Yamato-Security

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

WELA (Windows Event Log Analyzer): The Swiss Army knife for Windows Event Logs! ゑ羅（ウェラ）

Documentation and scripts to properly enable Windows event logs.

Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.

Curated Windows event log Sigma rules used in Hayabusa and Velociraptor.

Takajō (鷹匠) is a Hayabusa results analyzer.

WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing and configuring Windows event log settings. Windows event logs are a vital source of information for Digital Forensics and Incident...

RustyBlue is a rust implementation of DeepblueCLI, a forensics log analyzer for finding evidence of compromise from windows event logs.

Sample evtx files to use for testing hayabusa detection rules

DFIR analyzer for Windows forensic artifacts