Hayabusa

https://github.com/yamato-security/hayabusa
Admin
A Windows event log fast forensics timeline generator and threat hunting tool written in Rust with...
Tokens:51,867
Snippets:749
Trust Score:8.8
Update:5 months ago
Show doc for...
Tokens:
Raw
### Level Tuning Command Examples

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Examples of how to use the `level-tuning` command. The first example shows normal usage, while the second demonstrates tuning alert levels with a custom configuration file.

```bash
hayabusa.exe level-tuning
```

```bash
hayabusa.exe level-tuning -f ./config/level_tuning.txt
```

--------------------------------

### Install and Deploy Timesketch via Docker on Ubuntu

Source: https://github.com/yamato-security/hayabusa/blob/main/doc/TimesketchImport/TimesketchImport-English.md

Installs Timesketch using a deployment script and Docker Compose. Ensure Docker is installed and running. This script downloads the deployment script, makes it executable, and then starts the Timesketch services.

```bash
curl -s -O https://raw.githubusercontent.com/google/timesketch/master/contrib/deploy_timesketch.sh
chmod 755 deploy_timesketch.sh
cd /opt
sudo ~/deploy_timesketch.sh
cd timesketch
sudo docker compose up -d

# Create a user named user. Set the password here.
sudo docker compose exec timesketch-web tsctl create-user user
```

--------------------------------

### Search for Critical Systems Example

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Example of how to use the `config-critical-systems` command to search a directory for domain controllers and file servers.

```bash
hayabusa.exe config-critical-systems -d ../hayabusa-sample-evtx"
```

--------------------------------

### Install heaptrack on Ubuntu

Source: https://github.com/yamato-security/hayabusa/blob/main/doc/RustPerformance-English.md

Install heaptrack and its GUI component on Ubuntu 22.04. These commands are necessary prerequisites for using heaptrack as a memory profiler.

```bash
sudo apt install heaptrack
sudo apt install heaptrack-gui
```

--------------------------------

### Run Hayabusa Logon Summary Command

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Example of running the `logon-summary` command. This command provides a summary of user logon events.

```bash
target\x86_64-pc-windows-gnu\release\hayabusa.exe logon-summary -d C:\Users\Public\Documents\logons.csv
```

--------------------------------

### Set Default Profile Command Examples

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Examples demonstrating how to set the default output profile for the Hayabusa tool. You can set it to profiles like 'minimal' or 'super-verbose'.

```bash
hayabusa.exe set-default-profile minimal
```

```bash
hayabusa.exe set-default-profile super-verbose
```

--------------------------------

### Configure Critical Systems

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Example of using the `config-critical-systems` command to configure critical systems. This command is used for setting up system-specific configurations.

```bash
target\x86_64-pc-windows-gnu\release\hayabusa.exe config-critical-systems -c C:\Users\Public\Documents\critical-systems.toml
```

--------------------------------

### Verbose Output Example: Loaded Rules

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

This snippet shows an example of the verbose output indicating which rules have been loaded during the analysis.

```text
Loaded rule: rules/sigma/builtin/deprecated/proc_creation_win_susp_run_folder.yml
Loaded rule: rules/sigma/builtin/deprecated/proc_creation_win_execution_mssql_xp_cmdshell_stored_procedure.yml
Loaded rule: rules/sigma/builtin/deprecated/proc_creation_win_susp_squirrel_lolbin.yml
Loaded rule: rules/sigma/builtin/win_alert_mimikatz_keywords.yml
```

--------------------------------

### Example expand-list values file content

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

This file lists the values to be checked against the `IpAddress|expand` field in a rule. If the config file does not exist, the `expand` rule will be ignored.

```text
AdminWorkstation1
AdminWorkstation2
AdminWorkstation3
```

--------------------------------

### Run Hayabusa Eid Metrics Command

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Example of running the `eid-metrics` command with a specified configuration file. This command analyzes event IDs.

```bash
target\x86_64-pc-windows-gnu\release\hayabusa.exe eid-metrics -d C:\Users\Public\Documents\metrics.csv -c C:\Users\Public\Documents\eid-metrics.toml
```

