Wrangling Windows Event Logs with Hayabusa & SOF-ELK (Part 1)

This blog post provides a step-by-step tutorial for processing Windows Event Log (EVTX) files using Hayabusa to produce JSONL timeline output and ingesting that output into SOF-ELK for analysis. It walks through downloading and updating Hayabusa, running the json-timeline command, copying results to a SOF-ELK VM, verifying index ingestion, and using the Kibana web UI to filter and prioritize high-severity detections for efficient endpoint investigations.