domains / families / security / generating-forensic-timelines-with-hayabusa

generating-forensic-timelines-with-hayabusa

separate

Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV/JSON timeline with severity levels, MITRE ATT&CK mappings, and per-host/per-Event-ID metrics. Use during DFIR triage to turn raw event logs into a fast, SIEM-free incident timeline, or to export results into Timesketch or Timeline Explorer for collaborative analysis.

When to use

• During incident-response triage, to turn a pile of collected `.evtx` files into a prioritized timeline.
• When you need fast, SIEM-free detection over Windows event logs with community Sigma coverage.
• To enumerate suspicious activity (PowerShell, account changes, lateral movement) across many hosts' logs.
• To produce metrics (events per computer/Event ID/channel) and pivot keywords for deeper hunting.
• To export an incident timeline into Timesketch or Timeline Explorer for collaborative analysis.

Skill page

Source