Hayabusa

No entries match these filters. Clear filters

1. v4.3.0 Oct 28, 2026 · issue 123

   Hayabusa v4.3.0 adds -Z, --timezone <OFFSET> to six commands and extends unaliased rule-field resolution to EventData and UserData.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.3.0 https://github.com/Yamato-Security/hayabusa.git
   # already have the repo? check out this version:
   $ git checkout v4.3.0

   • Adds -Z, --timezone <OFFSET> to dfir-timeline, search, eid-metrics, logon-summary, log-metrics, and extract-base64 to render output timestamps with a fixed UTC offset in signed +HH:MM or -HH:MM form (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ --timezone "+09:00" or -Z "-01:00"); conflicts with --utc and --iso-8601; filtering, sorting, and histogram bins remain UTC-based.

   1 detail in Everything

2. docs update Oct 5, 2026 · issue 095

   Hayabusa 4.1.0 adds Windows executable version metadata and deterministic scan ordering across OSes and filesystems.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds embedded VERSIONINFO metadata to Windows executables, including product name, file description, company name, copyright, and original filename, with file and product versions auto-generated from the package version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Log files found with -l, --live-analysis (evtx or JSON/JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. via -J) are now scanned in sorted path order, producing a reproducible timeline across OSes and filesystems.
   • Rule files loaded from a rules/ directory (via -r <dir>) are now loaded in sorted path order, ensuring deterministic ordering of same-batch detections across OSes and filesystems.
   • count() by ... aggregation detections in unsorted timelines are now emitted in sorted group-key order, making two scans of identical logs comparable by hash or diff.
   • Adds embedded VERSIONINFO metadata to Windows executables, including product name, file description, company name, copyright, and original filename, with file and product versions auto-generated from the package version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   3 more in Everything

3. v4.1.0 Sep 12, 2026 · issue 073

   Hayabusa v4.1.0 adds sort-csv for post-scan deduplication and GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. enrichment for logon-summary.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.1.0 https://github.com/Yamato-Security/hayabusa.git
   # already have the repo? check out this version:
   $ git checkout v4.1.0

   └──▷ TRY IT
   Merge and deduplicate CSVs collected from multiple endpoints (e.g. via Velociraptor) into a single chronologically sorted output file.
   copy

   $ hayabusa sort-csv -d ./endpoint-csvs/ -o merged-timeline.csv -C

   Enrich a logon summary with GeoIP data to surface foreign source countries and ASNs for each summarized logon event.
   copy

   $ hayabusa logon-summary -d ./evtx/ -G ./GeoIP/ -o logon-summary.csv

   • Adds sort-csv command that sorts a Hayabusa CSV by Timestamp, deduplicates detections by comparing every column except EvtxFile, and accepts a single file via -f, --file, a directory of CSVs via -d, --directory, an output path via -o, --output, and -C, --clobber to overwrite.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds -G, --geo-ip option to the logon-summary command, appending Source ASN, Source Country, and Source City columns for the source IP of each summarized logon.
   • Adds First Logon/Last Logon columns to the logon-summary successful logon table and First Attempt/Last Attempt columns to the failed logon table.
   • Expands logon-summary to aggregate RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. session events from Security event IDs 4778/4779, Terminal Services RemoteConnectionManager/Operational 1149, and LocalSessionManager/Operational 25, in addition to the existing 21 and 302 sources.
   • Expands extract-base64 to scan PowerShell event IDs 4100 and 4102 (Microsoft-Windows-PowerShell/Operational and PowerShellCore/Operational) and classic Windows PowerShell events 403/600, checking the ContextInfo and Payload fields for 4100/4102 and EventData.Data detail blocks for 403/600.

   +2 more show less

   • Adds Linux aarch64 (ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead.) musl release binary (hayabusa-<ver>-lin-aarch64-musl), built with a correct aarch64 musl cross-toolchain.
   • Embeds VERSIONINFO metadata (product name, file description, company name, copyright, original filename) into Windows executables, with file and product versions auto-generated from Cargo.toml.
   • Adds sort-csv command that sorts a Hayabusa CSV by Timestamp, deduplicates detections by comparing every column except EvtxFile, and accepts a single file via -f, --file, a directory of CSVs via -d, --directory, an output path via -o, --output, and -C, --clobber to overwrite.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Linux aarch64 (ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead.) musl release binary (hayabusa-<ver>-lin-aarch64-musl), built with a correct aarch64 musl cross-toolchain.

   5 more in Everything

4. docs update Sep 9, 2026 · issue 069

   Hayabusa gains a sort-csv command to sort, deduplicate, and merge post-scan CSV results.

   └──▷ TRY IT
   Deduplicate and sort results collected from overlapping or backup event log sources across many endpoints into one clean, time-ordered CSV.
   copy

   $ hayabusa sort-csv -f merged_results.csv -o sorted_results.csv

   • Adds sort-csv command that sorts a Hayabusa results CSV by the Timestamp column, removes duplicate detections (comparing every column except Timestamp), and supports -f/--file for a single file, a directory flag for bulk CSVs from multiple endpoints, -o/--output for file output (or stdout), and an overwrite flag.

   1 detail in Everything

5. docs update Aug 26, 2026 · issue 057

   Hayabusa logon-summary gains -G/--geo-ip to enrich source IPs with MaxMind ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses., city, and country data.

   └──▷ TRY IT
   Enrich a logon summary report with geographic context for source IPs to quickly spot logins from unexpected countries or ASNs.
   copy

   $ hayabusa.exe logon-summary -d ../logs -G /usr/local/share/GeoIP -o logon-summary.csv

6. docs update Aug 26, 2026 · issue 057

   Hayabusa adds --geo-ip flag to append ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses., country, and city columns to summarized logon source IPs.

7. docs update Aug 4, 2026 · issue 035

   Hayabusa dfir-timeline gains scan wizard by default, flexible output types, GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. enrichment, and CSV/JSON/JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. format controls.

