Chainsaw, Hayabusa and Dissect: DFIR Triage for AI Agents

During DFIR preparation, artefact parsing is essential, and it is increasingly important for AI agent triage and investigation. There are several tools available, but the following are a useful start to your investigations. Chainsaw and Hayabusa provide strong starting points for investigating Windows event logs, and Dissect can help you triage the majority of your artefacts.

Chainsaw: fast Sigma hunting over event logs

Developer: WithSecure Labs · Link: github.com/WithSecureLabs/chainsaw

Chainsaw searches and hunts through Windows event logs at speed, using Sigma rules plus its own built-in rules.

Install

Download the release for your platform from the releases page. The chainsaw_all_platforms+rules.zip package includes Chainsaw’s own rules/ and mappings/ folders. Sigma rules are no longer bundled, so clone them separately to get the latest:

unzip chainsaw_all_platforms+rules.zip
cd chainsaw
git clone https://github.com/SigmaHQ/sigma

Core commands

# 1. Hunt with Sigma and Chainsaw rules, high and critical only, as JSONL
./chainsaw hunt ./evtx/ -s sigma/rules/ --mapping mappings/sigma-event-logs-all.yml \
  -r rules/ --level high --level critical --jsonl -o chainsaw-high.jsonl --skip-errors

# 2. Full hunt to CSV (--csv writes one file per detection group into a directory)
./chainsaw hunt ./evtx/ -s sigma/rules/ --mapping mappings/sigma-event-logs-all.yml \
  -r rules/ --csv --output chainsaw-csv/

# 3. Case-insensitive keyword search across every log
./chainsaw search mimikatz -i ./evtx/

# 4. Search on a field with a Tau expression, as JSON
./chainsaw search -t 'Event.System.EventID: =4104' ./evtx/ --json -o ps-scriptblocks.json

1. hunt runs every Sigma rule through the mapping file, which tells Chainsaw how Sigma field names line up with event log fields. --level can be repeated, and JSONL gives you one detection per line.
2. The same hunt as CSV is handy for a spreadsheet or Timeline Explorer. CSV output needs --output and writes a directory, not a single file.
3. search is a plain string or regex search, useful for pivoting on a hostname, username or tool name you’ve already found.
4. A Tau expression targets a specific field, here PowerShell script block logging (Event ID 4104).

Hayabusa: timelines with severity built in

Developer: Yamato Security · Link: github.com/Yamato-Security/hayabusa

Hayabusa also uses Sigma, plus its own large rule set, and is built around producing a sorted forensic timeline with a severity level on every line.

Install

Download the zip for your platform from the releases page. The binary is named with the version and platform (for example hayabusa-4.3.0-lin-x64-gnu), so rename it or adjust the commands below. Then pull the latest rules:

./hayabusa update-rules

Note for existing users: Hayabusa 4.0 merged csv-timeline and json-timeline into a single dfir-timeline command, with the format chosen by -t. Older blog posts and scripts using the old names will fail on current versions.

Core commands

# 1. High and critical detections as JSONL, timestamps in UTC, no interactive wizard
./hayabusa dfir-timeline -d ./evtx/ -t jsonl -p verbose -m high -U -w -o hayabusa-high.jsonl

# 2. Full timeline as CSV (all levels), for a spreadsheet or Timeline Explorer
./hayabusa dfir-timeline -d ./evtx/ -p standard -U -w -o hayabusa-timeline.csv

# 3. Summary of successful and failed logons
./hayabusa logon-summary -d ./evtx/ -U -o logons

# 4. Event ID counts, to see what logging you actually have
./hayabusa eid-metrics -d ./evtx/ -o eid-metrics.csv

1. dfir-timeline with -t jsonl and -m high gives you only high and critical detections, one per line. -p picks an output profile (minimal, standard, verbose, all-field-info, super-verbose and others; run list-profiles to see them all). -w skips the interactive rule-selection wizard, which you’ll want in any script.
2. Without -t the output defaults to CSV, and without -m every level down to informational is included. Use the verbose profile when you need provenance: unlike standard, it includes the source EvtxFile alongside the RecordID, plus MITRE ATT&CK tags.
3. logon-summary tabulates successful and failed logons by account and source, including RDP session events. -o is a filename prefix, so you get separate files for successes and failures.
4. eid-metrics counts events by Event ID. It quickly shows whether Sysmon, PowerShell or process-creation logging was even turned on, which tells you how much to trust an absence of detections.

Dissect: structured records from whole disk images

Developer: Fox-IT (part of NCC Group) · Link: github.com/fox-it/dissect · Docs: docs.dissect.tools

Chainsaw and Hayabusa only see event logs. Dissect works on the whole system. It opens E01, VMDK, VHDX, raw dd images, KAPE collections and Acquire collections directly, without mounting, and parses hundreds of artefacts (prefetch, Amcache, registry run keys, event logs, browser history, scheduled tasks and more) into typed records.

