hayabusa

hayabusa csv-timeline -d <evtx>

Generates the CSV timeline of an EVTX directory with hayabusa, applying its Windows event detection profiles.

Run it when you want the full timeline of Windows logs from a host (or several) with built-in detections: hayabusa processes the EVTX, applies its detection profiles (over a thousand event rules: logons, processes, services, log clearing) and generates a CSV with each relevant event, its severity, and the detail. It is the complementary tool to Chainsaw — with its own profiles and superior speed. In IR, the csv-timeline is the first artifact you open: the host's movie in chronological order with events flagged by severity, ready to pivot to the details.

Don't use it without knowing its profiles: hayabusa has detection profiles (default, suspicious, all) that change the volume and noise — the 'all' profile generates thousands of lines on active hosts, unmanageable without filters. On hosts with weeks of logs, processing takes time and the CSV is heavy; narrow it down with -f (date) or -E (EventIDs). And watch out: hayabusa detects on copied logs — the quality depends on the host's audit policy: without process or logon auditing configured, the relevant EventIDs don't exist in the EVTX, and the timeline comes out empty of what matters.