--------------------------------

### Run Hayabusa Log Metrics Command

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Example of running the `log-metrics` command. This command collects and displays metrics from log files.

```bash
target\x86_64-pc-windows-gnu\release\hayabusa.exe log-metrics -d C:\Users\Public\Documents\logs.csv
```

--------------------------------

### Run Hayabusa Analysis Command

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Example of running the `computer-metrics` analysis command. This command collects and displays system metrics.

```bash
target\x86_64-pc-windows-gnu\release\hayabusa.exe computer-metrics -d C:\Users\Public\Documents\metrics.csv
```

--------------------------------

### Run Hayabusa Pivot Keywords List Command

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Example of running the `pivot-keywords-list` command with a specified configuration file. This command helps in pivoting on keywords within data.

```bash
target\x86_64-pc-windows-gnu\release\hayabusa.exe pivot-keywords-list -d C:\Users\Public\Documents\data.csv -c C:\Users\Public\Documents\pivot-keywords.toml
```

--------------------------------

### Example JSON Log Structure

Source: https://github.com/yamato-security/hayabusa/blob/main/doc/AnalysisWithJQ-English.md

This example demonstrates the nested structure of a typical JSON log entry produced by Hayabusa, including a 'Details' object.

```json
{
    "Timestamp": "2016-08-19 08:06:57.658 +09:00",
    "Computer": "IE10Win7",
    "Channel": "Sec",
    "EventID": 4688,
    "Level": "info",
    "RecordID": 6845,
    "RuleTitle": "Proc Exec",
    "Details": {
        "CmdLine": "C:\\Windows\\system32\\ipconfig /release",
        "Path": "C:\\Windows\\System32\\ipconfig.exe",
        "PID": "0xcf4",
        "User": "IE10WIN7$",
        "LID": "0x3e7"
    }
}
```

--------------------------------

### Run Hayabusa Search Command

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Example of running the `search` command with specified data and configuration files. This command performs searches based on defined rules.

```bash
target\x86_64-pc-windows-gnu\release\hayabusa.exe search -d C:\Users\Public\Documents\data.csv -c C:\Users\Public\Documents\rules.toml
```

--------------------------------

### Install and Configure geoipupdate on Windows

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Instructions for downloading the Windows binary of `geoipupdate` and configuring it for automatic GeoIP database updates. Update the `GeoIP.conf` file with your MaxMind credentials and EditionIDs.

```powershell
# Download the latest Windows binary (Ex: geoipupdate_4.10.0_windows_amd64.zip)
# Edit \ProgramData\MaxMind/GeoIPUpdate\GeoIP.conf
# Add AccountID, LicenseKey, and EditionIDs GeoLite2-ASN GeoLite2-City GeoLite2-Country
# Run the geoipupdate executable
```

--------------------------------

### Run Hayabusa Expand List Command

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Example of using the `expand-list` command to expand a list of items. This is useful for processing lists of indicators or values.

```bash
target\x86_64-pc-windows-gnu\release\hayabusa.exe expand-list -d C:\Users\Public\Documents\list.txt
```

--------------------------------

### Cross-compile 32-bit Windows Binaries

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Set up the Rust environment and compile a 32-bit Windows binary on a 64-bit Windows system. This involves installing the specific target and then building the release version.

```bash
rustup install stable-i686-pc-windows-msvc
```

```bash
rustup target add i686-pc-windows-msvc
```

```bash
rustup run stable-i686-pc-windows-msvc cargo build --release
```

--------------------------------

### Install and Configure geoipupdate on macOS

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Steps to install the `geoipupdate` tool via Homebrew and configure it for automatic GeoIP database updates. Ensure your AccountID, LicenseKey, and EditionIDs are correctly set in the configuration file.

```bash
brew install geoipupdate
# Edit /usr/local/etc/GeoIP.conf or /opt/homebrew/etc/GeoIP.conf
# Add AccountID, LicenseKey, and EditionIDs GeoLite2-ASN GeoLite2-City GeoLite2-Country
geoipupdate
```