   └──▷ TRY IT
   Enrich a DFIRDFIRDigital forensics and incident response, investigating what happened during a security incident and containing it. The work includes preserving evidence, reconstructing activity and restoring systems. timeline with GeoIP context (ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses., city, country) for IP addresses — useful when triaging lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. or C2 traffic.
   copy

   $ hayabusa.exe dfir-timeline -d .\hayabusa-sample-evtx -G .\maxmind-db -o results.csv

   Output JSONL for bulk import into the Elastic Stack — faster and smaller than JSON, with case-insensitive format flag.
   copy

   $ hayabusa.exe dfir-timeline -d .\hayabusa-sample-evtx -t JSONL -o results.jsonl

   Speed up scanning on large collections by restricting to common Event IDs, then deduplicate detections for a cleaner timeline.
   copy

   $ hayabusa.exe dfir-timeline -E -s -X -d .\hayabusa-sample-evtx -o results.csv

   • Enables scan wizard by default for the dfir-timeline command.
   • Adds -t, --output-type flag to dfir-timeline for selecting output format: csv (default), json, or jsonl (value is case-insensitive, e.g. -t JSONL).
   • Adds -G, --geo-ip <MAXMIND-DB-DIR> to enrich IP addresses in dfir-timeline output with GeoIP data (ASN, city, country).
   • Adds -H, --html-report <FILE> to save a Results Summary HTML report alongside the dfir-timeline output.
   • Adds -R, --remove-duplicate-data to replace duplicate field data with "DUP" in dfir-timeline output (requires --sort).

   +10 more show less

   • Adds -X, --remove-duplicate-detections to strip duplicate detections from dfir-timeline output (requires --sort).
   • Adds -T, --visualize-timeline to output an event-frequency timeline in the terminal from dfir-timeline (requires unicode terminal support and --sort).
   • Adds -s, --sort flag to sort dfir-timeline results before saving (note: significantly increases memory usage).
   • Adds -V, --validate-checksums flag to enable checksum validation in dfir-timeline.
   • Adds -J, --json-input flag to scan JSON-formatted logs (.json or .jsonl) instead of .evtx in dfir-timeline.
   • Adds -E, --eid-filter flag to restrict dfir-timeline scanning to common Event IDs listed in ./rules/config/target_event_IDs.txt for faster performance.
   • Adds --threads <NUMBER> option to control thread count in dfir-timeline (default: optimal for performance).
   • Adds multiple timestamp format flags to dfir-timeline: --european-time, -O, --iso-8601 (always UTC), --rfc-2822, --rfc-3339, -U, --utc, --us-military-time, --us-time.
   • Adds -M, --multiline (CSV only) to separate event field information by newline characters in dfir-timeline output.
   • Adds -S, --tab-separator (CSV only) to separate event field information by tabs in dfir-timeline output; combining either CSV-only flag with a non-CSV -t value produces an error.

   15 details in Everything

8. docs update Aug 4, 2026 · issue 035

   Hayabusa adds a config-critical-systems subcommand for configuring critical system inputs.

9. docs update Aug 4, 2026 · issue 035

   Hayabusa analysis commands gain JSON/JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. input, checksum validation, duplicate removal, base64 extraction, and richer timestamp options across the board.

   └──▷ TRY IT
   Extract Base64-encoded content from a directory of EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. logs and save to CSV for offline analysis.
   copy

   $ hayabusa.exe extract-base64 -d ../hayabusa-sample-evtx -o base64-extracted.csv

   Collect log-file metadata from a directory, scoping to only Security and System channels, with UTC timestamps.
   copy

   $ hayabusa.exe log-metrics -d ../logs --include-channel Security,System -U -o log-metrics.csv

   • Adds -V, --validate-checksums flag to computer-metrics, eid-metrics, extract-base64, log-metrics, logon-summary, pivot-keywords-list, and search commands to enable checksum validation.
   • Adds -X, --remove-duplicate-records flag to eid-metrics and logon-summary to deduplicate event records (default: disabled).
   • Adds --threads <NUMBER> flag to eid-metrics, extract-base64, log-metrics, logon-summary, pivot-keywords-list, and search to control thread count (default: optimal for performance).
   • Adds new extract-base64 subcommand to scan .evtx or JSON logs for Base64-encoded content and save results to a CSV file via -o <FILE>.
   • Adds -E, --eid-filter flag to pivot-keywords-list to restrict scanning to common EIDs defined in ./rules/config/target_event_IDs.txt for faster analysis.

   +4 more show less

   • Adds -J, --json-output and -L, --jsonl-output flags to search to save results in JSON or JSONL format.
   • Adds -M, --multiline flag to log-metrics and search to separate event field information by newline characters in CSV output.
   • Adds multiple timestamp format flags (--european-time, -O, --iso-8601, --rfc-2822, --rfc-3339, -U, --utc, --us-military-time, --us-time) to eid-metrics, extract-base64, log-metrics, logon-summary, and search.
   • Adds --exclude-channel <CHANNEL...>, --exclude-filename <FILE...>, --include-channel <CHANNEL...>, and --include-filename <FILE...> flags to log-metrics for fine-grained channel and file filtering.

   9 details in Everything

10. docs update Aug 4, 2026 · issue 035

    Hayabusa 4.0.0 unifies timeline commands under dfir-timeline with -t output-type selection and adds Linux ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. musl binaries.

    • Adds unified dfir-timeline command replacing separate CSV/JSON/JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. commands; output format selected with -t, --output-type: -t csv (default), -t json, or -t jsonl (case-insensitive).
    • Removes -L, --JSONL-output flag; use -t jsonl instead with dfir-timeline.
    • Reassigns -t shorthand from --threads to --output-type; --threads retains its long form only.
    • Adds Linux aarch64 (ARM64) musl release binary (hayabusa-<ver>-lin-aarch64-musl) built with a proper aarch64 musl cross toolchain.
    • Standardizes all long option names to lowercase: --geo-ip, --HTML-report → --html-report, --UTC → --utc, --iso-8601, --rfc-2822, --JSON-input → --json-input, --JSON-output → --json-output, --EID-filter → --eid-filter; short flags unchanged.

    +2 more show less

    • Groups CSV-only output options under a new CSV Output help category; these options now error if used with a non-CSV -t value.
    • Produces deterministically ordered results-summary output: equal-count rows are now tie-broken by channel and event ID, and by logon grouping key, eliminating run-to-run diff noise.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -L, --JSONL-output flag is removed; replace with -t jsonl on the dfir-timeline command.
    • !The -t short flag no longer means --threads; it now means --output-type. Scripts passing -t <number> for thread count must switch to --threads <number>.
    • !Long option names are renamed to lowercase: --geo-ip, --UTC → --utc, --HTML-report → --html-report, --JSON-input → --json-input, --JSON-output → --json-output, --EID-filter → --eid-filter; any scripts using the old casing will break.
    • !CSV-only output options now error when used with -t json or -t jsonl; previously they were silently accepted.
11. docs update Aug 4, 2026 · issue 035

    Hayabusa adds dfir-timeline command to save timelines in CSV, JSON, and JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. formats.

