New DFIR Tool Automates Hayabusa Triage Across Multiple Hosts

A new digital forensics and incident response (DFIR) utility aims to simplify Windows event-log analysis across multiple systems by automating the processing of KAPE collections with Hayabusa.

Hayabusa is an open-source tool that analyses Windows Event Logs to identify potentially suspicious activity using detection rules. Reviewing results from multiple computers, however, can require investigators to consolidate separate outputs and correlate findings across hosts.

According to Forensic Focus’s October 14, 2026, DFIR roundup, Hayabusa-Bulk-Runner automates this workflow. The tool reportedly processes multiple KAPE collections, supports read-only mounting of disk images and consolidates host-level reports into a central triage view.

The reported workflow also includes hashing images before and after processing to help identify unexpected changes during analysis. This can support evidence-integrity checks, although hashing alone does not establish that an acquisition was complete or that every analytical result is accurate.

For incident responders, bulk analysis can reduce repetitive work when investigating compromised environments containing many Windows systems. It can also help analysts compare suspicious events across machines and prioritise systems for deeper examination.

As with any automated forensic workflow, investigators should validate significant findings against the underlying event logs, confirm the tool’s configuration and retain the original evidence.