--------------------------------

### Example expand-list rule configuration

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

When using the `expand` field modifier in rules, create a `.txt` file in `./config/expand/` named after the expand field. This file should contain the values to be checked.

```yaml
detection:
    selection:
        EventID: 5145
        RelativeTargetName|contains: '\winreg'
    filter_main:
        IpAddress|expand: '%Admins_Workstations%'
    condition: selection and not filter_main
```

--------------------------------

### Compile Hayabusa for Windows

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Compile Hayabusa for 64-bit Windows targets. Ensure you have the necessary cross-compilation targets installed.

```bash
cargo build --release --target x86_64-pc-windows-gnu
```

--------------------------------

### Kibana Query Language (KQL) Filtering Examples

Source: https://github.com/yamato-security/hayabusa/blob/main/doc/ElasticStackImport/ElasticStackImport-English.md

Examples of KQL queries to filter events in Kibana Discover. These demonstrate filtering by severity level, excluding informational events, searching by MITRE ATT&CK tactics, specific attack names, and target user details.

```kql
Level: "crit"
```

```kql
Level: "crit" OR Level: "high"
```

```kql
NOT Level: info
```

```kql
MitreTactics: *LatMov*
```

```kql
"PW Spray"
```

```kql
"LID: 0x8724ead"
```

```kql
Details_TgtUser: admmig
```

--------------------------------

### Compile Hayabusa from Source

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Compile the Hayabusa binary from source code using Cargo. This command requires a Rust installation and builds the release version of the project.

```bash
cargo build --release
```

--------------------------------

### Cross-compile Linux MUSL Binaries

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Set up the Rust environment and compile a MUSL binary for Linux. This involves installing the target and then building the release version with the specified target.

```bash
rustup install stable-x86_64-unknown-linux-musl
```

```bash
rustup target add x86_64-unknown-linux-musl
```

```bash
cargo build --release --target=x86_64-unknown-linux-musl
```

--------------------------------

### Run Hayabusa Extract Base64 Command

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Example of using the `extract-base64` command to extract Base64 encoded strings from a file. This is useful for decoding embedded data.

```bash
target\x86_64-pc-windows-gnu\release\hayabusa.exe extract-base64 -d C:\Users\Public\Documents\encoded.txt
```

--------------------------------

### Get Performance Counters with PowerShell

Source: https://github.com/yamato-security/hayabusa/blob/main/doc/RustPerformance-English.md

Use this PowerShell command to continuously record performance counter data to a CSV file. Ensure PowerShell 7 is installed. This is useful for monitoring system resources like memory and processor usage.

```PowerShell
Get-Counter -Counter "\Memory\Available MBytes",  "\Processor(_Total)\% Processor Time" -Continuous | ForEach {
         $_.CounterSamples | ForEach {
             [pscustomobject]@{
                 TimeStamp = $_.TimeStamp
                 Path = $_.Path
                 Value = $_.CookedValue
             }
         }
     } | Export-Csv -Path PerfMonCounters.csv -NoTypeInformation
```

--------------------------------

### Clone Sample EVTX Files

Source: https://github.com/yamato-security/hayabusa/wiki/Testing-Hayabusa-on-Sample-Evtx-Files

Use this command to download the sample EVTX files into a local directory for testing Hayabusa.

```bash
git clone https://github.com/Yamato-Security/hayabusa-sample-evtx.git
```

--------------------------------

### Print Logon Summary from Single File

Source: https://github.com/yamato-security/hayabusa/wiki/Usage-Examples

Prints a logon summary from a single specified .evtx file. Ensure the file path is correct.

```bash
hayabusa.exe logon-summary -f Security.evtx
```

--------------------------------

### Install macOS Build Dependencies

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Install necessary build dependencies for compiling on macOS, specifically 'pkg-config' and 'openssl', if you encounter compile errors related to openssl.

```bash
brew install pkg-config
```

```bash
brew install openssl
```

--------------------------------

### Example of Traditional JSON Log Format

Source: https://github.com/yamato-security/hayabusa/blob/main/doc/AnalysisWithJQ-English.md

