, and is anything missing?
Check yourself
1. What does -m medium do in csv-timeline?
2. logon-summary shows a network logon from FS-01. What does that change?
3. Why note the rule set version used for a timeline?