12. v4.0.0 Aug 3, 2026 · issue 035

    Hayabusa v4.0.0 merges csv-timeline and json-timeline into dfir-timeline, expands RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. and PowerShell coverage, and adds ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. Linux support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v4.0.0

    • New dfir-timeline command replaces csv-timeline and json-timeline, with output format selected via -t, --output-type: -t csv (default), -t json, or -t jsonl (case-insensitive); CSV-only flags -M, --multiline, -S, --tab-separator, and -R, --remove-duplicate-data now error if used with a non-CSV -t.
    • All command-line option long names standardized to lowercase: --GeoIP→--geo-ip, --HTML-report→--html-report, --UTC→--utc, --ISO-8601→--iso-8601, --RFC-2822/--RFC-3339→--rfc-2822/--rfc-3339, --JSON-input/--JSON-output→--json-input/--json-output, --EID-filter→--eid-filter; short flags unchanged.
    • logon-summary now counts RDP session events: Security EIDs 4778/4779 (session reconnect/disconnect with client workstation name and IP) and Terminal Services events RemoteConnectionManager/Operational 1149 and LocalSessionManager/Operational 25, covering RDP activity even when 4624 events have been overwritten.
    • extract-base64 now scans PowerShell event IDs 4100/4102 (Microsoft-Windows-PowerShell/Operational and PowerShellCore/Operational) across ContextInfo and Payload fields, and classic Windows PowerShell EIDs 403/600 via the EventData.Data blob.
    • Added First Logon/Last Logon columns to the logon-summary successful-logons table and First Attempt/Last Attempt columns to the failed-logons table.

    +1 more show less

    • New Linux aarch64 (ARM64) musl release binary (hayabusa-<ver>-lin-aarch64-musl) built with a proper aarch64 musl cross toolchain.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The csv-timeline and json-timeline commands are replaced by dfir-timeline; scripts invoking either old command must be updated.
    • !The -t short flag is reassigned from --threads to --output-type; any use of -t <N> to set thread count must switch to --threads <N>.
    • !The json-timeline flag -L, --JSONL-output is removed; use dfir-timeline -t jsonl instead.
    • !Long-form flags renamed: --GeoIP→--geo-ip, --HTML-report→--html-report, --UTC→--utc, --ISO-8601→--iso-8601, --RFC-2822→--rfc-2822, --RFC-3339→--rfc-3339, --JSON-input→--json-input, --JSON-output→--json-output, --EID-filter→--eid-filter; any scripts using the old uppercase forms will break.
13. v3.10.0 Jul 4, 2026 · issue 014

    Hayabusa v3.10.0 adds Sigma 2.1 |neq field modifiers and per-tactic unique/total alert counts in MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.10.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v3.10.0

    • Supports Sigma 2.1 |neq and |fieldref|neq field modifiers, enabling negated comparisons composable with |contains, |startswith, |endswith, and |fieldref in detection rules.
    • Adds unique and total alert counts per MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. tactic in detection results, giving practitioners a clearer picture of tactic coverage across a scan.

    2 details in Everything

14. v3.9.0 Apr 29, 2026 · release notes

    Hayabusa v3.9.0 adds support for MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v19 threat taxonomy.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.9.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v3.9.0

    • Supports MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. v19, keeping tactic and technique mappings current with the latest framework revision.

    1 detail in Everything

15. v3.7.0 Nov 14, 2025 · release notes

    Hayabusa v3.7.0 adds chunk-checksum validation for timelines and four new channel/filename filters for log-metrics.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.7.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v3.7.0

    └──▷ TRY IT
    Verify EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. chunk integrity while building a CSV timeline — useful when investigating potentially corrupted or tampered event logs.
    copy

    $ hayabusa csv-timeline -d /mnt/evidence/evtx -o timeline.csv -V

    Scope log-metrics to a specific channel and filename pattern to quickly profile activity from a single source without noise from other logs.
    copy

    $ hayabusa log-metrics -d /mnt/evidence/evtx --include-channel Security --include-filename Security.evtx

    • Adds -V, --validate-checksums option to csv-timeline and json-timeline commands to verify chunk header checksums in EVTX files.
    • Adds --include-channel, --exclude-channel, --include-filename, and --exclude-filename options to the log-metrics command for targeted log analysis.

    2 details in Everything

16. v3.6.0 Sep 25, 2025 · release notes

    Hayabusa v3.6.0 improves Results Summary with first/last detection timestamps and cleaner empty-field handling for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. ingestion.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.6.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v3.6.0

    • Outputs first and last detection timestamps (in addition to first/last event timestamps) in the Results Summary of csv-timeline and json-timeline commands.
    • Event and record IDs with multiple possibilities from correlation rules now output as empty strings instead of - for easier parsing.
    • Rule modified date outputs an empty string instead of - when not defined, easing SIEM import.
    • Empty rule metadata fields (e.g., RuleModifiedDate) are omitted from JSON output entirely, reducing file size and simplifying parsing.

    4 details in Everything

17. v3.4.0 Aug 1, 2025 · release notes

    Hayabusa v3.4.0 adds field-name abbreviations in search, 32-bit/64-bit OS compatibility, and filebeat-safe JSON/L output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.4.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v3.4.0

    └──▷ TRY IT
    Run a search and keep full, unabbreviated field names in the output for easier parsing or correlation.
    copy

    $ hayabusa search -d <evtx-dir> -b

    • Adds automatic field-name abbreviations in the search command output, disableable with -b, --disable-abbreviations.
    • Enables the 32-bit Hayabusa binary to run on 64-bit operating systems.
    • Appends a trailing return character after the last line in JSON/JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output files so filebeat no longer misses the final event.

    3 details in Everything

18. v3.2.0 Apr 2, 2025 · release notes

    Hayabusa v3.2.0 adds uptime/timezone to computer-metrics and first/last timestamps to default output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v3.2.0

    • Adds uptime and timezone info to the computer-metrics command output.
    • Adds first and last timestamp fields to the default scan output.
    • Improves checking and logging of invalid rules to surface rule problems more clearly.