This is an example of the traditional JSON format where all log objects are contained within a single array. This format can be cumbersome for tools like `jq` and memory-intensive for large files.

```json
[
    {
        "Timestamp": "2016-08-19 08:06:57.658 +09:00",
        "Computer": "IE10Win7",
        "Channel": "Sec",
        "EventID": 4688,
        "Level": "info",
        "RecordID": 6845,
        "RuleTitle": "Proc Exec",
        "Details": {
            "CmdLine": "C:\\Windows\\system32\\ipconfig /release",
            "Path": "C:\\Windows\\System32\\ipconfig.exe",
            "PID": "0xcf4",
            "User": "IE10WIN7$",
            "LID": "0x3e7"
        }
    },
    {
        "Timestamp": "2016-08-19 11:07:47.489 +09:00",
        "Computer": "IE10Win7",
        "Channel": "Sec",
        "EventID": 4688,
        "Level": "info",
        "RecordID": 6847,
        "RuleTitle": "Proc Exec",
        "Details": {
            "CmdLine": "taskhost.exe $(Arg0)",
            "Path": "C:\\Windows\\System32\\taskhost.exe",
            "PID": "0x228",
            "User": "IE10WIN7$",
            "LID": "0x3e7"
        }
    }
]
```

--------------------------------

### Kibana KQL Filtering Examples

Source: https://github.com/yamato-security/hayabusa/wiki/Importing-Results-Into-Elastic-Stack

Examples of Kibana Query Language (KQL) for filtering Hayabusa results in the Discover view. These queries demonstrate how to select specific alerts by level, exclude informational events, search for keywords, and filter by Logon ID.

```kql
Level: "critical"
```

```kql
Level: "critical" or Level: "high"
```

```kql
NOT Level:info
```

```kql
*LatMov*
```

```kql
"Password Spray"
```

```kql
"LID: 0x8724ead"
```

--------------------------------

### Clone Timesketch Repository on macOS

Source: https://github.com/yamato-security/hayabusa/blob/main/doc/TimesketchImport/TimesketchImport-English.md

Clones the Timesketch repository from GitHub. This is a prerequisite for starting the Docker containers on macOS.

```bash
git clone https://github.com/google/timesketch.git
cd timesketch
```

--------------------------------

### Using 'all-field-info' Profile with Hayabusa

Source: https://github.com/yamato-security/hayabusa/blob/main/doc/AnalysisWithJQ-English.md

Command to include all original field information from .evtx logs in the output. This is achieved using the `--profile all-field-info` option.

```bash
hayabusa json-timeline -d <directory> --profile all-field-info -o results.json
```

--------------------------------

### Level Tuning Configuration File Sample

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

A sample CSV formatted configuration file for tuning alert levels. It maps rule IDs to new risk levels. Ensure custom configurations are saved in `./config/level_tuning.txt` to avoid overwrites during rule updates.

```csv
id,new_level
570ae5ec-33dc-427c-b815-db86228ad43e,informational # 'Application Uninstalled' - Originally low.
b6ce0b2f-593b-5e1c-e137-d30b2974e30e,high # 'Suspicious Double Extension File Execution' - Sysmon 1 - Originally critical
452b2159-5e6e-c494-63b9-b385d6195f58,high # 'Suspicious Double Extension File Execution' - Security 4688 - Originally critical
51ba8477-86a4-6ff0-35fa-7b7f1b1e3f83,high # 'CobaltStrike Service Installations - System' - System 7045 - Originally critical
daad2203-665f-294c-6d2f-f9272c3214f2,critical # 'Mimikatz DC Sync' - Security 4662 - Originally high
8b061ac2-31c7-659d-aa1b-36ceed1b03f1,high # 'HackTool - Rubeus Execution' - Sysmon 1 - Originally critical
be670d5c-31eb-7391-4d2e-d122c89cd5bb,high # 'HackTool - Rubeus Execution' - Security 4688 - Originally critical
```

--------------------------------

### Update Stable Rust

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Periodically update your stable Rust installation to ensure you have the latest compiler and tools. This is important for maintaining build compatibility.

```bash
rustup update stable
```

--------------------------------

### Level Tuning Command Usage

Source: https://github.com/yamato-security/hayabusa/wiki/Usage-Examples

Displays the usage information for the `level-tuning` command, including available options for output settings and general configuration.

```bash
Usage: level-tuning [OPTIONS]

Display Settings:
      --no-color  Disable color output
  -q, --quiet     Quiet mode: do not display the launch banner

General Options:
  -f, --file <FILE>  Tune alert levels (default: ./rules/config/level_tuning.txt)
```

