get_hayabusa_rules
List Hayabusa or Sigma detection rules, optionally filtered by keyword. Use to preview which rules will match a given filter for scan_evtx.
Instructions
List available Hayabusa/Sigma detection rules, optionally filtered by keyword.
Useful for understanding what rules exist before running scan_evtx — e.g. call with keyword="mimikatz" to see which rules would be loaded by scan_evtx(rule_filter="mimikatz"), since both use the same case-insensitive match against rule file text.
Args: keyword: Only return rules whose rule file text contains this string (case-insensitive), e.g. "lateral" or "mimikatz". Omit to list all rules (subject to max_results). rules_dir: Optional path to a custom Sigma/Hayabusa rules directory. Defaults to Hayabusa's bundled ./rules. max_results: Cap on the number of rules returned (default 50). total_matched in the response is always the true match count.
Returns: A dict with total_matched (true count of matching rule files) and rules: a list of {path, id, title, level, status, description, author, tags, logsource}, capped at max_results.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| keyword | No | ||
| rules_dir | No | ||
| max_results | No |