AWatch-rus/docs/hayabusa-server-runner-2026-05-14.md

Hayabusa Server-Side Runner 2026-05-14

This document records the production runner model for Hayabusa on <AW_SERVER_HOST>.

Install layout

• root: /opt/hayabusa
• pinned release: /opt/hayabusa/releases/v3.9.0
• active symlink: /opt/hayabusa/current
• operator entrypoint: /usr/local/bin/aw-hayabusa

Runtime directories

• inbox: /opt/hayabusa/inbox
• archive: /opt/hayabusa/archive
• reports: /opt/hayabusa/reports
• state: /opt/hayabusa/state

Operator entrypoint

Supported helper subcommands:

• aw-hayabusa doctor
• aw-hayabusa inventory
• aw-hayabusa accept --package <zip> [--host HOST]
• aw-hayabusa process-inbox [--mode incident] [--limit N]
• aw-hayabusa profiles
• aw-hayabusa version

Supported analysis modes:

• aw-hayabusa quick --input <file-or-dir> [--host HOST]
• aw-hayabusa incident --input <file-or-dir> [--host HOST]
• aw-hayabusa full --input <file-or-dir> [--host HOST]

Mode intent

• quick

  • fast CSV timeline
  • HTML summary
  • logon summary
  • intended for first-pass triage

• incident

  • JSONL timeline
  • HTML summary
  • logon summary
  • intended for normal incident review

• full

  • JSONL timeline
  • deprecated/noisy/unsupported rules enabled
  • HTML summary
  • logon summary
  • intended for deeper DFIR review

Output naming

Reports are stored under:

• /opt/hayabusa/reports/<HOST>/<UTC_TIMESTAMP>_<MODE>[_LABEL]/

Typical contents:

• timeline.csv or timeline.jsonl
• summary.html
• logon-summary-*.csv
• run.log
• manifest.json

Latest-run symlinks:

• /opt/hayabusa/state/latest-run
• /opt/hayabusa/state/latest-<HOST>

Intake and archive workflow

Incoming packages:

• /opt/hayabusa/inbox/incoming/*.zip

Transient staging:

• /opt/hayabusa/inbox/staging/<INTAKE_ID>/

Archived raw packages:

• /opt/hayabusa/archive/packages/<HOST>/<INTAKE_ID>.zip

Archived extracted payloads:

• /opt/hayabusa/archive/extracted/<HOST>/<INTAKE_ID>/payload/
• intake metadata:
  • /opt/hayabusa/archive/extracted/<HOST>/<INTAKE_ID>/intake.json

State/log helpers:

• /opt/hayabusa/state/latest-intake.json
• /opt/hayabusa/state/logs/

Minimal operator flow

1. Drop or copy an export package:
   • aw-hayabusa accept --package /path/to/HOST-YYYYMMDD-HHMMSS.zip
2. Check queue:
   • aw-hayabusa inventory
3. Process packages:
   • aw-hayabusa process-inbox --mode incident

Validation baseline

Minimum server-side validation:

aw-hayabusa doctor
aw-hayabusa profiles
aw-hayabusa inventory

Boundaries

• Hayabusa is not deployed as a daemon.
• No AW bucket ingestion happens in this phase.
• EVTX intake orchestration remains a later phase.