Can't get hayabusa to use JSON as input

[mischw]

Can't get hayabusa to use JSON as input

[mischw]

I re-ran the scan with the JSON output because I wanted to make use of the --remove-duplicate-detections, which the logon-summary command does not support. So I used the flag with the json-timeline command and got confused when hayabusa did not accept its own generated JSON output. So yeah, sorry. I think I misunderstood what this is used for.
Maybe the help output for the json-timeline command and the --JSON-input flag would profit from a more detailed description of their intended use?
Is there documentation on how the JSON has to look like for making it work with haybusa?
Besides that I think this issue is not really an issue.

[YamatoSecurity]

You are using it wrong. Why are you trying to output results to JSON from EVTX and then re-run scans against the outputted JSON? Typically, if you have the original .evtx files, you will never use the JSON input. JSON input is only for when you have event log information in JSON format. For example, you exported data from Splunk or another SIEM. The only time you use Hayabusa JSON as input is for when using Takajo.

[YamatoSecurity]

@mischw Thanks, I will try to update the documentation to make it clearer.