rustinel
Open-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.
File Explorer
Download Latest Version (.zip)- config.toml
- bug_report.md
- feature_request.md
- ci.yml
- docs.yml
- privileged-smoke.yml
- release.yml
- rsigma-engine.yml
- sigma-rules.yml
- zizmor.yml
- dependabot.yml
- pull_request_template.md
- release.yml
- zizmor.yml
- sigma_backend.rs
- social-card.png
- social-card.svg
- demo.gif
- logo-rustinel.png
- active-response.md
- architecture.md
- benchmarking.md
- cli.md
- configuration.md
- detection.md
- development.md
- faq.md
- getting-started.md
- index.md
- limitations.md
- operations.md
- output.md
- roadmap.md
- siem-demos.md
- troubleshooting.md
- why-rustinel.md
- config.toml
- dns.rs
- events.rs
- file.rs
- main.rs
- network.rs
- process.rs
- Cargo.lock
- Cargo.toml
- deny.toml
- .gitkeep
- docker-compose.yml
- filebeat.yml
- README.md
- docker-compose.yml
- README.md
- send-alerts.py
- memory_target.rs
- yara_demo.rs
- main.html
- com.rustinel.agent.plist
- rustinel.entitlements
- domains.txt
- hashes.txt
- ips.txt
- paths_regex.txt
- linux_whoami.yml
- macos_whoami.yml
- windows_whoami.yml
- example_test_string.yar
- linux.sh
- windows.ps1
- install.ps1
- install.sh
- package-app.sh
- fetch_corpus.py
- dedup.rs
- mod.rs
- manifest.rs
- mod.rs
- writer.rs
- mod.rs
- inspect.rs
- mod.rs
- path.rs
- prerequisites.rs
- rules.rs
- services.rs
- alert.rs
- condition.rs
- detect.rs
- handler.rs
- loader.rs
- logsource.rs
- matcher.rs
- mod.rs
- rsigma_adapter.rs
- rsigma_backend.rs
- rule.rs
- stats.rs
- alert.rs
- hash.rs
- load.rs
- matchers.rs
- mod.rs
- types.rs
- linux.rs
- macos.rs
- mod.rs
- types.rs
- unsupported.rs
- windows.rs
- alert.rs
- event.rs
- helpers.rs
- mod.rs
- network.rs
- registry.rs
- user.rs
- alert.rs
- event.rs
- fields.rs
- match_details.rs
- mod.rs
- mod.rs
- linux.rs
- macos.rs
- mod.rs
- windows.rs
- mod.rs
- mod.rs
- output.rs
- recording.rs
- mod.rs
- capture.rs
- ioc.rs
- linux.rs
- logging.rs
- macos.rs
- mod.rs
- orchestration.rs
- windows.rs
- yara.rs
- mod.rs
- ebpf.rs
- events.rs
- mod.rs
- bpf.rs
- esf.rs
- mod.rs
- packet.rs
- socket.rs
- etw.rs
- field_maps.rs
- file_paths.rs
- mapper.rs
- mod.rs
- dns.rs
- mod.rs
- network_events.rs
- connection.rs
- dns.rs
- mod.rs
- process.rs
- sid.rs
- file_identity.rs
- fs.rs
- log_rate_limiter.rs
- mod.rs
- path.rs
- pe.rs
- process.rs
- socket.rs
- time.rs
- user.rs
- config.rs
- lib.rs
- main.rs
- rules.rs
- service.rs
- setup.rs
- mod.rs
- encoded_powershell_command.yml
- powershell_temp_file_write.yml
- windows-powershell-fixture.ps1
- windows-powershell.manifest.json
- windows-powershell.ndjson
- active_response.rs
- alert_output.rs
- capture_command.rs
- capture_recording.rs
- config_integration.rs
- dedup_integration.rs
- ecs_contract.rs
- pipeline_ioc.rs
- pipeline_sigma.rs
- platform_mapping.rs
- reload.rs
- replay_command.rs
- replay_fixture.rs
- router_and_handlers.rs
- rsigma_engine_parity.rs
- rsigma_unsupported.rs
- sigma_match_selection.rs
- yara_disk.rs
- yara_memory.rs
- .gitattributes
- .gitignore
- build.rs
- Cargo.lock
- Cargo.toml
- config.toml
- CONTRIBUTING.md
- deny.toml
- LICENSE
- README.md
- rustinel.service
- SECURITY.md
- zensical.toml
# Installation Guide
1. Get the code
git clone https://github.com/Karib0u/rustinel
Downloads the entire project code from GitHub to your computer.
cd rustinel
Moves into the project folder you just downloaded.
2. Official Install Script
Easy Recommendedirm https://rustinel.io/install.ps1 | iex
Downloads and runs the official install script via PowerShell β this handles the full setup automatically.
curl -fsSL https://rustinel.io/install.sh | sh
Downloads and runs the official install script in one line β this handles the full setup automatically.
After installing, open a new terminal and run the program's version command (e.g. --version) to confirm it worked.
Pulled directly from this repo's README.
3. Rust
MediumPrerequisites
- Git Needed to download the project code from GitHub.
- Rust (rustup) Installing via rustup also installs cargo.
cargo build --release
Compiles the Rust project.
If cargo build finishes without errors, it worked. The executable is created under target/.
Pulled directly from this repo's README.
// repository documentation
Was this content helpful?
(0 ratings)