Repo brief: Yamato-Security/hayabusa

Generated by RepoPilot · document generated 2026-09-14 · concise human review Evidence snapshot · analyzed 2026-09-14T23:04:10.437Z · commit 188e22eb4c3b

Verdict

Mixed — Mixed signals — read the receipts

• Last commit 2w ago
• 4 active contributors
• AGPL-3.0 licensed
• CI configured

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against dependency CVEs from deps.dev and OpenSSF Scorecard

What it is

Hayabusa is a Rust-based threat hunting and forensics tool that processes Windows event logs using Sigma detection rules (including v2 correlation rules) to generate fast forensic timelines and identify security incidents. It reads .evtx files, applies detection logic from YAML-based Sigma rules, and outputs results in multiple formats (CSV, JSON, HTML) with support for aggregation, correlation, and advanced field matching. Modular monolith: src/detections/ contains the rule engine (condition_parser.rs, aggregation_parser.rs, correlation_parser.rs, matchers/) with field extraction and detection logic; src/timeline/ handles timeline generation; src/results/ handles output formats (csv.rs,…

Start here

Read these in order:

• src/detections/rule/aggregation_parser.rs — Foundation: doesn't import anything internally and is imported by 3 other files. Read first to learn the vocabulary.
• src/options/geoip_search.rs — Foundation: imported by 2, no internal dependencies of its own.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

git clone https://github.com/Yamato-Security/hayabusa.git
cd hayabusa
cargo build --release
./target/release/hayabusa --help

Note: Verify Rust 1.97.1+ is installed (rustc --version); the project requires this specific minimum version per Cargo.toml.

Daily commands:

Build: cargo build --release produces executable in target/release/hayabusa. Execute: ./hayabusa -e <evtx_file> -r <rules_dir> -o <output_file> (typical pattern; see -h for full CLI). Development rebuild…

…shortened for this brief.

Key cautions & unknowns

• Small team — 4 contributors active in recent commits
• Concentrated ownership — top contributor handles 67% of recent commits
• AGPL-3.0 is copyleft — check downstream compatibility
• Rust version pinning: Cargo.toml specifies rust-version = "1.97.1" as minimum; older toolchains will fail with cryptic edition errors. Custom evtx fork: dependency points to…
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.