Hayabusa
6.1#15 in digital forensics softwareFree planFree planLinuxmacOSWindows
VisitHayabusa vs Plaso
What both publish
| Fact | Hayabusa | Plaso |
|---|---|---|
| Integrations | The project documents importing results into Elastic Stack, Timesketch, and Timeline Explorer, and analyzing JSON with jq. | The documented analysis plug-ins include VirusTotal, NSRL server, and hash tagging. |
| Platforms | The project lists Windows, Linux, and macOS support, with binaries for those operating systems. | The user guide lists Docker for Linux, Mac OS, and Windows, with Fedora, macOS, and Ubuntu as alternatives. |
| Purpose | Hayabusa is a Windows event log forensics timeline generator and threat hunting tool. | Plaso is a Python-based engine used by tools to create super timelines or more targeted timelines for digital forensic analysis. |
| Support | The maintainers invite bug reports through GitHub and say the project is actively maintained and they are happy to fix reported bugs. | The project directs users to its discussion mailing list, Open Source DFIR Slack community, troubleshooting guide, and GitHub issue tracker; contributions are best effort. |
Hayabusa plans
- HayabusaFree
Plaso plans
- Open-source Plaso packageFree
- PlasoFree
Pick Hayabusa if…
Hayabusa suits people investigating Windows event logs or hunting for threats across collected logs and endpoints. It also fits workflows that use Sigma rules or the listed timeline analysis integrations.
Pick Plaso if…
Plaso suits digital forensic practitioners who need to collect and analyze timelines from files, devices, logs, or storage images. Its parser and plug-in framework may also suit users extending forensic workflows.