New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Generating Forensic Timelines With Hayabusa

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV/JSON timeline with severity levels, MITRE ATT&CK mappings, and…

Apache-2.0Auto-check passedSecurity

Install Generating Forensic Timelines With Hayabusa

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill generating-forensic-timelines-with-hayabusa -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills generating-forensic-timelines-with-hayabusa --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/generating-forensic-timelines-with-hayabusa .claude/skills/generating-forensic-timelines-with-hayabusa && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
generating-forensic-timelines-with-hayabusa
GitHub stars
34k
Token cost
~2.2k tokens
SKILL.md length
790 words
Files
5 (incl. scripts, references)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV/JSON timeline with severity levels, MITRE ATT&CK mappings, and…

  • Works in 8 steps: Update the rule set → Build a CSV timeline from collected logs → Choose an output profile → …
  • Tasks that involve Digital forensics
  • SKILL.md covers Overview, When to Use, Prerequisites and Objectives, plus 4 more sections
  • Runs Python scripts from its folder; calls curl, git and cargo; reaches github.com

What it does

Generating Forensic Timelines With Hayabusa is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV/JSON timeline with severity levels, MITRE ATT&CK mappings, and per-host/per-Event-ID metrics. Use during DFIR triage to turn raw event logs into a fast, SIEM-free incident timeline, or to export results into Timesketch or Timeline Explorer for collaborative analysis.

Its SKILL.md is about 2.2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 6 other files, including scripts and reference files (for example `references/api-reference.md`, `references/standards.md` and `scripts/agent.py`).

It sits in Security, covering Digital forensics, Security operations and CSV and tabular files. It works with PowerShell. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Digital forensics
  • Tasks that involve Security operations
  • Tasks that involve CSV and tabular files

Example prompts

  • “/generating-forensic-timelines-with-hayabusa”

Requirements

  • Python 3

Workflow steps

8 steps, taken from the step headings in SKILL.md.

  1. Update the rule set
  2. Build a CSV timeline from collected logs
  3. Choose an output profile
  4. Filter by minimum severity
  5. Produce a JSON/JSONL timeline for tooling
  6. Generate metrics and pivot keywords
  7. Search logs for specific IOCs
  8. Live triage on a running host

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • curl
    • git
    • cargo
    • jq

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • github.com

    Also links to:

    • ericzimmerman.github.io
    • timesketch.org

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Generating Forensic Timelines With Hayabusa loads about 2.2k tokens when it runs, and up to ~3.2k if it reads all its reference files. Until then it costs about 109 tokens; SKILL.md has 790 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~109
When it runs · the whole SKILL.md, loaded when a task matches
~2.2k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 790 words, ~2,207 tokens.

Download SKILL.mdSave it as .claude/skills/generating-forensic-timelines-with-hayabusa/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.
name
generating-forensic-timelines-with-hayabusa
description
Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV/JSON timeline with severity levels, MITRE ATT&CK mappings, and per-host/per-Event-ID metrics. Use during DFIR triage to turn raw event logs into a fast, SIEM-free incident timeline, or to export results into Timesketch or Timeline Explorer for collaborative analysis.
domain
cybersecurity
subdomain
digital-forensics
tags
hayabusa, dfir, evtx, sigma, timeline, threat-hunting, windows-event-logs, forensics
version
1.0
author
mahipal
license
Apache-2.0
nist_csf
RS.AN-03
mitre_attack
T1059.001

Generating Forensic Timelines with Hayabusa

Overview

Hayabusa (隼, Japanese for "peregrine falcon") is a Sigma-based threat-hunting and fast-forensics timeline generator for Windows event logs, developed by Yamato Security in Rust. It parses .evtx files (offline or via live analysis of a local host), applies a large built-in library of Sigma detection rules plus Hayabusa-specific rules, and produces a single, readable, chronological timeline of high-signal events with severity levels, MITRE ATT&CK tactics, and rule references. This collapses thousands of raw event-log records into a prioritized incident timeline that an analyst can review quickly.