Install

Dissect is a Python package. Install it into a virtual environment:

python3 -m venv ~/venvs/dissect
source ~/venvs/dissect/bin/activate
pip install dissect

Core commands

# 1. Basic system info (hostname, OS, time zone, install date) as JSON
target-info -j evidence/host01.E01

# 2. List the plugins (functions) available for this target
target-query -l evidence/host01.E01

# 3. Run several plugins and write JSON lines with rdump
target-query -q -f prefetch,runkeys,evtx evidence/host01.E01 | rdump -J > host01-triage.jsonl

# 4. One record type to CSV
target-query -q -f amcache.applications evidence/host01.E01 | rdump -C > host01-amcache.csv

1. target-info is your first sanity check. Confirm the hostname and, importantly, the system’s configured time zone before you interpret anything.
2. target-query -l lists every function Dissect can run against that image.
3. target-query outputs binary records, and rdump converts them. -J writes JSON lines, which copes well with several record types in one stream. Each record carries its own timestamp fields and source path.
4. CSV (-C) works best with one record type per file, since different plugins produce different columns.

The same commands work on an Acquire collection (target-query -f prefetch host01.tar) or a KAPE output folder. For interactive browsing, target-shell evidence/host01.E01 drops you into a shell over the image’s file system.

Feeding this to an AI agent

The tools above do the heavy lifting. How you hand their output to an agent decides whether you get useful triage or confident nonsense. General lessons:

• Prefer JSONL or CSV over raw dumps. Never give an agent raw .evtx, registry hives or disk images. Give it the parsed records.
• Keep provenance on every record. The source file, event record ID (or artefact path) and timestamp should travel with each line, so every claim the agent makes can be cited back to a specific record and checked.
• Normalise timestamps to UTC. Chainsaw outputs UTC by default; use -U with Hayabusa; Dissect record timestamps are UTC. Mixing local and UTC times will produce a wrong timeline that looks right.
• Treat rule hits as leads, not conclusions. A Sigma detection means “look here”. Plenty of high-severity hits are admin activity, backup software or the security tools themselves.
• Corroborate across independent artefact families. A suspicious process in an event log hit is much stronger when a prefetch or Amcache entry shows the same binary ran. Ask the agent to say which artefact families support each finding, and which don’t.
• Filter before you feed. Don’t hand an agent gigabytes. Start with critical and high Sigma hits, let the agent propose pivots (a user, host, file name or time window), then pull just those records with chainsaw search or an rdump -s selector.
• Watch for prompt injection in log fields. Command lines, file names, user agents and script blocks are attacker-controlled strings. An attacker can write “ignore previous instructions” into a scheduled task description. Make it explicit to the agent that log content is data, not instructions.
• A human analyst confirms findings. The agent speeds up the reading. A person still verifies the key records and owns the conclusions, especially anything that goes into a report, insurance claim or notification decision.

Tips and gotchas

• Update rules before every case. Run hayabusa update-rules and git pull in your Sigma clone. New detections land weekly, and a stale rule set quietly misses recent techniques.
• Work on a copy of the evidence. Run against copied log folders or images, never the original, and record hashes before you start.
• Get the Chainsaw mapping path right. --mapping must point at mappings/sigma-event-logs-all.yml relative to where you run Chainsaw. A wrong path or a missing mapping means Sigma rules don’t load, and an empty result looks like a clean system.
• Use --skip-errors on real-world collections. Corrupt or partially copied .evtx files are common, and without it Chainsaw can stop at the first bad file.
• Know your time zones. Hayabusa shows local time unless you pass -U, and the host’s configured time zone (from target-info) may differ from both yours and the client’s. Agree on UTC for the whole case.
• Check what logging existed. No detections from a host with no Sysmon and default audit policy is not the same as no attacker. eid-metrics makes the gap obvious.
• Run both Chainsaw and Hayabusa. Their rule sets and field handling differ, and an event caught by one and not the other is worth a closer look.

Bringing it together

A practical flow: collect logs and images, run target-info to confirm host and time zone, run Chainsaw and Hayabusa over the event logs for high and critical hits, pull execution and persistence artefacts with Dissect, then give an agent the filtered, UTC-normalised JSONL with provenance intact. Let it summarise, cluster and suggest pivots, and have an analyst verify every finding before it goes anywhere.

Structured output is what makes AI agents useful in incident response. These three tools are the quickest way to get it, and they are free.

If you’re dealing with a suspected compromise and want experienced hands on the evidence, see our Incident Response & Forensics service or get in touch.