Hayabusa and Chainsaw
Yamato Security; WithSecure · Hayabusa 4 / Chainsaw 2 · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
Two open-source Rust tools that apply Sigma and their own rules directly to Windows event log (EVTX) files and produce a prioritised, timeline-ordered set of hits. Hayabusa comes from Yamato Security; Chainsaw is published by WithSecure (the repository now lives under WithSecureOpenSource). Both are actively released.
Who it is for, and when
These are the fast path from a folder of EVTX files to a shortlist of interesting events, without standing up a SIEM. On an intrusion matter they are usually the first thing run against collected logs, because they surface logon anomalies, service installs, PowerShell activity, and known attack patterns in minutes and give you a CSV or JSON timeline to work from. Running both and comparing is cheap and catches rule-coverage gaps in either.
What it does not cover
Both are rule-driven detection over event logs and nothing more: they do not collect the logs, do not parse other artefact types, and will miss anything no rule describes. Neither reconstructs what happened — a hit is a lead requiring corroboration from other artefacts — and a quiet result often means logging was never enabled rather than that nothing occurred.
Go to the source
Open at github.com (opens in a new tab)https://github.com/Yamato-Security/hayabusa
Details
- Type
- Tool
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Publisher
- Yamato Security; WithSecure
- Version verified
- Hayabusa 4 / Chainsaw 2
- Year
- 2026
- Topics
- log-analysis, windows, triage, threat-hunting, timeline, open-source
- Checked at source
Related entries
A large collection of free single-purpose Windows artefact parsers — among them MFTECmd, PECmd, LECmd, JLECmd, AmcacheParser, SBECmd, EvtxECmd, RECmd, and the Timeline Explorer and Registry Explorer GUIs. The tools are still distributed from ericzimmerman.github.io, with a Get-ZimmermanTools helper that pulls the current set.
Autopsy
FreeAn open-source graphical forensic platform built over The Sleuth Kit, with an ingest-module architecture for keyword search, hash matching, web and email artefacts, and timeline review. It is now maintained by Sleuth Kit Labs, which also sells the commercial Cyber Triage product.
An open-source Python framework that extracts timestamps from hundreds of artefact types across a disk image or directory and writes them into a single normalised storage file. log2timeline is the extraction front end; psort and psteal filter, sort, and export the result.
Sigma
FreeAn open, structured YAML format for describing detections in log data, plus a community rule repository and the pySigma/sigma-cli tooling that converts a rule into the query language of a particular SIEM or log platform. The rule repository is actively released by SigmaHQ.
Timesketch
FreeAn open-source web application for collaborative timeline analysis, built around the idea of a sketch that several analysts annotate, tag, and search at once. It ingests Plaso storage files, CSV, and JSONL. The project states plainly that it is code owned by Google rather than an official Google product.