Side by side
Arkime vs Hayabusa
Both stand on digital forensics software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan Open source APILinuxSelf-hosted+1
Arkime offers session search, packet inspection, and flexible packet retention without license fees. It requires an OpenSearch or Elasticsearch deployment, so teams should account for that dependency and its operation.
Visit Arkime Free plan LinuxMacWindows
Choose Hayabusa if you need a free tool for Windows event-log timelines and threat hunting across systems. Its Sigma support, analysis summaries, and multiple export formats cover several investigation workflows. Look elsewhere if your work requires mobile, disk, or memory forensics, or a Linux ARM MUSL binary.
Visit HayabusaThe facts
| Arkime | Hayabusa | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Yes | Not published |
| Runs on | API, Linux, Self-hosted, Web | Linux, Mac, Windows |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 1 | 1 |
| Maker | Not published | Not published |
| Website | arkime.com | github.com |
| On digital forensics software | #1 of 30 | #4 of 30 |
Arkime: what it does well
- Stores full packets in standard PCAP format.
- Supports metadata-only capture with traffic selection rules.
- Exports search results as PCAP or CSV.
- Capture can scale with more machines, CPU, or disk.
- Authentication options include OIDC.
What to know first
- Requires OpenSearch or Elasticsearch for session metadata.
- Phone indicator enrichment is limited to the U.S.
- Anonymous authentication is not recommended.
Hayabusa: what it does well
- Processes EVTX logs from one host or thousands.
- Exports timelines as CSV, JSON, and JSONL.
- Supports Sigma, including v2 correlation rules.
- Offers more than 4,000 curated detection rules.
- Includes MITRE ATT&CK mapping and HTML summary reports.
What to know first
- No Linux ARM MUSL binary is provided.
- It focuses on Windows event logs; mobile, disk, and memory forensics are unsupported.
- SaaS users are asked to open-source their improvements.
Alternatives to Arkime Alternatives to Hayabusa The whole list