<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Building Incident Timeline — API Reference

## Hayabusa CLI

```bash
# CSV timeline from EVTX directory
hayabusa csv-timeline -d /path/to/evtx/ -o timeline.csv

# JSON timeline
hayabusa json-timeline -d /path/to/evtx/ -o timeline.jsonl

# Filter by severity
hayabusa csv-timeline -d /evtx/ -o high.csv --min-level high

# Time window filter
hayabusa csv-timeline -d /evtx/ \
  --timeline-start "2026-03-10T00:00:00Z" \
  --timeline-end "2026-03-15T23:59:59Z" -o window.csv

# Include all fields
hayabusa csv-timeline -d /evtx/ -o full.csv --no-field-data-mapping

# Output columns: Timestamp, Computer, Channel, EventID, Level, RuleTitle, Details
```

## Plaso (log2timeline / psort)

```bash
# Create Plaso storage from disk image
log2timeline.py plaso.dump /evidence/disk.E01

# Create from log directory
log2timeline.py plaso.dump /evidence/logs/

# Export to CSV (full)
psort.py -o l2tcsv plaso.dump -w timeline.csv

# Export with time filter
psort.py -o l2tcsv plaso.dump "date > '2026-03-10' AND date < '2026-03-16'" -w filtered.csv

# Export to Elasticsearch
psort.py -o elastic plaso.dump --server 127.0.0.1 --port 9200 --index_name case001

# Plaso CSV columns: date, time,timezone,MACB,source,sourcetype,type,user,host,
#   short,desc,version,filename,inode,notes,format,extra
```

## Chainsaw

```bash
# Hunt with Sigma rules
chainsaw hunt /evtx/ --sigma rules/ --mapping mappings/sigma-event-logs-all.yml

# Search for specific patterns
chainsaw search /evtx/ -s "mimikatz"
chainsaw search /evtx/ -s "powershell" --timestamp "2026-03-10T00:00:00"

# Output as JSON
chainsaw hunt /evtx/ --sigma rules/ --json -o results.json
```

## MFTECmd (NTFS Timeline)

```bash
# Parse $MFT to CSV
MFTECmd.exe -f '$MFT' --csv /output/ --csvf mft.csv

# Parse $J (USN Journal)
MFTECmd.exe -f '$J' --csv /output/ --csvf usn.csv

# Key columns: Created0x10, LastModified0x10, LastAccess0x10, FileName, ParentPath
```

## Key Windows Event IDs for Timeline

| Event ID | Log | Significance |
|----------|-----|-------------|
| 4624 | Security | Successful logon |
| 4625 | Security | Failed logon |
| 4672 | Security | Special privileges assigned |
| 4688 | Security | Process creation |
| 4698 | Security | Scheduled task created |
| 4720 | Security | User account created |
| 7045 | System | Service installed |
| 1 | Sysmon | Process creation (with hash) |
| 3 | Sysmon | Network connection |
| 11 | Sysmon | File creation |
| 13 | Sysmon | Registry value set |

## Common Patterns

### Timeline Correlation Workflow

```
1. Generate Hayabusa timeline from EVTX
2. Generate Plaso super-timeline from disk/logs
3. Parse MFT for file system events
4. Merge all sources, normalize to UTC
5. Filter for attack window
6. Identify pivot points (initial access, persistence, lateral movement)
7. Document milestones with evidence references
```

### Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `min-level` | Minimum Hayabusa severity | `high` |
| `timeline-start` | Start of time window | `2026-03-10T00:00:00Z` |
| `timeline-end` | End of time window | `2026-03-15T23:59:59Z` |
| `output_format` | Plaso output format | `l2tcsv`, `elastic` |