Hayabusa is purpose-built for DFIR triage. Instead of loading EVTX into a SIEM, an investigator runs a single binary against a directory of collected logs and gets a CSV or JSON timeline plus metrics (events per computer, per Event ID, per channel). Because detections are Sigma-based, coverage tracks the open detection-engineering community, and rules can be updated on demand with update-rules. The tool's output integrates with downstream analysis: CSV opens in Timeline Explorer, JSONL feeds into jq, and timesketch-* profiles export directly into Timesketch.

A frequent finding in Hayabusa timelines is malicious PowerShell — MITRE ATT&CK T1059.001 (Command and Scripting Interpreter: PowerShell) — surfaced via Sigma rules over Event ID 4104 (script-block logging), 4103, and Sysmon process creation. This skill maps to NIST CSF RS.AN-03 (analysis is performed to establish what has taken place during an incident).

When to Use

  • During incident-response triage, to turn a pile of collected .evtx files into a prioritized timeline.
  • When you need fast, SIEM-free detection over Windows event logs with community Sigma coverage.
  • To enumerate suspicious activity (PowerShell, account changes, lateral movement) across many hosts' logs.
  • To produce metrics (events per computer/Event ID/channel) and pivot keywords for deeper hunting.
  • To export an incident timeline into Timesketch or Timeline Explorer for collaborative analysis.

Prerequisites

  • Hayabusa binary. Download a pre-compiled release (Windows/Linux/macOS) from GitHub:
    bash
    # Linux example
curl -LO https://github.com/Yamato-Security/hayabusa/releases/latest/download/hayabusa-3.0.0-lin-x64-gnu.zip
unzip hayabusa-*.zip && cd hayabusa-*
./hayabusa-3.0.0-lin-x64-gnu --version
    Or build from source (rules are a submodule):
    bash
    git clone https://github.com/Yamato-Security/hayabusa.git --recursive
cd hayabusa && cargo build --release
  • Collected Windows .evtx files (or run with --live-analysis on the host, as Administrator).
  • Updated detection rules:
    bash
    ./hayabusa update-rules
  • Optional: Timeline Explorer (Windows) or Timesketch for visualizing output; jq for JSONL.

Objectives

  • Build a CSV or JSON forensic timeline from a directory of .evtx files.
  • Update and tune the Sigma rule set used for detection.
  • Select an output profile appropriate to the investigation (minimal vs. verbose vs. timesketch).
  • Generate metrics (computer, Event ID, log) and pivot keywords for hunting leads.
  • Filter the timeline by minimum severity to focus triage.
  • Search logs for specific IOCs by keyword or regex.

MITRE ATT&CK Mapping

Technique IDOfficial NameWhy Hayabusa Detects It
T1059.001Command and Scripting Interpreter: PowerShellSigma rules over Event IDs 4104/4103 and Sysmon flag malicious PowerShell
T1059.003Command and Scripting Interpreter: Windows Command ShellRules over process-creation events surface suspicious cmd usage
T1078Valid AccountsLogon events (4624/4625/4672) reveal anomalous authentication
T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup FolderRules over registry-modification events flag persistence
T1053.005Scheduled Task/Job: Scheduled TaskEvent ID 4698/106 rules surface task creation
T1003OS Credential DumpingRules flag LSASS access and credential-dumping patterns
Show full SKILL.md (286 more words)Show less

Workflow

1. Update the rule set

Pull the latest Sigma and Hayabusa rules before every investigation.

bash
./hayabusa update-rules
2. Build a CSV timeline from collected logs

Point Hayabusa at a directory of .evtx files and write a CSV timeline. -w skips the interactive wizard for scripted runs.

bash
./hayabusa csv-timeline -d ./collected_evtx -o timeline.csv -w
# UTC timestamps for cross-host correlation
./hayabusa csv-timeline -d ./collected_evtx -o timeline_utc.csv -U -w
3. Choose an output profile

Profiles control detail. Use verbose to include MITRE ATT&CK tactics, tags, and the source rule/EVTX file; all-field-info to retain every original field.

bash
# Verbose: adds MITRE tactics, tags, rule file, evtx file
./hayabusa csv-timeline -d ./collected_evtx -o timeline_verbose.csv -p verbose -w
# Preserve all original event fields
./hayabusa csv-timeline -d ./collected_evtx -o timeline_full.csv -p all-field-info -w

Available profiles: minimal, standard (default), verbose, all-field-info, all-field-info-verbose, super-verbose, timesketch-minimal, timesketch-verbose.