--------------------------------

### Print Verbose Information

Source: https://github.com/yamato-security/hayabusa/wiki/Usage-Examples

Enable verbose output to get detailed information about file processing times, parsing errors, and other diagnostic data.

```bash
hayabusa.exe csv-timeline -d .\hayabusa-sample-evtx -v
```

--------------------------------

### Save Logon Summary from Directory

Source: https://github.com/yamato-security/hayabusa/wiki/Usage-Examples

Saves the logon summary results from multiple .evtx files located in a directory to a CSV file. Specify the output file prefix.

```bash
hayabusa.exe logon-summary -d ../logs -o logon-summary.csv
```

--------------------------------

### Run Level Tuning with Custom Config

Source: https://github.com/yamato-security/hayabusa/wiki/Usage-Examples

Tunes rule alert levels using a specified custom configuration file. Ensure the file path is correct.

```bash
hayabusa.exe level-tuning -f my_level_tuning.txt
```

--------------------------------

### Verbose Output Example: Scan Errors

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

This snippet illustrates potential errors encountered during the scan, such as failing to parse an event file or serialize binary XML.

```text
[ERROR] Failed to parse event file.
EventFile: ../logs/Microsoft-Rdms-UI%4Operational.evtx
Error: Failed to parse record number 58471

[ERROR] Failed to parse event file.
EventFile: ../logs/Microsoft-Rdms-UI%4Operational.evtx
Error: Failed to parse record number 58470

[ERROR] Failed to parse event file.
EventFile: ../logs/Microsoft-Windows-AppxPackaging%4Operational.evtx
Error: An error occurred while trying to serialize binary xml to output.
```

--------------------------------

### Logon Summary Command Usage

Source: https://github.com/yamato-security/hayabusa/wiki/Usage-Examples

Displays the usage information for the `logon-summary` command, detailing input options, filtering, output settings, and general configurations.

```bash
Usage: logon-summary <INPUT> [OPTIONS]

Input:
  -d, --directory <DIR>  Directory of multiple .evtx files
  -f, --file <FILE>      File path to one .evtx file
  -l, --live-analysis    Analyze the local C:\\Windows\\System32\\winevt\\Logs folder
  -J, --JSON-input       Scan JSON formatted logs instead of .evtx (.json or .jsonl)
  -x, --recover-records  Carve evtx records from slack space (default: disabled)

Filtering:
      --exclude-computer <COMPUTER...>  Do not scan specified computer names (ex: ComputerA) (ex: ComputerA,ComputerB)
      --include-computer <COMPUTER...>  Scan only specified computer names (ex: ComputerA) (ex: ComputerA,ComputerB)
      --timeline-end <DATE>             End time of the event logs to load (ex: "2022-02-22 23:59:59 +09:00")
      --timeline-offset <OFFSET>        Scan recent events based on an offset (ex: 1y, 3M, 30d, 24h, 30m)
      --timeline-start <DATE>           Start time of the event logs to load (ex: "2020-02-22 00:00:00 +09:00")

Output:
  -o, --output <FILENAME-PREFIX>  Save the logon summary to two CSV files (ex: -o logon-summary)

Display Settings:
      --no-color  Disable color output
  -q, --quiet     Quiet mode: do not display the launch banner
  -v, --verbose   Output verbose information

General Options:
  -C, --clobber                        Overwrite files when saving
  -Q, --quiet-errors                   Quiet errors mode: do not save error logs
  -c, --rules-config <DIR>             Specify custom rule config directory (default: ./rules/config)
      --target-file-ext <FILE-EXT...>  Specify additional evtx file extensions (ex: evtx_data)
  -t, --threads <NUMBER>               Number of threads (default: optimal number for performance)

Time Format:
      --European-time     Output timestamp in European time format (ex: 22-02-2022 22:00:00.123 +02:00)
      --ISO-8601          Output timestamp in ISO-8601 format (ex: 2022-02-22T10:10:10.1234567Z) (Always UTC)
      --RFC-2822          Output timestamp in RFC 2822 format (ex: Fri, 22 Feb 2022 22:00:00 -0600)
      --RFC-3339          Output timestamp in RFC 3339 format (ex: 2022-02-22 22:00:00.123456-06:00)
      --US-military-time  Output timestamp in US military time format (ex: 02-22-2022 22:00:00.123 -06:00)
      --US-time           Output timestamp in US time format (ex: 02-22-2022 10:00:00.123 PM -06:00)
  -U, --UTC               Output time in UTC format (default: local time)
```

