hayabusa-mcp-security-scanner: Command for Claude Code

Investigate the EVTX file at $1 and write an Obsidian-compatible investigation note under investigations/.

1. Parse arguments

• evtx_path = $1. If empty, stop immediately and report: Usage: /investigate-evtx <evtx-path> [severity]. Make no tool calls.
• severity_arg = $2 (may be absent).

2. Resolve and validate severity BEFORE scanning

• If severity_arg is present: trim whitespace and lowercase it, then check it is exactly one of informational, low, medium, high, critical.
  • No match → stop immediately, before calling any scan tool, and report: Invalid severity '<severity_arg>'. Must be exactly one of: informational, low, medium, high, critical.
  • Match → use the normalized value as min_severity.
• If severity_arg is absent → min_severity = "medium" (the default).

3. Scan

Call mcp__hayabusa-mcp__scan_evtx with evtx_path, the resolved min_severity, and output_format="full".

• If the tool raises a file-not-found or Hayabusa-binary error, surface that error message verbatim, and add a note that evtx_path is resolved by the MCP server against its own process working directory (the repo root) — relative paths should be given relative to the repo root, or as absolute paths.
• If the scan succeeds with zero findings, this is not a failure: continue to step 7 to write a minimal note recording that the scan ran and found nothing at min_severity, and suggest re-running with a lower severity value.

4. Resolve MITRE ATT&CK tags per finding

scan_evtx findings do not carry ATT&CK tags directly — only a RuleID. For each unique RuleID across the findings:

• Read the MCP resource detection://rules/{RuleID} via ReadMcpResourceTool to get that rule's full YAML text.
• Parse the YAML tags: list. Keep only entries matching ^attack\.t\d{4}(\.\d{3})?$ (case-insensitive), and normalize each to Txxxx or Txxxx.xxx form (e.g. attack.t1070.001 → T1070.001).
• If the rule has no tags matching that pattern (this is a real, expected case — do not treat it as an error), record "no ATT&CK tags for this rule" for that RuleID. Never invent or guess a technique ID.
• If the resource lookup fails for a given RuleID (e.g. unknown identifier), record "could not resolve tags for RuleID <id>" and continue with the rest.