Hayabusa review
A focused EVTX parser for Sigma-based Windows threat hunting and timeline work.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Hayabusa is an open-source, command-line tool for Windows event-log forensics and threat hunting. It parses EVTX files, applies Sigma-based detection rules, and consolidates events from one or many systems into forensic timelines. Its audience includes incident responders, threat hunters, and forensic teams whose investigations center on Windows event logs. Hayabusa runs on Windows, macOS, and Linux, while its evidence source remains Windows EVTX data.
Its strongest fit is an investigation workflow that needs structured output and connections to other analysis tools. Hayabusa can generate CSV, JSON, and JSONL timelines, along with HTML reports and detection-frequency timelines. Keyword and regular-expression searches help narrow event data, while event, computer, log, and logon metrics provide additional views. Timesketch-compatible output profiles support timeline review, and integrations with Elastic Stack, Timeline Explorer, Velociraptor, and jq extend its place in an existing toolkit. Live analysis and offline log collection cover different collection situations.
Hayabusa stays deliberately focused rather than acting as a complete digital forensics suite. Its published capabilities address Windows event-log analysis, not mobile forensics, disk imaging, memory forensics, or case collaboration. The command-line format also suits technical users more than teams seeking a broad graphical case-management environment. Choose Hayabusa when Sigma hunting, EVTX parsing, metrics, searches, and timeline exports are the priority. Choose a broader alternative when an investigation requires multiple evidence types or built-in case collaboration alongside event-log analysis.
Hayabusa pros and cons
- Where it wins
- Sigma-based detection rules support focused threat hunting.
- Generates CSV, JSON, and JSONL forensic timelines.
- Works with Timesketch, Elastic Stack, and Velociraptor.
- Where it doesn't
- Focuses on Windows EVTX rather than broader forensic evidence.
- Command-line workflows may require technical setup.
- Does not provide mobile, disk, memory, or case collaboration features.
Hayabusa fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update