Yamato Security is a security group created by Zach Mathis (@yamatosecurity) in 2012. At first, the main purpose was to provide security training to build a local security community in Western Japan but has grown to provide training, CTF events, webinars, etc... across the country for thousands of people.

Now, with a group of volunteer members, we are providing free open source DFIR tools such as Hayabusa, WELA, Takajo, Suzaku, etc...

Please contact us if you want to help out and contribute.

• Hayabusa - (隼) A sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
• Takajo - (鷹匠) An analyzer for Hayabusa results.
• Suzaku - (朱雀) A sigma-based threat hunting and fast forensics timeline generator for cloud logs.
• WELA - ゑ羅（ウェラ）(Windows Event Log Auditor): An auditing and configuration tool for Windows event logs.
• Yamato Security's Windows Event Log Configuration Guide For DFIR And Threat Hunting - Documentation for how to configure proper Windows audit log settings and which categories and Event IDs are important to monitor.
• Presentations - Presentations in English and Japanese.