--------------------------------

### Using 'super-verbose' Profile with Hayabusa

Source: https://github.com/yamato-security/hayabusa/blob/main/doc/AnalysisWithJQ-English.md

Command to include both 'Details' and 'AllFieldInfo' objects in the output. This profile provides the most comprehensive data.

```bash
hayabusa json-timeline -d <directory> --profile super-verbose -o results.json
```

--------------------------------

### Print computer metrics from a directory

Source: https://github.com/yamato-security/hayabusa/wiki/Usage-Examples

Use the `computer-metrics` command to analyze logs in a directory and display computer name metrics. Ensure the input directory contains .evtx files.

```bash
hayabusa.exe computer-metrics -d ../logs
```

--------------------------------

### Level Tuning Command Usage

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Displays the available options for the `level-tuning` command. Use this to understand how to modify alert risk levels.

```bash
Usage: level-tuning [OPTIONS]

Display Settings:
  -K, --no-color  Disable color output
  -q, --quiet     Quiet mode: do not display the launch banner

General Options:
  -f, --file <FILE>  Tune alert levels (default: ./rules/config/level_tuning.txt)
  -h, --help         Show the help menu
```

--------------------------------

### List Profiles Command Usage

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Displays the available options for the `list-profiles` command. This command is used to view available output profiles.

```bash
Usage: list-profiles [OPTIONS]

Display Settings:
  -K, --no-color  Disable color output
  -q, --quiet     Quiet mode: do not display the launch banner

General Options:
  -h, --help  Show the help menu
```

--------------------------------

### Run on Live Windows Machine for Alert Detection

Source: https://github.com/yamato-security/hayabusa/wiki/Usage-Examples

Analyze a live Windows machine to detect alerts (potentially malicious behavior). Requires Administrator privileges.

```bash
hayabusa.exe csv-timeline -l -m low
```

--------------------------------

### Run Level Tuning Command

Source: https://github.com/yamato-security/hayabusa/wiki/Usage-Examples

Executes the `level-tuning` command with default settings. This command tunes alert levels based on the default configuration file.

```bash
hayabusa.exe level-tuning
```

--------------------------------

### Run Hayabusa on Linux

Source: https://github.com/yamato-security/hayabusa/wiki/Running-Hayabusa

After making the binary executable, you can run Hayabusa from the root directory of the project.

```bash
./hayabusa
```

--------------------------------

### Extract and Count Channel, Event ID, and Rule Title with jq

Source: https://github.com/yamato-security/hayabusa/blob/main/doc/AnalysisWithJQ-English.md

Extend the previous example by including the 'RuleTitle' field. This allows for detailed analysis of specific event types and their associated rules.

```bash
cat results.json | jq -j ' .Channel , " " , .EventID , " " , .RuleTitle , "\n" ' | sort | uniq -c | sort -nr | head -n 10
```

--------------------------------

### Configure Critical Systems Command Usage

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

Displays the usage instructions for the `config-critical-systems` command, including input file options and display/general settings.

```bash
Usage: hayabusa.exe config-critical-systems <INPUT> [OPTIONS]

Input:
  -d, --directory <DIR>  Directory of multiple .evtx files
  -f, --file <FILE>      File path to one .evtx file

Display Settings:
  -K, --no-color  Disable color output
  -q, --quiet     Quiet mode: do not display the launch banner

General Options:
  -h, --help  Show the help menu
```

--------------------------------

### Print Event ID metrics from a directory

Source: https://github.com/yamato-security/hayabusa/blob/main/README.md

This command processes all .evtx files within a specified directory to generate Event ID metrics.

```bash
hayabusa.exe log-metrics -d ../logs
```
Tokens:
Raw