Hayabusa

Hayabusa is a Windows event-log forensics and threat-hunting tool for investigators and defenders working with EVTX data. It is a strong fit for building timelines across individual machines or endpoint collections, but it is not a full-spectrum forensics suite.

Overview

Hayabusa can run live on one Windows system, analyze collected logs offline, or hunt across endpoints using the Velociraptor Hayabusa artifact. That flexibility makes it useful for both targeted triage and wider hunts, while its focus on event logs sets a clear boundary around what it can investigate.

The project says its multithreaded Rust implementation can deliver up to a 5x speed improvement. That ceiling may matter when processing larger collections, but it is not a guarantee for every workload. Rust’s memory-safe design is a sensible foundation for software handling security evidence.

Key features

Timelines and detection

Hayabusa consolidates events from one host or thousands into CSV, JSON, or JSONL timelines. It supports the Sigma specification, including v2 correlation rules, and its curated detection rules number over 4,000. Together, these capabilities give analysts a substantial event-log hunting toolkit without a paid tier; the detection rules have a separate license from the software.

Analysis and integrations

Computer and event ID metrics, logon summaries, keyword pivoting, HTML summary reports, and MITRE ATT&CK mapping help analysts move from a large event set toward useful leads. The project documents importing results into Elastic Stack, Timesketch, and Timeline Explorer, as well as analyzing JSON with jq. These options suit teams with established investigation workflows, though Hayabusa itself does not provide case collaboration.

Live response

Special Windows live-response packages bundle the binary with XOR-encoded rules and configuration files. That reduces files written to the system and helps avoid antivirus false positives on YAML rule files, a practical benefit when limiting the footprint of a response tool matters.

Pricing

Hayabusa costs nothing under the GNU AGPLv3, and its detection rules use DRL 1.1. There is no paid plan to unlock additional features or a stated free-plan cap. The project says internal, SaaS, and consulting use are allowed, while requesting that SaaS users open-source improvements they make; organizations should review both licenses against their intended use.

Platforms

Hayabusa supports Windows, macOS, and Linux, with Windows event logs as its evidence source. It does not provide a Linux ARM MUSL binary because, according to the project, it does not run properly. It does not cover mobile, disk imaging, or memory forensics, so investigators needing those evidence types will need other tools.

Who it's for

Hayabusa is best suited to incident responders and threat hunters who need to convert EVTX data into timelines, apply Sigma detections, and summarize activity across one or many systems. Its free availability and multiple output formats make it a practical choice for teams already using the documented integrations. It is a poor fit as a single platform for broader forensic evidence collection or collaborative case management.

Pros and cons

• Pros: Free software with no stated usage cap, making it accessible for small investigations and large hunts alike.
• Pros: Sigma v2 correlation support, over 4,000 curated rules, and three timeline formats offer useful breadth for event-log analysis.
• Pros: Live, offline, and Velociraptor-based workflows support different scales of endpoint investigation.
• Cons: No mobile, disk, or memory forensics, limiting its usefulness beyond Windows event logs.
• Cons: No case collaboration feature for teams that need shared investigation management.
• Cons: No Linux ARM MUSL binary, which excludes that platform target.

Alternatives

For a broader digital-forensics shortlist, see Digital Forensics Software.

Choose NetworkMiner instead when its GPLv2 open-source software and free edition better suit your needs. Consider OSForensics if you want a free edition or a 30-day trial. Plaso is another free option for investigators seeking a tool with no stated commercial plan or usage limits. The Sleuth Kit is worth considering when open-source forensic tools and a C library are a better fit.

Pick Volatility 3 when you need a free, open-source framework rather than Hayabusa’s event-log focus. Arkime may fit better if you need a free open-source tool without paid-only features or license fees. Consider CAINE if a free Linux and Windows forensic ISO is more appropriate. For imaging and preview work, Exterro FTK Imager offers a free Windows-only tool, with a paid Pro plan at $499 a year.

Verdict

Choose Hayabusa if you need a free, focused way to turn Windows event logs into timelines and threat-hunting leads across systems. Its Sigma support, summaries, and flexible exports make it particularly useful for event-log investigations. Look elsewhere if you need mobile, disk, or memory forensics, case collaboration, or a Linux ARM MUSL binary.