query

Query — EVTX investigation from saved parameters

This command runs against real Hayabusa scan data via the scan_evtx MCP tool. It does not use Splunk or any SIEM. This project has no SIEM access — this command adapts the familiar "read a saved query from a file, run it, write up findings" workflow to the data we actually have: local .evtx files scanned with Hayabusa. Do not suggest or fall back to Splunk syntax (index=, SPL, etc.) anywhere in this command.

Arguments

$1 — required. Path to a plain-text parameters file (see format below). $2 — optional. A time range to scope the analysis to, e.g. 2026-07-10..2026-07-15 or last 24h. scan_evtx has no native time-range flag — Hayabusa itself supports -s/-e timeline bounds, but this project's wrapper doesn't expose them (see src/mcp_hayabusa/hayabusa.py). So: if $2 is given, run the scan unbounded as usual, then filter/annotate the analysis step by each record's Timestamp field to stay inside that range — don't try to pass a time flag to the tool. If $2 is omitted, skip time-scoping entirely; don't invent a default window.

Steps

1. Read the parameters file at $1 with the Read tool. Expect simple key: value lines, e.g.:

   target: sample_evtx/Discovery/T1082_uname/uname.evtx
   rule_filter: discovery
   min_level: medium
   rules_dir: hayabusa/rules
   

   Required: target (path to a .evtx file or a directory of them — set is_file: true when calling the tool if target is a single file). Optional: rule_filter, min_level (informational/low/medium/high/critical), rules_dir (which rule set to scan/filter from — use hayabusa/rules for the full bundled Hayabusa Sigma ruleset, fetched via scripts/download_hayabusa.py and gitignored; omit it, or use rules/custom, to scan only this repo's own authored rules tracked in git). Ignore any other keys but don't error on them. If target is missing or doesn't resolve to an existing path, stop and report that — don't guess a path.