Skill UI

Hayabusa is a specialized threat-hunting and fast-forensics tool designed to analyze Windows EVTX event logs. It applies a comprehensive library of Sigma detection rules to raw log data, generating a single, prioritized, chronological timeline. The output includes severity levels, MITRE ATT&CK mappings, and detailed metrics, enabling analysts to perform rapid, SIEM-free incident triage and export results for collaborative analysis.

This guide details the process of parsing core Windows forensic artifacts, including MFT, Prefetch, Registry hives, ShellBags, and Amcache. Utilizing Eric Zimmerman's specialized EZ Tools, raw evidence is converted into standardized CSV/JSON formats. This process is crucial for Digital Forensics and Incident Response (DFIR) investigations, enabling analysts to reconstruct program execution, file access history, and persistence mechanisms, which can then be loaded into Timeline Explorer for unified analysis.

KAPE (Kroll Artifact Parser and Extractor) is a specialized, rapid triage tool for incident response. It collects specific, volatile forensic artifacts (like registry hives, event logs, and browser data) from compromised Windows systems. It is designed for remote, at-scale artifact collection when full disk imaging is impractical, enabling analysts to quickly build a defensible, parseable dataset for initial investigation and containment.

This skill analyzes local Q&A session JSONL files to produce a complete, auditable weekly report in Markdown format. It supports generating routine weekly summaries, comparing performance across consecutive time windows, and identifying key trends and risks. The output is a single, self-contained Markdown file designed to provide sufficient aggregates and structure for downstream documentation rendering (e.g., Feishu or whiteboards), without needing external data sources or APIs.