    3 details in Everything

19. v3.1.1 Mar 12, 2025 · release notes

    Hayabusa v3.1.1 adds OS information to the computer-metrics command.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.1 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v3.1.1

20. v3.1.0 Feb 21, 2025 · release notes

    Hayabusa v3.1.0 adds Emergency Alerts for critical systems, a new config-critical-systems command, and expands extract-base64 coverage.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v3.1.0

    └──▷ TRY IT
    Search a narrow time window in a large evidence set with minimal memory use, then sort only when needed for review.
    copy

    $ hayabusa search -d /mnt/evtx --timeline-start "2025-01-01T00:00:00" --timeline-end "2025-01-31T23:59:59" -s -o results.csv

    Extract base64-encoded payloads including PowerShell Core and service-creation events, then pipe tab-separated results into a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents.-friendly CSV.
    copy

    $ hayabusa extract-base64 -d /mnt/evtx && hayabusa csv-timeline -d /mnt/evtx -S -o timeline_tabs.csv

    • New emergency severity level: add critical system hostnames (DCs, file servers) to config/critical_systems.txt and alerts automatically escalate one tier higher, with critical becoming emergency.
    • New config-critical-systems command automatically discovers domain controllers and file servers and populates ./config/critical_systems.txt.
    • New -X, --remove-duplicate-detections option for eid-metrics and logon-summary commands to deduplicate results.
    • New -S, --tab-separator option in csv-timeline, search, and log-metrics commands to delimit field output with tabs.
    • Adds --timeline-start / --timeline-end time-range filtering options to the search command.

    +3 more show less

    • Expands extract-base64 to cover PowerShell Classic EID 400 events, PowerShell Core logs, and System 7045 (Service Creation) events.
    • The search command gains a new -s, --sort option; results are now unsorted by default, yielding significantly lower memory usage and faster execution.
    • Adds RuleID field to all output profiles except minimal.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -s, --sort-events option is renamed to -s, --sort; any scripts or workflows using --sort-events will break.
21. v3.0.0 Dec 25, 2024 · release notes

    Hayabusa v3.0.0 adds base64 extraction, expand modifier support, and temporal correlation rules for threat hunting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v3.0.0

    └──▷ TRY IT
    Uncover encoded payloads hiding in event logs by extracting and decoding all base64 strings in one pass.
    copy

    $ hayabusa extract-base64 -d <evtx-dir>

    Audit which placeholder lists your expand-modifier rules depend on before deploying a new rule set.
    copy

    $ hayabusa expand-list -r <rules-dir>

    • New extract-base64 command extracts and decodes base64 strings from events.
    • New expand-list command outputs placeholder names used by rules with the expand modifier.
    • Supports the expand field modifier in detection rules.
    • Supports Temporal Proximity (temporal) correlation rules.
    • Supports Temporal Ordered Proximity (temporal_ordered) correlation rules.

    +1 more show less

    • Adds log file size output to the log-metrics command.

    6 details in Everything

22. v2.19.0 Nov 26, 2024 · release notes

    Hayabusa v2.19.0 adds a new log-metrics command, comparison field modifiers, UTF-16 base64 chaining, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. logon visibility, and abbreviation control.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.19.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.19.0

    └──▷ TRY IT
    Quickly profile a collection of EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. files to understand their time range, event counts, and sources before running a full timeline.
    copy

    $ hayabusa log-metrics -d /mnt/evidence/evtx

    Generate a CSV timeline without abbreviated Channel/Provider names so SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. ingestion or manual review sees the canonical field values.
    copy

    $ hayabusa csv-timeline -d /mnt/evidence/evtx -b -o timeline.csv

    Detect base64-encoded UTF-16 strings hidden in PowerShell command lines using the new chained modifier support in a Sigma-style rule.
    yaml copy

    detection:
      selection:
        CommandLine|utf16le|base64offset|contains: 'Invoke-Mimikatz'

    • New log-metrics command retrieves per-file .evtx metadata: computer names, event count, first/last timestamps, channels, and providers.
    • New -b, --disable-abbreviations option for csv-timeline, json-timeline, eid-metrics, log-metrics, and search commands to output raw Channel and Provider values instead of abbreviated forms.
    • Supports gt, gte, lt, lte field modifiers in detection rules for numeric/string comparisons.
    • Supports chaining utf16, utf16be, utf16le, and wide field modifiers with base64offset|contains for encoded content detection.
    • logon-summary command now surfaces logon information from RDP events, with additional detail when saving to a file.

    +1 more show less

    • windash characters are now dynamically loaded from rules/config/windash_characters.txt, allowing customization without rebuilding.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --timeline-offset option has been renamed to --time-offset; any scripts or workflows using --timeline-offset will break.
23. v2.18.0 Oct 22, 2024 · release notes

    Hayabusa v2.18.0 adds XOR-encoded rule bundles for AV evasion and new fieldref modifiers for flexible field-comparison detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.18.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.18.0

    • Supports the fieldref modifier (alias for equalsfield) for comparing two fields in a Sigma rule.
    • Adds fieldref|endswith modifier as an alias for endswithfield, enabling field-to-field suffix comparisons.
    • Adds fieldref|startswith and fieldref|contains modifiers for prefix and substring field-to-field comparisons.
    • Supports XOR-encoded rule bundles (encoded_rules.yml) to minimize files on target systems and avoid antivirus false positives on rule content.
    • Loads rules/config files from a single rules_config_files.txt bundle, reducing the file footprint needed during live response.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !License changed from GPL-3.0 to AGPL-3.0, which may affect how you can distribute Hayabusa in your toolchain or products.
24. v2.17.0 Aug 22, 2024 · release notes

    Hayabusa v2.17.0 adds Sigma V2 modifier support (|re:, |exists:, |cased:) and ships low-memory mode on by default.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.17.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.17.0

    └──▷ TRY IT
    Run a full scan in the default (low-memory) mode, then explicitly enable sorted output only when you also need duplicate-data removal.
    copy

    $ hayabusa scan -d /mnt/evtx -s -R -o results.csv

    • Supports Sigma V2 |re: submodifiers: |re|i: (case-insensitive), |re|m: (multi-line), and |re|s: (single-line dot-matches-newline) regex matching.
    • Supports Sigma V2 |exists: modifier for field-existence checks in detection rules.
    • Supports Sigma V2 |cased: modifier for explicit case-sensitive matching.
    • Adds name lookup support for Sigma correlation rules.
    • Low-memory mode is now on by default; -s flag is repurposed as --sort-events to explicitly sort events before output (high memory).

    +6 more show less

    • Sigma correlation reference rules no longer emit alerts by default; add generate: true to a rule to re-enable output.
    • Data fields in JSON output are now indexed (e.g., Data[3]) instead of emitted as a flat array, improving downstream parsing.
    • Aggregation rule alerts now include Channel and EventID even when multiple results are present.
    • JSON timeline outputs {} instead of "-" for empty Details fields, improving machine-parsability.
    • Updates MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. tags to Sigma V2 format (e.g., defense_evasion → defense-evasion).
    • Config files in the config folder are now embedded in the binary, reducing file count for live analysis and Velociraptor deployments.

