Hayabusa

At a glance

• Editor score
  6.5 / 10
• Pricing
  Open source
• Best for
  Windows event-log threat hunting
• Paid from
  Free
• Mobile forensics
  No
• Facts checked
  20 Sep 2026

• Where it wins

  • Sigma-based detection rules support focused threat hunting.
  • Generates CSV, JSON, and JSONL forensic timelines.
  • Works with Timesketch, Elastic Stack, and Velociraptor.

• Where it doesn't

  • Focuses on Windows EVTX rather than broader forensic evidence.
  • Command-line workflows may require technical setup.
  • Does not provide mobile, disk, memory, or case collaboration features.

Our verdict on Hayabusa

Hayabusa is an open-source, command-line tool for Windows event-log forensics and threat hunting. It parses EVTX files, applies Sigma-based detection rules, and consolidates events from one or many systems into forensic timelines. Its audience includes incident responders, threat hunters, and forensic teams whose investigations center on Windows event logs. Hayabusa runs on Windows, macOS, and Linux, while its evidence source remains Windows EVTX data.

Its strongest fit is an investigation workflow that needs structured output and connections to other analysis tools. Hayabusa can generate CSV, JSON, and JSONL timelines, along with HTML reports and detection-frequency timelines. Keyword and regular-expression searches help narrow event data, while event, computer, log, and logon metrics provide additional views. Timesketch-compatible output profiles support timeline review, and integrations with Elastic Stack, Timeline Explorer, Velociraptor, and jq extend its place in an existing toolkit. Live analysis and offline log collection cover different collection situations.

Hayabusa stays deliberately focused rather than acting as a complete digital forensics suite. Its published capabilities address Windows event-log analysis, not mobile forensics, disk imaging, memory forensics, or case collaboration. The command-line format also suits technical users more than teams seeking a broad graphical case-management environment. Choose Hayabusa when Sigma hunting, EVTX parsing, metrics, searches, and timeline exports are the priority. Choose a broader alternative when an investigation requires multiple evidence types or built-in case collaboration alongside event-log analysis.

Your product? Our editors can test Hayabusa in depth and publish a review, labelled as paid · from $149/mo →

Hayabusa pricing

Hayabusa fact sheet

Hayabusa integrations

Hayabusa lists 5 integrations on its own site.

• Elastic Stack
• Timesketch
• Timeline Explorer
• Velociraptor
• jq

Alternatives to Hayabusa

• AutopsyA free, cross-platform platform for broad, case-based digital investigations.9.4
• Paraben E3 Forensic PlatformA broad evidence-processing platform for teams handling varied digital investigations.9.3
• Magnet AXIOM CyberA broad investigation platform for collecting and analyzing endpoint, mobile, cloud, and memory evidence.9.2

See all Hayabusa alternatives →

Featured on iTechGuides

Hayabusa is listed in our Digital Forensics Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/hayabusa/"><img src="https://www.itechguides.com/best/badge/hayabusa.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update