investigate_jp

Analyze Hayabusa CSV logs to generate Japanese intrusion timelines and incident reports.

26|1|Updated Mar 13, 2026

Search Tags:#report generation #log analysis #incident response #forensics #dfir #timeline generation #hayabusa

Ready to run

npx skills add https://github.com/Yamato-Security/mecha-hayabusa --skill investigate-jp

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: investigate_jp
Source: https://github.com/Yamato-Security/mecha-hayabusa/tree/main/skill/investigate_jp
Command: npx skills add https://github.com/Yamato-Security/mecha-hayabusa --skill investigate-jp

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires echarts.min.js, report.html, report.py, timeline_chart.html, timeline_chart.py, mitre_flow.html, mitre_flow.py, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the complex and time-consuming process of digital forensics and incident response (DFIR) by analyzing Hayabusa logs, generating detailed timelines, and producing comprehensive incident reports.

Core Features & Use Cases

Automated Log Analysis: Processes Hayabusa CSV logs to identify critical events, IOCs, and attack patterns.
Timeline Generation: Creates a chronological sequence of events, grouped by attack phases.
Report Generation: Produces detailed incident reports in Japanese, including executive summaries, IOC lists, and host/account impact analysis.
Use Case: When a security incident occurs, feed the Hayabusa analysis results into this Skill to quickly generate a professional incident report, enabling faster decision-making and remediation.

Quick Start

Use the investigate_jp skill to read hayabusa-results.csv and build an intrusion timeline and report.

Frequently Asked Questions about investigate_jp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate an incident response report from Hayabusa CSV logs?▼

To generate an incident response report from Hayabusa CSV logs, you can use an automated DFIR skill to process the logs, extract IOCs, identify attack phases, and output a comprehensive Japanese incident report.

Can I build an intrusion timeline from Hayabusa logs automatically?▼

Yes, you can build an intrusion timeline from Hayabusa logs automatically by processing the CSV results to group chronological events by attack phase, creating a structured host-centric timeline for investigation.

What is the best way to analyze lateral movement during a digital forensics investigation?▼

The best way to analyze lateral movement during digital forensics is to process Hayabusa CSV logs using DuckDB, correlating host and account activities to map lateral movement across the network and generate a detailed incident report.

Do I need DuckDB to extract IOCs from Hayabusa analysis results?▼

Yes, DuckDB is required as the data processing engine to extract IOCs, perform dataset profiling, and correlate attack patterns from Hayabusa CSV logs during the digital forensics and incident response workflow.

How does automated DFIR report generation handle attack phase analysis?▼

Automated DFIR report generation handles attack phase analysis by systematically processing Hayabusa CSV logs to categorize chronological events into distinct attack phases, extracting IOCs and lateral movement correlations.

Can I produce a Japanese incident report for executive summaries and host impact analysis?▼

Yes, this DFIR skill produces detailed Japanese incident reports that include executive summaries, IOC lists, and host and account impact analysis, enabling faster decision-making and remediation during security incidents.