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -s, --low-memory-mode flag is renamed to -s, --sort-events; existing scripts or workflows that passed -s to enable low-memory mode will now instead enable high-memory event sorting.
    • !-R, --remove-duplicate-data and -X, --remove-duplicate-detections now require -s, --sort-events to be explicitly set; they no longer work without it.
    • !JSON timeline output for empty Details fields changes from "-" to {}; parsers that expected the string "-" will break.
    • !JSON Data field output changes from an array ("Data": [...]) to indexed keys ("Data[3]", "Data[4]", …); any downstream parser relying on the array format will break.
    • !MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. tags are reformatted to Sigma V2 style (e.g., defense_evasion → defense-evasion); tooling that matches on the underscore format will no longer match.
    • !The set-default-profile command requires the config directory to be present on disk; it cannot run from the embedded-config binary alone.
25. v2.16.0 Jun 11, 2024 · release notes

    Hayabusa v2.16.0 adds channel-based filtering flags, Splunk REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. input, Sigma Correlation support, and multi-directory scanning

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.16.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.16.0

    └──▷ TRY IT
    Scan all event logs in multiple directories without channel filtering to catch cross-channel threats.
    copy

    $ hayabusa csv-timeline -d /path/to/logs1 -d /path/to/logs2 -a -A

    Parse Splunk REST API exported logs directly using the new input type.
    copy

    $ hayabusa json-timeline -J path/to/splunk_export.json

    Map event data fields using the new Provider_Name and Data[x] notation in a custom mapping file.
    yaml copy

    # rules/config/data_mapping/custom_mapping.yaml
    field_mappings:
      - source: Data[0].ProviderName
        target: Provider_Name

    • Adds -A, --enable-all-rules flag to csv-timeline and json-timeline subcommands to disable default Channel field filtering of detection rules
    • Adds -a, --scan-all-evtx-files flag to csv-timeline and json-timeline subcommands to load all .evtx files regardless of applicable rule channels
    • Adds support for analyzing Splunk logs exported from the REST API via a new input format
    • Adds Event Count and Value Count support for Sigma Correlation rules
    • Updates -d, --directory option in CLI to accept multiple directories for scanning

    +2 more show less

    • Adds Provider_Name field support and Data[x] notation in data mapping YAML files under rules/config/data_mapping/
    • Changes JSON output structure for count rules to separate field information into nested objects under the Details key

    7 details in Everything

26. v2.15.0 Apr 20, 2024 · release notes

    Hayabusa v2.15.0 adds windash field modifier support in Sigma rules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.15.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.15.0

    └──▷ BREAKING ON UPGRADE

    • !Starting around the end of May, Hayabusa will stop converting windash internally and require rules to use windash as-is; updating to v2.15.0 is required to avoid rule parsing errors after that date.
27. v2.14.0 Mar 29, 2024 · release notes

    Hayabusa v2.14.0 adds --include-status rule filtering and -s, --low-memory-mode.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.14.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.14.0

    └──▷ TRY IT
    Run a scan using only active rules to reduce false positives from deprecated detections.
    copy

    $ hayabusa search -t /path/to/logs --include-status "active"

    Scan large logs on a resource-constrained system while disabling duplicate removal to save memory.
    copy

    $ hayabusa search -t /path/to/large_logs.log -s

    Import JSON output directly from Splunk without manual conversion.
    copy

    $ hayabusa search -i splunk_export.json

    • Adds --include-status option to filter rules by their status
    • Adds -s, --low-memory-mode option to reduce memory usage by up to 95%
    • JSON input now supports the format exported from Splunk

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !-s, --low-memory-mode cannot be used in combination with -R, --remove-duplicate-data or -X, --remove-duplicate-detections
28. v2.13.0 Feb 11, 2024 · release notes

    Hayabusa v2.13.0 adds wildcard filter to search, JSON array input parsing, and --help flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.13.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.13.0

    • Adds wildcard character support and exact match behavior to the -f (Filter) option in the search command
    • Adds a -h, --help flag to all Hayabusa commands via General Options
    • Enables parsing of JSON input sources where the data is nested inside an array

    3 details in Everything

29. v2.12.0 Dec 23, 2023 · release notes

    Adds MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. tactic summary to HTML reports and changes JSON tag fields to arrays.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.12.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.12.0

    └──▷ TRY IT
    Parse the new array format of MitreTags in a JSON stream.
    copy

    $ hayabusa search -f events.json --json-output results.json
    jq '.[0].MitreTags[]' results.json

    • Adds a MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. tactics summary to the HTML report for each detected computer.
    • Changes %MitreTactics%, %MitreTags%, and %OtherTags% output in JSON from strings to arrays of strings.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !JSON outputs for %MitreTactics%, %MitreTags%, and %OtherTags% are now arrays instead of strings, which may break scripts expecting a single string value.
30. v2.11.0 Dec 4, 2023 · release notes

    Hayabusa v2.11.0 adds PowerShell classic log field extraction with --no-pwsh-field-extraction flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.11.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.11.0

    └──▷ TRY IT
    Scan PowerShell logs while forcing legacy parsing to match older output formats or reduce resource usage.
    copy

    $ hayabusa -t winlog --no-pwsh-field-extraction

    • Adds --no-pwsh-field-extraction CLI argument to disable extraction of fields from PowerShell classic logs
    • Enhances the scan wizard to display rule count

    2 details in Everything

31. v2.10.1 Nov 13, 2023 · release notes

    Adds interactive questions to the scan wizard in Hayabusa v2.10.1

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.10.1 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.10.1

32. v2.10.0 Oct 30, 2023 · release notes

    Hayabusa v2.10.0 adds a scan wizard and tag filtering to pivot-keywords-list

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.10.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.10.0

    └──▷ TRY IT
    Launch Hayabusa interactively to select which detection rules to enable during a scan
    copy

    $ hayabusa -w

    Run a standard non-interactive scan, bypassing the wizard
    copy

    $ hayabusa -f evidence.evtx --no-wizard

    List only rules tagged with credential for targeted keyword extraction
    copy

    $ hayabusa pivot-keywords-list --include-tag credential

    • Adds the -w, --no-wizard option to enable an interactive scan wizard for rule selection, with traditional execution restored via --no-wizard
    • Adds --include-tag option to the pivot-keywords-list command to load only rules matching specified tags
    • Adds --exclude-tag option to the pivot-keywords-list command to skip loading rules with specific tags

