scan_evtx
Scan Windows Event Log (.evtx) files with Hayabusa rules to detect threats. Output results in CSV or JSON, filter by rule text or severity.
Instructions
Run a Hayabusa detection scan over Windows Event Log (.evtx) data.
Wraps hayabusa csv-timeline / hayabusa json-timeline, always run
non-interactively (no rule-config wizard, no launch banner).
Args:
target: Path to a single .evtx file (set is_file=True) or a
directory containing .evtx files.
is_file: True if target is a single .evtx file rather than a
directory.
output_format: "csv" (uses csv-timeline), or "json"/"jsonl"
(both use json-timeline; jsonl adds Hayabusa's -L flag). This
controls Hayabusa's own output format, not the shape of the
dict returned by this tool — see result_detail for that.
rules_dir: Optional path to a custom Sigma/Hayabusa rules
directory or file (passed as -r). Defaults to Hayabusa's
bundled ./rules. Ignored if rule_filter is set (see below).
rule_filter: Only run rules whose rule file text contains this
string (case-insensitive), e.g. "lateral" or "mimikatz".
Hayabusa has no native free-text rule filter, so this copies
matching rule files from rules_dir (or Hayabusa's default
./rules) into a temporary rules directory and scans with just
those loaded.
min_level: Optional minimum alert level to load: "informational",
"low", "medium", "high", or "critical" (passed as -m).
utc: Output timestamps in UTC instead of local time (-U).
output_path: Where to write the full result file. If omitted, a
temporary file is used and deleted after a preview is
extracted, so the full result set is only kept on disk when
you pass this explicitly.
result_detail: "summary" (default) returns counts by level, the
top matching rules, and a condensed preview (key fields only);
stdout/stderr tails are only included on non-zero exit. "full"
returns the complete record preview with all fields plus
stdout/stderr tails, as before.
max_results: Cap on the number of preview records returned
(default 20). Does not affect record_count, which is always
the true total.
Returns: A dict shaped per result_detail; see above.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| utc | No | ||
| target | Yes | ||
| is_file | No | ||
| min_level | No | ||
| rules_dir | No | ||
| max_results | No | ||
| output_path | No | ||
| rule_filter | No | ||
| output_format | No | json | |
| result_detail | No | summary |