mcp-hayabusa

MCP server wrapping Hayabusa for EVTX (Windows Event Log) analysis.

Setup

uv sync
python3 scripts/download_hayabusa.py

download_hayabusa.py downloads the latest Hayabusa release for your platform into ./hayabusa/ and creates a stable ./hayabusa/hayabusa (.exe on Windows) path. ./hayabusa/ is gitignored — re-run the script instead of committing the binary.

Sigma rules for the detection knowledge base are mirrored from SigmaHQ/sigma into ./rules/:

git clone https://github.com/SigmaHQ/sigma.git sigma-rules
cp -r sigma-rules/rules ./rules

./rules/ is gitignored — re-clone/pull and re-copy instead of committing the mirror.

Related MCP server: hayabusa-mcp

Running the server

uv run server.py

Registering with Claude Code

Add to .claude/settings.json:

{
  "mcpServers": {
    "hayabusa": {
      "command": "python",
      "args": ["server.py"],
      "cwd": "."
    }
  }
}

Tools

scan_evtx

Scans an EVTX file with Hayabusa and returns structured results.

Returns a dict with finding_count (total matches after filtering, before max_results), returned_count (findings actually returned), and findings.

get_hayabusa_rules

Lists available Hayabusa detection rules, optionally filtered by keyword.

Returns a dict with rule_count and rules (each with title, id, level, description, tags, path).