    3 details in Everything

33. v2.9.0 Sep 22, 2023 · release notes

    Hayabusa v2.9.0 adds better JSON parsing for count rules and optimizes thread defaults

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.9.0

    • The Details field in count rule JSON output is now a string for easier parsing
    • Changed the default thread count from CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. count to std::thread::available_parallelism

    2 details in Everything

34. v2.8.0 Sep 1, 2023 · release notes

    Hayabusa v2.8.0 adds EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. file carving, duplicate removal, timeline offsets, AND-logic search, and HexToDecimal field mapping.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.8.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.8.0

    └──▷ USE IT
    Carve and recover hidden or deleted EVTX records from slack space during timeline analysis.
    shell copy

    hayabusa csv-timeline -x /path/to/evidence.evtx

    Use AND logic in a search to find events where both cmd.exe and /c appear.
    shell copy

    hayabusa search -a -k 'cmd.exe, /c'

    Map a hex field to decimal using the new function in your config.
    yaml copy

    # In your field mapping config file:
    field_mapping:
      EventID: "HexToDecimal(OriginalEventID)"

    • Adds -x, --recover-records option to csv-timeline and json-timeline to recover evtx records through file carving in evtx slack space
    • Adds %RecoveredRecord% field to the output profile when using --recover-records
    • Adds -X, --remove-duplicate-detections option to csv-timeline and json-timeline to skip duplicate detection entries
    • Adds --timeline-offset option to csv-timeline, json-timeline, logon-summary, eid-metrics, pivot-keywords-list, and search commands to scan recent events based on a time offset
    • Adds -a, --and-logic option in the search command to search keywords with AND logic

    +1 more show less

    • Adds support for HexToDecimal in field mapping configuration files to convert hex values to decimal

    6 details in Everything

35. v2.7.0 Aug 3, 2023 · release notes

    Hayabusa v2.7.0 adds computer-metrics command, proven rules support, and numerous new CLI flags for filtering and output formatting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.7.0

    └──▷ USE IT
    Scan only rules that have been verified to work correctly, defined in the proven rules list file.
    shell copy

    hayabusa json-timeline --proven-rules -i /path/to/logs

    Filter timeline output to a specific EventID while excluding duplicates to save space.
    shell copy

    hayabusa csv-timeline --include-eid 4624 -R -i /path/to/logs

    Run the renamed metrics command to get event counts by computer name, ignoring duplicates.
    shell copy

    hayabusa eid-metrics --exclude-computer "LEGACY-PC" -i /path/to/logs

    • Adds the computer-metrics subcommand to list event counts grouped by computer name
    • Adds -P, --proven-rules flag to load only rules listed in ./rules/config/proven_rules.txt
    • Adds --include-tag and --exclude-tag flags to filter which rules are loaded based on their tags field
    • Adds --include-category and --exclude-category flags to filter which rules are loaded based on their category field
    • Adds -R, --remove-duplicate-data flag to csv-timeline and json-timeline commands to replace duplicate data with DUP

    +8 more show less

    • Adds -F, --no-field-data-mapping flag to disable mapping code numbers to human-readable messages from .yaml config files in ./rules/config/data_mapping
    • Adds --include-computer and --exclude-computer flags to csv-timeline, json-timeline, metrics, logon-summary, and pivot-keywords-list commands
    • Adds --include-eid and --exclude-eid flags to csv-timeline, json-timeline, and pivot-keywords-list commands
    • Adds timestamp output format options (--European-time, --ISO-8601, --RFC-2822, --RFC-3339, --US-time, --US-military-time, -U, --UTC) to the search command
    • Adds -C, --clobber flag to pivot-keywords-list command to overwrite existing output files
    • Adds --timeline-start and --timeline-end options to logon-summary command
    • Renames the metrics command to eid-metrics
    • Renames the --live_analysis option to --live-analysis

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The metrics subcommand is now eid-metrics; scripts calling hayabusa metrics will fail.
    • !The CLI option --live_analysis is renamed to --live-analysis; using the old name will result in an error.
36. v2.6.0 Jun 16, 2023 · release notes

    Hayabusa v2.6.0 adds |all: sigma support, -C flag for overwrites, %ExtraFieldInfo%, and JSON/JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. search output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.6.0

    • Adds -C, --clobber to csv-timeline, json-timeline, metrics, logon-summary, and search commands to overwrite existing output files.
    • Allows the search command to output results in JSON or JSONL format.
    • Adds %ExtraFieldInfo% alias to output profiles for fields not included in Details, now default in the standard profile.
    • Adds support for the '|all': keyword in sigma rules.

    4 details in Everything

37. v2.5.0 May 7, 2023 · release notes

    Hayabusa v2.5.0 adds -M multiline flag to the search command

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.5.0

38. v2.4.0 Apr 18, 2023 · release notes

    Hayabusa v2.4.0 adds search subcommand with -r/--regex flag for keyword and pattern matching

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.4.0

    └──▷ USE IT
    Search event records for a specific attacker IP address to rapidly triage a potential incident.
    shell copy

    hayabusa search -i /path/to/logs.evtx --keyword "192.168.1.55"

    Identify suspicious PowerShell execution patterns using regex within the search module.
    shell copy

    hayabusa search -i /path/to/logs.evtx --regex "Invoke-Expression|IEX.*-EncodedCommand"

    • Adds search command to search for specified keywords in records
    • Adds -r, --regex option in the search command to search for regular expressions

    2 details in Everything

39. v2.3.3 Apr 6, 2023 · release notes

    Hayabusa v2.3.3 adds -M multiline rule author output and improves performance.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.3 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.3.3

    • Improves processing speed by ~5% through CoWCoWCopy-on-write: an OS memory optimization where two processes share the same physical pages until one writes, triggering a private copy only then. It makes forking processes fast and cheap. string optimization

    1 detail in Everything

40. v2.3.2 Mar 22, 2023 · release notes

    Adds -M, --multiline flag to the csv-timeline command in Hayabusa v2.3.2

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.2 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.3.2

    └──▷ USE IT
    Export timeline data with multiline formatting enabled using the new option.
    shell copy

    hayabusa csv-timeline -M input.log

    • csv-timeline supports -M, --multiline for multiline output

    1 detail in Everything

41. v2.3.1 Mar 18, 2023 · release notes

    Adds short-hand options -D and -u, quotes CSV fields in csv-timeline

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.1 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.3.1

    └──▷ USE IT
    Enable deprecated and unsupported rules with concise flags during execution.
    shell copy

    hayabusa -t logfile.evtx --enable-deprecated-rules --enable-unsupported-rules
    hayabusa -t logfile.evtx -D -u

    • Adds short-hand -D and -u flags for --enable-deprecated-rules and --enable-unsupported-rules respectively.
    • Quotes CSV fields in csv-timeline output to support multiple lines within a single field.

