tabledevil d5f4ba8862 Add hayabusa smoke test (fetch sample-evtx → scan → eval → cleanup) ...

Verifies image present, EVTX corpus available (clones on demand), the
container exits cleanly, all four output artefact types are produced
non-empty, then prints detection count + MITRE TTP coverage.

Default SUBSET=DeepBlueCLI (21 EVTX, ~30s). Documented alternatives:
YamatoSecurity, EVTX-ATTACK-SAMPLES, EVTX-to-MITRE-Attack, or empty for
the full 599-file bundle.

KEEP_DATA=1 keeps the cloned corpus on disk for fast reruns.

Validated end-to-end on amd64 Linux: 7/7 PASS, 8,626 detections from
DeepBlueCLI subset, 31 distinct MITRE TTPs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-07 11:45:33 +02:00

.dockerignore

Bump Hayabusa 2.17.0→3.8.1, Takajo 2.6.0→2.15.1; fix takajo CWD

2026-04-11 22:04:46 +02:00

.gitignore

Pin runtime base to ubuntu:24.04, gitignore test-data, add fetch helper

2026-05-07 11:34:12 +02:00

Dockerfile

Pin runtime base to ubuntu:24.04, gitignore test-data, add fetch helper

2026-05-07 11:34:12 +02:00

fetch-test-data.sh

Pin runtime base to ubuntu:24.04, gitignore test-data, add fetch helper

2026-05-07 11:34:12 +02:00

start.sh

Bump Hayabusa 2.17.0→3.8.1, Takajo 2.6.0→2.15.1; fix takajo CWD

2026-04-11 22:04:46 +02:00

test_smoke.sh

Add hayabusa smoke test (fetch sample-evtx → scan → eval → cleanup)

2026-05-07 11:45:33 +02:00

S

Description

An Alpine container around hayabusa (https://github.com/Yamato-Security/hayabusa)

35 KiB

Languages

Shell 67.9%

Dockerfile 32.1%