4. Filter by minimum severity

Focus triage on the highest-confidence detections with -m/--min-level.

bash
./hayabusa csv-timeline -d ./collected_evtx -o critical.csv -m high -w

Levels: informational, low, medium, high, critical.

5. Produce a JSON/JSONL timeline for tooling

JSONL feeds cleanly into jq and downstream pipelines.

bash
./hayabusa json-timeline -d ./collected_evtx -L -o timeline.jsonl -w
# Example: top rule titles
jq -r '.RuleTitle' timeline.jsonl | sort | uniq -c | sort -rn | head
6. Generate metrics and pivot keywords

Summaries reveal which hosts and Event IDs dominate, and pivot keywords give hunting leads.

bash
./hayabusa computer-metrics -d ./collected_evtx -o computers.csv
./hayabusa eid-metrics -d ./collected_evtx -o eid.csv
./hayabusa log-metrics -d ./collected_evtx -o logs.csv
./hayabusa pivot-keywords-list -d ./collected_evtx -m medium -o pivots
7. Search logs for specific IOCs

Use the search command for keyword or regex hunting independent of detection rules.

bash
# Keyword search (case-insensitive) for a suspicious binary
./hayabusa search -d ./collected_evtx -k "powershell" -i
# Regex search for base64-looking PowerShell encoded commands
./hayabusa search -d ./collected_evtx -r "-[Ee]nc(odedCommand)?\s+[A-Za-z0-9+/=]{20,}"
8. Live triage on a running host

On the affected machine (Administrator), analyze local logs without exporting first.

bash
./hayabusa csv-timeline -l -o live_timeline.csv -m high -w

Tools and Resources

ToolPurposeSource
HayabusaSigma-based EVTX timeline/threat huntinghttps://github.com/Yamato-Security/hayabusa
hayabusa-rulesSigma + Hayabusa detection ruleshttps://github.com/Yamato-Security/hayabusa-rules
TakajōHayabusa results analyzerhttps://github.com/Yamato-Security/takajo
Timeline ExplorerReview CSV timelineshttps://ericzimmerman.github.io/
TimesketchCollaborative timeline analysishttps://timesketch.org/
SigmaGeneric detection rule formathttps://github.com/SigmaHQ/sigma

Validation Criteria

  • Hayabusa binary installed and --version confirmed.
  • Rules updated with update-rules before analysis.
  • CSV timeline generated from the collected .evtx directory.
  • Appropriate output profile selected for the investigation goal.
  • Timeline filtered by minimum severity for triage focus.
  • JSON/JSONL timeline produced for downstream tooling where needed.
  • Computer/EID/log metrics generated.
  • Pivot keywords list produced for hunting leads.
  • Targeted IOC searches run with keyword/regex.
  • Findings (e.g., PowerShell T1059.001 detections) documented in the incident timeline.

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 4 other files (scripts, references) in skills/generating-forensic-timelines-with-hayabusa of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • references/api-reference.md
  • references/standards.md
  • scripts/agent.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Generating Forensic Timelines With Hayabusa next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Generating Forensic Timelines With Hayabusa compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Generating Forensic Timelines With Hayabusa this skillmukul975/Anthropic-Cybersecurity-Skills34k—~2.2kAutomated safety check: PassApache-2.0
Ctf Malwareljagiello/ctf-skills3.4k—~2.1kAutomated safety check: NotesMIT
Dfirtransilienceai/communitytools563—~1.5kAutomated safety check: PassMIT
Forensics OsqueryAgentSecOps/SecOpsAgentKit2201 repos~4.9kAutomated safety check: NotesCustom licence
Log Evasionwgpsec/AboutSecurity1.8k—~1.2kAutomated safety check: PassNone
Incident Response NetworkLeoYeAI/openclaw-master-skills2.2k—~5kAutomated safety check: PassApache-2.0

Similar skills

  • Ctf Malware

    ljagiello/ctf-skills

    Provides malware analysis and network traffic techniques for CTF challenges.

