Run Hayabusa against collected Windows EVTX files to apply Sigma detection rules and produce a prioritized, chronological CSV/JSON timeline with severity levels, MITRE ATT&CK mappings, and per-host/per-Event-ID metrics. Use during DFIR triage to turn raw event logs into a fast, SIEM-free incident timeline, or to export results into Timesketch or Timeline Explorer for collaborative analysis.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill generating-forensic-timelines-with-hayabusanpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill generating-forensic-timelines-with-hayabusa -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill generating-forensic-timelines-with-hayabusa -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/generating-forensic-timelines-with-hayabusagh skill install mukul975/Anthropic-Cybersecurity-Skills generating-forensic-timelines-with-hayabusagit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/generating-forensic-timelines-with-hayabusa ~/.claude/skills/generating-forensic-timelines-with-hayabusa # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/generating-forensic-timelines-with-hayabusa ~/.agents/skills/generating-forensic-timelines-with-hayabusa # Codex, Cursor, Gemini CLI, Copilot, OpenCode