Hayabusa

Download the appropriate release package, including rules and configuration. For an offline collection:

hayabusa csv-timeline -d logs/ -m medium --no-wizard -o alerts.csv
hayabusa json-timeline -d logs/ --no-wizard -o timeline.json

For local Windows logs, use csv-timeline -l; it analyzes the local event log directory. Run hayabusa csv-timeline --help for the installed version's rule and output options. Record the rule version and selection with results, and inspect event context before treating a rule hit as an incident. A medium threshold omits lower-level detections; expand it when needed.