scan_evtx
Run a first-pass scan of Windows event logs (.evtx) to get aggregate metrics, detection timeline, and event ID insights in one call. Choose summary or full output with optional filtering by alert level or rule keyword.
Instructions
Run a high-level first-pass scan of an .evtx file or directory.
A convenience tool that combines hayabusa_log_metrics, hayabusa_csv_timeline (filtered by min_level), and hayabusa_eid_metrics into one call, plus a compact "summary" section, so a first look at a target doesn't require several separate tool calls.
Args: target: Path to an .evtx file or a directory containing .evtx files. min_level: Optional minimum alert level for the detection timeline, e.g. "informational", "low", "medium", "high", or "critical". rule_filter: Optional keyword to filter detections by. Only detections whose rule title contains this keyword (case-insensitive) are included. Matching only considers detections already fetched within max_rows -- raise max_rows if a large, truncated result set might hide matches. output_format: "summary" (default) returns a concise result -- aggregate counts plus a bounded "top_findings" list -- suited for reasoning over. "full" returns the complete result: file metadata, the full detection timeline, event ID metrics, and the summary, all still subject to rule_filter/max_results. max_results: Optional maximum number of detections ("findings") to return, applied after rule_filter. Defaults to max_rows, preserving prior behavior when omitted. max_rows: Maximum number of rows to fetch per sub-result (default 200). Also bounds how many detections rule_filter can search.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| max_rows | No | ||
| min_level | No | ||
| max_results | No | ||
| rule_filter | No | ||
| output_format | No | summary |