List available Hayabusa/Sigma detection rules, optionally filtered by keyword.

Useful for understanding what rules exist before running scan_evtx — e.g. call with keyword="mimikatz" to see which rules would be loaded by scan_evtx(rule_filter="mimikatz"), since both use the same case-insensitive match against rule file text.

Args: keyword: Only return rules whose rule file text contains this string (case-insensitive), e.g. "lateral" or "mimikatz". Omit to list all rules (subject to max_results). rules_dir: Optional path to a custom Sigma/Hayabusa rules directory. Defaults to Hayabusa's bundled ./rules. max_results: Cap on the number of rules returned (default 50). total_matched in the response is always the true match count.

Returns: A dict with total_matched (true count of matching rule files) and rules: a list of {path, id, title, level, status, description, author, tags, logsource}, capped at max_results.

Run a Hayabusa detection scan over Windows Event Log (.evtx) data.

Wraps hayabusa csv-timeline / hayabusa json-timeline, always run non-interactively (no rule-config wizard, no launch banner).

Args: target: Path to a single .evtx file (set is_file=True) or a directory containing .evtx files. is_file: True if target is a single .evtx file rather than a directory. output_format: "csv" (uses csv-timeline), or "json"/"jsonl" (both use json-timeline; jsonl adds Hayabusa's -L flag). This controls Hayabusa's own output format, not the shape of the dict returned by this tool — see result_detail for that. rules_dir: Optional path to a custom Sigma/Hayabusa rules directory or file (passed as -r). Defaults to Hayabusa's bundled ./rules. Ignored if rule_filter is set (see below). rule_filter: Only run rules whose rule file text contains this string (case-insensitive), e.g. "lateral" or "mimikatz". Hayabusa has no native free-text rule filter, so this copies matching rule files from rules_dir (or Hayabusa's default ./rules) into a temporary rules directory and scans with just those loaded. min_level: Optional minimum alert level to load: "informational", "low", "medium", "high", or "critical" (passed as -m). utc: Output timestamps in UTC instead of local time (-U). output_path: Where to write the full result file. If omitted, a temporary file is used and deleted after a preview is extracted, so the full result set is only kept on disk when you pass this explicitly. result_detail: "summary" (default) returns counts by level, the top matching rules, and a condensed preview (key fields only); stdout/stderr tails are only included on non-zero exit. "full" returns the complete record preview with all fields plus stdout/stderr tails, as before. max_results: Cap on the number of preview records returned (default 20). Does not affect record_count, which is always the true total.

Returns: A dict shaped per result_detail; see above.