    3.4k GitHub stars~2.1k tokensUpdated 27 days ago
    SecurityAuto-check: notes

  • Dfir

    transilienceai/communitytools

    Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.

    563 GitHub stars~1.5k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • Forensics Osquery

    AgentSecOps/SecOpsAgentKit

    SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases.

    220 GitHub starsUsed in 1 repo~4.9k tokens
    SecurityAuto-check: notes

  • Log Evasion

    wgpsec/AboutSecurity

    日志分析与日志逃逸方法论。理解蓝队如何通过日志追踪攻击行为（SIEM/Event Log/Syslog），以及红队如何规避日志记录或精准清除痕迹。当需要设计无痕操作或分析日志监控覆盖范围时使用

    1.8k GitHub stars~1.2k tokensUpdated yesterday
    SecurityAuto-check passed

  • Incident Response Network

    LeoYeAI/openclaw-master-skills

    Network forensics evidence collection and analysis during security incidents.

    2.2k GitHub stars~5k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • TShark Traffic Analysis

    AgentSecOps/SecOpsAgentKit

    Guides authorized packet capture and analysis with TShark, Wireshark's command-line tool, for security investigations, malware detection and forensic examination of network traffic.

    220 GitHub starsUsed in 1 repo~4.8k tokens
    SecurityAuto-check: notes

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Works with

Categories

Questions about Generating Forensic Timelines With Hayabusa

What does Generating Forensic Timelines With Hayabusa do?

Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV/JSON timeline with severity levels, MITRE ATT&CK mappings, and…. Generating Forensic Timelines With Hayabusa is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV/JSON timeline with severity levels, MITRE ATT&CK mappings, and per-host/per-Event-ID metrics.

When should I use Generating Forensic Timelines With Hayabusa?

Generating Forensic Timelines With Hayabusa fits situations like: tasks that involve Digital forensics; tasks that involve Security operations; tasks that involve CSV and tabular files.

How do I install Generating Forensic Timelines With Hayabusa in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill generating-forensic-timelines-with-hayabusa -a claude-code`. Or copy the skill folder (skills/generating-forensic-timelines-with-hayabusa in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/generating-forensic-timelines-with-hayabusa in your project. Claude Code loads it when a task matches its description.

How do I install Generating Forensic Timelines With Hayabusa in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill generating-forensic-timelines-with-hayabusa -a codex`. Or copy the skill folder (skills/generating-forensic-timelines-with-hayabusa in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/generating-forensic-timelines-with-hayabusa in your project. Codex loads it when a task matches its description.

Can I use Generating Forensic Timelines With Hayabusa in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill generating-forensic-timelines-with-hayabusa -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/generating-forensic-timelines-with-hayabusa, .gemini/skills/generating-forensic-timelines-with-hayabusa, .github/skills/generating-forensic-timelines-with-hayabusa and .opencode/skills/generating-forensic-timelines-with-hayabusa in your project.

What does Generating Forensic Timelines With Hayabusa need to run?

Going by SKILL.md and its folder, Generating Forensic Timelines With Hayabusa needs Python for the scripts in its folder and the command-line tools its instructions call (curl, git, cargo and jq). Our summary lists: Python 3.

Does Generating Forensic Timelines With Hayabusa access the network?

SKILL.md names 3 domains. In commands or code: github.com; the agent is likely to contact it when it follows the instructions. As links in the text: ericzimmerman.github.io and timesketch.org. This is read from the text; nothing was executed.

Is Generating Forensic Timelines With Hayabusa safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Generating Forensic Timelines With Hayabusa use?

Generating Forensic Timelines With Hayabusa is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Generating Forensic Timelines With Hayabusa use?

About 2.2k tokens (SKILL.md is roughly 8.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1k tokens, read only when the agent opens those files.

What are the alternatives to Generating Forensic Timelines With Hayabusa?

Skills that share tags, products or a category with Generating Forensic Timelines With Hayabusa: Ctf Malware (ljagiello/ctf-skills, 3.4k stars), Dfir (transilienceai/communitytools, 563 stars), Forensics Osquery (AgentSecOps/SecOpsAgentKit, 220 stars) and Log Evasion (wgpsec/AboutSecurity, 1.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Generating Forensic Timelines With Hayabusa?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.