    2 details in Everything

42. v2.3.0 Mar 16, 2023 · release notes

    Hayabusa v2.3.0 adds |cidr and |contains|all pipes, * of selection logic, and --enable-unsupported-rules flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.3.0

    └──▷ TRY IT
    Scan using rules that are not yet stable or officially supported
    copy

    $ hayabusa scan -t <target> --enable-unsupported-rules

    Match event data against a specific CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. range using the new pipe
    yaml copy

    # In rule YAML:
    pipe: "|cidr"

    Use logical selection operators in rule conditions
    yaml copy

    # In rule YAML:
    condition: "1 of selection*" or "all of selection*"

    • --enable-unsupported-rules CLI argument enables detection for rules marked as unsupported
    • |cidr pipe keyword adds CIDR matching capability in rules
    • |contains|all pipe keyword added to rule syntax
    • 1 of selection* and all of selection* syntax now supported for rule conditions

    4 details in Everything

43. v2.2.2 Feb 22, 2023 · release notes

    Hayabusa v2.2.2 adds |base64offset|contains pipe keyword and timestamp options to metrics/logon-summary

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.2.2 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.2.2

    └──▷ USE IT
    Detect base64-encoded strings at a specific byte offset within an event log field using the new pipe keyword.
    shell copy

    hayabusa scan -r rules/ -t event_log.evtx -k 'Field Value |base64offset|contains "password"'

    Customize the timestamp display format for session analysis in logon-summary.
    shell copy

    hayabusa logon-summary -t event_log.evtx --time-format iso8601

    View the time range of logs processed when scanning a directory with metrics.
    shell copy

    hayabusa metrics -d /logs/corporate/

    • Added support for the |base64offset|contains pipe keyword.
    • Added Time Format options for logon-summary and metrics commands.
    • metrics command now displays first and last timestamps when using the -d directory option.

    3 details in Everything

44. v2.2.0 Feb 11, 2023 · release notes

    Hayabusa v2.2.0 adds -J JSON input, -G GeoIPGeoIPA database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. enrichment, and -e exact-level scanning

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.2.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.2.0

    └──▷ USE IT
    Scan a JSON event log file with IP enrichment enabled.
    shell copy

    hayabusa -t evtx -f events.json -J -G

    Filter scan results to only show high severity rules using the new exact-level flag.
    shell copy

    hayabusa -t evtx -f events.evtx -e high

    • Adds --JSON-input (-J) CLI flag to read JSON-formatted event logs as new input source
    • Adds -G, --GeoIP CLI flag to enrich results with ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. organization, city, and country via MaxMind databases
    • Adds -e, --exact-level option to filter scan results for specific rule levels

    3 details in Everything

45. v2.0.0 Dec 24, 2022 · release notes

    Hayabusa v2.0.0 replaces help and usage commands with a subcommand-based interface

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0

    • Switches command usage and help menu to be handled by subcommands instead of global flags or top-level arguments.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The previous method for invoking help or usage (likely via a global flag like --help at the root level) is replaced by using dedicated subcommands, which may require updating existing scripts that rely on the old invocation pattern.
46. v1.9.0 Dec 23, 2022 · release notes

    Hayabusa v1.9.0 adds |endswithfield pipe keyword and --debug memory usage reporting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.9.0

    └──▷ USE IT
    Monitor memory consumption during a scan to identify resource-intensive rules.
    shell copy

    hayabusa -f rule.yml -i event.evtx --debug

    • Adds the |endswithfield pipe keyword for rule authoring.
    • Adds the --debug CLI flag to display runtime memory utilization.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The short option for --visualize-timeline has changed from -V to -T.
47. v1.8.1 Nov 21, 2022 · release notes

    Adds %RenderedMessage% field to output profiles for WEC rendered log messages

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.1 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.8.1

48. v1.8.0 Nov 7, 2022 · release notes

    Hayabusa v1.8.0 adds --list-profiles command and new output field/alias support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.8.0

    • Adds --ISO-8601 flag to CLI for Elastic Stack-compatible output timestamps
    • Adds --list-profiles subcommand to list available output profiles
    • Adds %RuleAuthor%, %RuleCreationDate%, %RuleModifiedDate%, and %Status% aliases for output profiles
    • Adds %RuleID% and %Provider% aliases for output profiles

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Event ID filtering is now disabled by default; use -e, --eid-filter to re-enable
    • !Renamed profile alias from %RecordInformation% to %AllFieldInfo%
    • !Removed HBFI- prefix in the AllFieldInfo JSON field output
49. v1.7.2 Oct 16, 2022 · release notes

    Hayabusa v1.7.2 adds --list-profiles CLI option to discover output profiles

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.2 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.7.2

    └──▷ TRY IT
    Discover which output profiles are available for use with the tool.
    copy

    $ hayabusa --list-profiles

    • Adds --list-profiles flag to print available output profiles
    • Limits rule author names in detected alerts to 40 characters

    2 details in Everything

50. v1.7.1 Oct 10, 2022 · release notes

    Hayabusa v1.7.1 adds rule author display and channel/EID info configuration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.1 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.7.1

    • Adds rules/config/channel_eid_info.txt to configure Channel and EID mappings for more accurate detection results.
    • Adds rule authors to standard output during scanning.

    2 details in Everything

51. v1.7.0 Sep 29, 2022 · release notes

    Hayabusa v1.7.0 adds HTML summary reports, metrics output options, and CSV export for logon data

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.7.0

    • Adds -H, --html-report flag to generate an HTML summary report
    • Adds -M, --metrics subcommand (replaces -s, --statistics) for Event ID analysis
    • Adds CSV output support (-o, --output) when using -M or -L options

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -s, --statistics flag is removed and replaced by -M, --metrics
    • !The statistics_event_info.txt output file is renamed to event_id_info.txt
52. v1.6.0 Sep 16, 2022 · release notes

    Adds -j and -J CLI options to export timeline results as JSON or JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    └──▷ USE IT
    Export the full execution timeline for downstream parsing or visualization.
    shell copy

    hayabusa -i C:\Windows\System32\winevt\Logs\Security.evtx -j timeline.json

    Export the execution timeline in line-delimited JSON format for streaming ingestion.
    shell copy

    hayabusa -i C:\Windows\System32\winevt\Logs\Security.evtx -J timeline.jsonl

    • Adds -j, --json option to save the analysis timeline to a JSON file.
    • Adds -J, --jsonl option to save the analysis timeline to a JSONL file.

