Hayabusa vs Plaso

Hayabusa is a free, open-source tool for Windows event log forensics and threat hunting. It processes EVTX logs from one host or thousands into CSV, JSON or JSONL timelines. Analysis features include computer and event ID metrics, logon summaries, keyword pivoting, HTML summary reports and MITRE ATT&CK mapping. It supports the Sigma specification, including v2 correlation rules; the project describes its curated detection rules as numbering over 4,000. The project says its multithreaded Rust implementation can deliver up to a 5x speed improvement and describes Rust as memory-safe. Hayabusa can run live on one system, process collected logs offline or hunt across endpoints through the Velociraptor Hayabusa artifact. Results can be imported into Elastic Stack, Timesketch and Timeline Explorer, while JSON can be analyzed with jq. Special Windows live-response packages bundle the program with encoded rules and configuration files to reduce files written to the system and help avoid antivirus false positives on YAML rule files. It runs on Windows, macOS and Linux, but no Linux ARM MUSL binary is provided because it does not run properly. The software uses AGPLv3; detection rules use DRL 1.1.

Plaso is a Python-based engine for creating timelines used in digital forensic analysis. Its log2timeline tool extracts events from files, directories, storage-media images, or devices and stores them in a Plaso storage file. The psort tool can filter and sort that data and run automatic analysis. Other command-line tools include image_export, pinfo, and psteal. Documented inputs include Windows event logs and registry data, browser histories, SQLite databases, text logs, and cloud audit logs from AWS CloudTrail, Azure Activity, Google Cloud, and Microsoft 365. Plaso can create a CSV timeline from a storage image using psteal with dynamic output; listed formats also include JSON, JSON Lines, KML, TLN, XLSX, OpenSearch, and Timesketch. The framework supports additional parsers, analysis plug-ins, and scripts for forensic tasks. Documented analysis plug-ins include VirusTotal, NSRL server, and hash tagging. Plaso is free, with no commercial plan or usage limits stated. The project recommends packaged releases for general use and a version no older than six months.