KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#developer-tools #typescript #claude-code #codex #dsh #dsh-plugin #ai-agent #ai-agents #deepseek-harness #agent-skills #macos #cli

rustinel

★ 452 Open GitHub ↗

Open-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<h1 align="center">Rustinel</h1>

Open-source endpoint detection for Windows, Linux, and macOS. 
 Native telemetry to Sigma, YARA, IOC detection, and SIEM-ready alerts. Written in Rust.

<a href="https://rustinel.io/">Website</a> |
 <a href="https://docs.rustinel.io/">Docs</a> |
 <a href="https://github.com/Karib0u/rustinel/releases/latest">Download</a> |
 <a href="docs/siem-demos.md">SIEM demos</a>

---

## Quick Start

Rustinel ships release archives with a binary, default config, demo rules, and a
`logs/` directory.

**Windows** - test from PowerShell:

```powershell
irm https://rustinel.io/install.ps1 | iex
```

Then deploy from an elevated PowerShell and diagnose the managed installation:

```powershell
rustinel setup --yes
rustinel doctor
```

The Windows release binary requires the x64 Microsoft Visual C++ Redistributable.
See [Getting Started](https://docs.rustinel.io/getting-started/#windows) if the
process exits before printing output.

**Linux** - test, deploy, and diagnose:

```bash
curl -fsSL https://rustinel.io/install.sh | sh -s -- --run
sudo rustinel setup --yes
rustinel doctor
```

**macOS** (experimental)

```bash
curl -fsSL https://rustinel.io/install.sh | sh
cd rustinel
```

macOS requires a one-time Full Disk Access approval before Endpoint Security can
start. Follow the [Getting Started](https://docs.rustinel.io/getting-started/)
macOS notes before using it beyond a first test.

```bash
sudo ./rustinel run
```

After Full Disk Access is granted, deploy and diagnose the managed installation:

```bash
sudo ./rustinel setup --yes
./rustinel doctor
```

With the agent running, trigger the bundled demo rule:

```bash
whoami
```

Alerts are written to `logs/alerts.json.<date>` as ECS NDJSON.

Prefer to inspect first? Download the [install script](scripts/install/install.sh)
or a package from the [latest release](https://github.com/Karib0u/rustinel/releases/latest).
Installers only download published release binaries.

---

## Why Rustinel

A transparent endpoint detection engine you can read, run, test, and extend.

- **Native telemetry:** ETW on Windows, eBPF on Linux, Endpoint Security and `/dev/bpf` on macOS.
- **Detection formats:** Sigma for behavior, YARA for files and memory, IOC matching for hashes, IPs, domains, and path regexes.
- **Rule reuse:** bring existing Sigma and YARA rules instead of rewriting them into a proprietary format.
- **SIEM output:** ECS 9.4.0 NDJSON alerts for Elastic, Splunk, and other log pipelines.
- **Operations:** hot reload for rules and IOCs, optional active response on Windows and Linux only; macOS is detection-only today. Includes Windows service support and launchd packaging notes.

---

## Platform support

| Platform | Sensor | Telemetry | Status |
| --- | --- | --- | --- |
| Windows 10/11, Server 2016+ | ETW | Process, image load, network, file, registry, DNS, PowerShell, WMI, service, task | Stable |
| Linux 5.8+ (BTF) | eBPF | Process, network, file, DNS | Stable |
| macOS 11+ | Endpoint Security + `/dev/bpf` | Process, file, network, DNS | Experimental |

Windows coverage is the broadest today. Linux and macOS focus on process,
network, file, and DNS telemetry. macOS remains experimental. Current gaps are
listed in [Limitations](https://docs.rustinel.io/limitations/).

---

## How detection works

```text
  ETW (Windows) | eBPF (Linux) | ESF + /dev/bpf (macOS)
                        │
              Normalized event model
                        │
        ┌───────────────┼───────────────┐
      Sigma            YARA             IOC
    behavior        files +         hashes, IPs,
      rules          memory         domains, paths
        └───────────────┼───────────────┘
                        │
                ECS NDJSON alerts
                        │
              Optional active response
```

See the [detection docs](https://docs.rustinel.io/detection/) for rule authoring, YARA memory scanning, and IOC formats.

---

## Detection packs

The bundled rules only prove that the pipeline works. For real coverage, load
curated content from **[rustinel-rules](https://github.com/Karib0u/rustinel-rules)**,
the official versioned detection repository.

```text
rustinel        ->  the engine that collects telemetry and evaluates rules
rustinel-rules  ->  the Sigma, YARA, and IOC packs it loads
```

Each pack materializes into folders you point `config.toml` straight at. Browse the [pack catalog](https://github.com/Karib0u/rustinel-rules) to get started.

---

## Good for / not for

**Use it for** detection engineering, rule development and testing, blue-team labs, cross-platform detection research, and SIEM pipeline validation.

**It is not** a drop-in replacement for a mature commercial EDR. Rustinel does
not provide kernel-level self-protection, pre-execution blocking, anti-tamper
guarantees, or managed response. A sufficiently privileged attacker may interfere
with user-mode telemetry.

---

## Build from source

```bash
cargo build --release
sudo ./target/release/rustinel run
```

macOS requires the app-like signed bundle described in [Getting Started](https://docs.rustinel.io/getting-started/).

---

## Documentation

[Website](https://rustinel.io/) |
[Docs home](https://docs.rustinel.io/) |
[Getting Started](https://docs.rustinel.io/getting-started/) |
[Configuration](https://docs.rustinel.io/configuration/) |
[Detection](https://docs.rustinel.io/detection/) |
[Architecture](https://docs.rustinel.io/architecture/) |
[Operations](https://docs.rustinel.io/operations/) |
[Troubleshooting](https://docs.rustinel.io/troubleshooting/) |
[FAQ](https://docs.rustinel.io/faq/) |
[Detection rules](https://github.com/Karib0u/rustinel-rules) |
[Roadmap](docs/roadmap.md)

---

## Contributing

Testing, feedback, and detection ideas are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md).

## License

[Apache 2.0](LICENSE).

rustinel

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README