Instead of Hayabusa
Hayabusa alternatives
Hayabusa turns Windows EVTX logs into timelines for threat hunting. Its Sigma support includes v2 correlation rules, and it consolidates events from one host or thousands into CSV, JSON, or JSONL. It also offers event and computer metrics, logon summaries, keyword pivoting, HTML reports, and MITRE ATT&CK mapping. The project describes its multithreaded Rust implementation as capable of up to a 5x speed improvement; it can run live, analyze collected logs offline, or hunt across endpoints with the Velociraptor artifact.
- 1
NetworkMiner
Free plan LinuxMacWindowsExtracting artifacts from captured or live network traffic — NetworkMiner extracts files, images, emails, and passwords from network traffic, while Hayabusa builds timelines from Windows event logs.
- 2
OSForensics
Free plan AndroidSelf-hostedWindowsComputer investigations with recovery and case reports — OSForensics searches and recovers computer files, reviews user activity, and creates case reports, unlike Hayabusa’s event-log focus.
- 3
Plaso
Free plan Open source APILinuxMac+2Building timelines from varied forensic inputs — Plaso creates timelines from files, storage images, devices, logs, and cloud audit formats, beyond Hayabusa’s Windows event-log focus.
- 4
The Sleuth Kit
Free plan APILinuxMac+2Examining disk images and file systems — The Sleuth Kit analyzes disk images and file systems, including deleted and hidden content, rather than focusing on event logs.
- 5
Volatility 3
Free plan LinuxMacSelf-hosted+1Analyzing volatile memory samples — Volatility 3 extracts artifacts from RAM samples to reveal runtime state, an evidence source Hayabusa does not handle.
- 6
Arkime
Free plan Open source APILinuxSelf-hosted+1Searching and inspecting network sessions — Arkime indexes network-session metadata and can store packet captures, while Hayabusa creates timelines from Windows event logs.
- 7
CAINE
Free plan Open source LinuxSelf-hostedWindowsA graphical Linux forensic environment — CAINE combines forensic tools in a graphical live distribution with read-only device defaults, unlike Hayabusa’s event-log analysis focus.
- 8
Exterro FTK Imager
Free plan WebWindows - 9
Paraben E3 Forensic Platform
Free plan AndroidiPhoneLinux+2 - 10
Guymager
Free plan Linux - 11
SIFT Workstation
Free plan LinuxSelf-hostedWindows - 12
Timesketch
Free plan APILinuxSelf-hosted+1 - 13
ADF Triage-G2
Free trial AndroidiPhoneLinux+2 - 14
Autopsy
Free plan LinuxMacWindows - 15
SUMURI PALADIN
Free plan Linux - 16
Belkasoft X Forensic
Free trial AndroidiPhoneLinux+2 - 17
Tsurugi Linux
Free plan Linux - 18
Magnet AXIOM Cyber
Free trial LinuxMacSelf-hosted+1 - 19
Cellebrite Inseyets
Free trial WebWindows - 20
Elcomsoft Mobile Forensic Bundle
Paid LinuxMacWindows - 21
MOBILedit Forensic
Free trial Windows - 22
Oxygen Forensic Detective
Free trial Windows - 23
MSAB XRY
Paid AndroidiPhoneWindows - 24
Passware Kit Mobile
Paid LinuxMacWindows
Hayabusa is free and open source on Windows, macOS, and Linux, but focuses on Windows event logs: it does not provide mobile, disk-image, or memory forensics, and has no Linux ARM MUSL binary. Alternatives shift toward network traffic, computer files, disk images, RAM, or broader forensic workflows. Compare the evidence you need to examine, the outputs and workflow you prefer, platform fit, and any price or trial terms. A tool aimed at another evidence source may suit your investigation better, even if it does not replace Hayabusa’s event-log timeline work.
← Back to Hayabusa The whole digital forensics software list