Skip to content
SPECIFICTION
Get listed

Hayabusa

github.com

Free plan WindowsmacOSLinux
Visit github.com
Spec score 7.9 #12 of 30 in Digital Forensics Software

What it is

Hayabusa is a free, open-source tool for Windows event log forensics and threat hunting. It processes EVTX logs from one host or thousands into CSV, JSON or JSONL timelines. Analysis features include computer and event ID metrics, logon summaries, keyword pivoting, HTML summary reports and MITRE ATT&CK mapping. It supports the Sigma specification, including v2 correlation rules; the project describes its curated detection rules as numbering over 4,000. The project says its multithreaded Rust implementation can deliver up to a 5x speed improvement and describes Rust as memory-safe. Hayabusa can run live on one system, process collected logs offline or hunt across endpoints through the Velociraptor Hayabusa artifact. Results can be imported into Elastic Stack, Timesketch and Timeline Explorer, while JSON can be analyzed with jq. Special Windows live-response packages bundle the program with encoded rules and configuration files to reduce files written to the system and help avoid antivirus false positives on YAML rule files. It runs on Windows, macOS and Linux, but no Linux ARM MUSL binary is provided because it does not run properly. The software uses AGPLv3; detection rules use DRL 1.1.

Spec sheet

Purpose
Hayabusa is a Windows event log forensics timeline generator and threat hunting tool.Read 8 Oct 2026 · github.com
Platforms
The project lists Windows, Linux, and macOS support, with binaries for those operating systems.Read 8 Oct 2026 · yamato-security.github.io
Integrations
The project documents importing results into Elastic Stack, Timesketch, and Timeline Explorer, and analyzing JSON with jq.Read 8 Oct 2026 · yamato-security.github.io
Security
Hayabusa is written in Rust, which the project describes as memory-safe.Read 8 Oct 2026 · yamato-security.github.io
Support
The maintainers invite bug reports through GitHub and say the project is actively maintained and they are happy to fix reported bugs.Read 8 Oct 2026 · yamato-security.github.io
Analysis features
Features include computer and event ID metrics, logon summaries, keyword pivoting, HTML summary reports, and MITRE ATT&CK mapping.Read 8 Oct 2026 · yamato-security.github.io
Detection rules
The project homepage describes its curated detection rules as numbering over 4,000.Read 8 Oct 2026 · yamato-security.github.io
Enterprise hunting
Hayabusa can run live on one system, analyze collected logs offline, or hunt across endpoints with the Velociraptor Hayabusa artifact.Read 8 Oct 2026 · yamato-security.github.io
Licensing
Hayabusa is released under AGPLv3 and its detection rules under Detection Rule License 1.1; the project says internal, SaaS, and consulting use are allowed, with a request to open-source improvements made for SaaS use.Read 8 Oct 2026 · yamato-security.github.io
Live response
Special Windows live response packages bundle the binary, XOR-encoded rules, and configuration files to reduce files written to the system and help avoid antivirus false positives on YAML rule files.Read 8 Oct 2026 · yamato-security.github.io
Platform limit
The project says it does not provide a Linux ARM MUSL binary because it does not run properly.Read 8 Oct 2026 · yamato-security.github.io
Sigma support
Hayabusa supports the Sigma specification, including v2 correlation rules.Read 8 Oct 2026 · yamato-security.github.io
Speed
The project says its Rust implementation is multi-threaded and can deliver up to a 5x speed improvement.Read 8 Oct 2026 · yamato-security.github.io
Timeline output
It consolidates events from one host or thousands into CSV, JSON, or JSONL timelines.Read 8 Oct 2026 · yamato-security.github.io

Plans and prices

Hayabusa Free GNU AGPLv3 software · detection rules use DRL 1.1 Read 8 Oct 2026 · yamato-security.github.io

Every Hayabusa plan and price →

Strong points and limits

Strong points

  • Exports timelines as CSV, JSON and JSONL.
  • Supports Sigma, including v2 correlation rules.
  • Includes HTML reports and MITRE ATT&CK mapping.
  • Can analyze logs live, offline or across endpoints.
  • Free software under AGPLv3.

Limits

  • No Linux ARM MUSL binary is provided.
  • Detection rules use a separate DRL 1.1 license.
  • Mobile, disk imaging and memory forensics are not supported.

Who it suits

Hayabusa suits security teams and analysts working with Windows event logs for timeline creation or threat hunting. Its live, offline and Velociraptor options cover single-system analysis through endpoint hunts.

Verdict

Hayabusa combines event-log timelines, Sigma detections and hunting workflows with several export and analysis options. Note the separate detection-rule license and the stated Linux ARM MUSL limitation.

Where Specifiction places it

Alternatives to HayabusaAll alternatives →