investigate

Analyze Hayabusa CSV logs to generate DFIR timelines and HTML reports.

26|1|Updated Mar 13, 2026

Search Tags:#log analysis #incident response #forensics #dfir #ioc #timeline generation #hayabusa

Ready to run

npx skills add https://github.com/Yamato-Security/mecha-hayabusa --skill investigate-yamato-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: investigate
Source: https://github.com/Yamato-Security/mecha-hayabusa/tree/main/skill/investigate
Command: npx skills add https://github.com/Yamato-Security/mecha-hayabusa --skill investigate-yamato-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires echarts.min.js, mitre_flow.py, report.py, timeline_chart.py, report.html, mitre_flow.html, timeline_chart.html, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the complex and time-consuming process of digital forensic investigations, enabling rapid analysis of security logs to build incident timelines and generate comprehensive reports.

Core Features & Use Cases

Automated Log Analysis: Ingests Hayabusa CSV logs and automatically processes them using LLM-driven tools.
Timeline & Report Generation: Creates detailed incident timelines, MITRE ATT&CK flow diagrams, and forensic reports in HTML format.
IOC Extraction & Correlation: Identifies Indicators of Compromise (IOCs) and correlates lateral movement patterns.
Use Case: When a security alert fires, use this Skill to immediately analyze the relevant Hayabusa logs, identify the attack path, understand attacker techniques, and generate a preliminary incident report for stakeholders.

Quick Start

Use the investigate skill to analyze the provided hayabusa-results.csv file and generate an intrusion timeline and report.

Frequently Asked Questions about investigate

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate incident timeline generation from Hayabusa CSV logs?▼

To automate incident timeline generation from Hayabusa CSV logs, you can use this Skill to ingest the logs, analyze security events, and output interactive HTML reports with detailed forensic timelines.

Can I generate MITRE ATT&CK flow diagrams from Windows security event logs?▼

Yes, you can generate MITRE ATT&CK flow diagrams from Windows security event logs by processing Hayabusa CSV outputs through this Skill, which maps attacker techniques and visualizes the attack flow in HTML format.

Does this DFIR tool require Hayabusa MCP tools for structured LLM-driven analysis?▼

Yes, this DFIR tool requires Hayabusa MCP tools to perform structured LLM-driven analysis, extracting IOCs, decoding payloads, and correlating lateral movement patterns directly from CSV security logs.

What is the best way to extract Indicators of Compromise and correlate lateral movement from forensic logs?▼

The best way to extract Indicators of Compromise and correlate lateral movement from forensic logs is using automated LLM-driven analysis on Hayabusa CSV inputs to identify attack paths and generate comprehensive incident reports.

How do I create an interactive HTML report for digital forensic investigations?▼

You can create an interactive HTML report for digital forensic investigations by running this Skill on Hayabusa CSV logs, which produces structured outputs including MITRE ATT&CK mapping and timeline charts.

Are there limitations when analyzing large Hayabusa CSV results for intrusion timelines?▼

A key limitation when analyzing large Hayabusa CSV results for intrusion timelines is the dependency on Hayabusa MCP tools for LLM-driven processing, which may require structured input formats to accurately extract IOCs and map attack flows.