    2 details in Everything

53. v1.5.1 Aug 19, 2022 · release notes

    Adds Timesketch-compatible CSV output profile

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.1 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.5.1

    └──▷ USE IT
    Export event logs in a format ready for direct import into a Timesketch timeline.
    shell copy

    hayabusa -t -p timesketch -f /path/to/logs.evtx -o output.csv

54. v1.5.0 Aug 18, 2022 · release notes

    Hayabusa v1.5.0 adds customizable output profiles via config files and a null keyword for rule detection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    └──▷ USE IT
    Write a rule that triggers when a specific field is missing from an event record.
    yaml copy

    - condition: fields.field_name = null
      name: FieldMissing

    • Adds customizable output fields using config/profiles.yaml and config/default_profile.yaml.
    • Implements the null keyword in rules to check if a target field exists or not.

    2 details in Everything

55. v1.4.2 Jul 24, 2022 · release notes

    Hayabusa v1.4.2 adds custom rule update paths and reduces output YAML size.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.2 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.4.2

    • Adds ability to specify a custom directory for rule updates via --rules when used with --update-rules
    • Changes the saved detection rule path column from RulePath to RuleFile in output files to reduce file size

    2 details in Everything

56. v1.4.1 Jun 30, 2022 · release notes

    Hayabusa v1.4.1 adds -D, --deep-scan, moves rule configs to rules/config/ for -U, --update-rules support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.1 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.4.1

    └──▷ USE IT
    Perform a thorough scan of all events, ignoring the default Event ID filter for deeper investigation.
    shell copy

    hayabusa -t eventlogs.evtx -D

    • Adds the -D, --deep-scan flag to bypass the default Event ID filter and scan all events instead of only those with defined rules.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The channel_abbreviations.txt, statistics_event_info.txt and target_event_IDs.txt files have moved from the config directory to the rules/config directory.
57. v1.4.0 Jun 26, 2022 · release notes

    Hayabusa v1.4.0 adds --target-file-ext for non-evtx logs and --exclude-status to filter rules by status field

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    └──▷ USE IT
    Scan non-evtx binary log files that mimic evtx structure
    shell copy

    hayabusa -t --target-file-ext evtx_data -r rules/ -f logs.bin

    Run scans excluding draft or experimental rules to reduce noise
    shell copy

    hayabusa -t --exclude-status draft -r rules/ -f logs.evtx

    • Adds --target-file-ext CLI option to specify additional file extensions (e.g., evtx_data) beyond the default .evtx for scanning
    • Adds --exclude-status CLI option to ignore rule loading based on the rule's status field

    2 details in Everything

58. v1.3.1 Jun 12, 2022 · release notes

    Hayabusa v1.3.1 adds --US-time, --US-military-time, --European-time flags and multi-field indexing in rules

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.1 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.3.1

    • Adds --US-time, --US-military-time, and --European-time CLI arguments to specify custom output time formats
    • Adds %Data[1]% placeholder support in rule details fields to select specific named fields among duplicates
    • Adds loaded rules status summary displayed at startup

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -R flag now defaults to hiding the record ID instead of displaying it; use -R / --hide-record-id explicitly to hide, and omit it (or use the new default behavior) to show.
59. v1.3.0 Jun 6, 2022 · release notes

    Hayabusa v1.3.0 adds --visualize-timeline, -R record ID display, and --all-tags CSV export.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    └──▷ TRY IT
    Generate a visual timeline of event frequency directly in the terminal.
    copy

    $ hayabusa scan -f evtx.log --visualize-timeline

    Export findings to CSV including all rule tags for deeper MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. mapping.
    copy

    $ hayabusa scan -f evtx.log --csv results.csv --all-tags

    Include the raw EVTXEVTXWindows XML-based binary log format used by the Event Log service to store system, application, and security events; cyber tools parse it to extract forensic artifacts from live systems or offline disk images. EventRecordID in output for precise source file correlation.
    copy

    $ hayabusa scan -f evtx.log --display-record-id

    • --visualize-timeline (alias -V) enables a new event frequency timeline visualization feature
    • -R / --display-record-id adds the raw EVTX EventRecordID to output fields
    • --all-tags expands CSV exports to include all rule tags in the MitreAttack column

    3 details in Everything

60. v1.2.2 May 19, 2022 · release notes

    Hayabusa v1.2.2 adds -L logon summary and enables colored output by default

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.2 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.2.2

    └──▷ USE IT
    Generate a summary of logon events from EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. logs
    shell copy

    hayabusa -t edr -L -f logs.evtx

    • Adds -L / --logon-summary flag to generate a logon summary
    • Enables colored output for Command Prompt and PowerShell prompts by default

    2 details in Everything

61. v1.2.1 Apr 22, 2022 · release notes

    Adds a Channel column to output based on ./config/channel_abbreviations.txt for richer event context.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.1 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.2.1

    • Adds channel output field driven by ./config/channel_abbreviations.txt
    • Changes default path for level tuning rules from ./config/level_tuning.txt to ./rules/config/level_tuning.txt

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Level tuning is no longer read from ./config/level_tuning.txt; must use ./rules/config/level_tuning.txt
62. v1.2.0 Apr 15, 2022 · release notes

    Adds -C, -p, -F, --level-tuning flags and the |equalsfield rule aggregator to Hayabusa v1.2.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    • -C / --config flag added to specify a custom rules directory instead of the default location
    • |equalsfield aggregation keyword added for Sigma rules to compare if two fields are equal
    • -p / --pivot-keywords-list flag added to generate a list of keywords for pivoting investigations
    • -F / --full-data flag added to output all field information beyond the rule's details
    • --level-tuning flag added to tune detection risk levels using an external configuration file

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The event ID and title config file timeline_event_info.txt is renamed to statistics_event_info.txt.
63. v1.1.0 Mar 3, 2022 · release notes

    Hayabusa v1.1.0 adds -r for single rule testing, -u for rule updates, and live analysis capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/Yamato-Security/hayabusa.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    • Adds -r / --rules option to specify a single rule for targeted testing
    • Adds -u / --update-rules flag to update rules from the hayabusa-rules repository
    • Adds -l / --live-analysis option to perform live analysis on Windows without specifying the event log directory
    • Adds -c / --color flag to enable True Color output for supported terminals

    4 details in Everything