hayabusa-mcp-security-scanner: Command for Claude Code

Triage the EVTX file at $1 and write an Obsidian-compatible triage note under investigations/triage/, syncing reusable ATT&CK technique notes under techniques/.

1. Parse arguments

• evtx_path = $1. If empty, stop immediately and report: Usage: /triage <evtx-path> [severity] [case-id]. Make no tool calls.
• severity_arg = $2 (may be absent).
• case_id_arg = $3 (may be absent).

2. Resolve and validate severity BEFORE scanning

• If severity_arg is present: trim whitespace and lowercase it, then check it is exactly one of informational, low, medium, high, critical.
  • No match → stop immediately, before calling any scan tool, and report: Invalid severity '<severity_arg>'. Must be exactly one of: informational, low, medium, high, critical.
  • Match → use the normalized value as min_severity.
• If severity_arg is absent → min_severity = "medium" (the default).

3. Validate case_id BEFORE scanning

• If case_id_arg is absent, case_id = null and this step is done.
• If present: trim whitespace, then check the result matches exactly ^[A-Za-z0-9_-]{1,64}$.
  • No match (this covers path separators / \, traversal sequences .., shell metacharacters ; | & $ " ' * ? ( ) < > ~, whitespace, email addresses, or any other character outside letters/digits/hyphen/underscore) → stop immediately, before calling any scan tool, and report: Invalid case ID '<case_id_arg>'. Use only letters, numbers, hyphens, and underscores (max 64 characters).` Do not attempt to strip or sanitize the value and continue — reject and stop.
  • Match → use the trimmed value as case_id.

4. Scan

Call mcp__hayabusa-mcp__scan_evtx with evtx_path, the resolved min_severity, and output_format="full".

• If the tool raises a file-not-found or Hayabusa-binary error, surface that error message verbatim, and add a note that evtx_path is resolved by the MCP server against its own process working directory (the repo root) — relative paths should be given relative to the repo root, or as absolute paths.
• If the scan succeeds with zero findings, this is not a failure: continue through the remaining steps to write a minimal note with triage_outcome: insufficient evidence, and suggest re-running with a lower severity value.