Rustinel

Open-source endpoint detection for Windows, Linux, and macOS.

Native telemetry → Sigma / YARA / IOC detection → SIEM-ready alerts. Written in Rust.

Website · Docs · Download · SIEM demos

Get your first alert in 60 seconds

Rustinel ships as a single binary with bundled demo rules. Install it, trigger a test command, and read the alert.

Linux

curl -fsSL https://raw.githubusercontent.com/Karib0u/rustinel/main/scripts/install/install.sh | sh -s -- --run

Windows — from an elevated PowerShell:

Invoke-WebRequest https://raw.githubusercontent.com/Karib0u/rustinel/main/scripts/install/install.ps1 -OutFile install-rustinel.ps1
powershell -ExecutionPolicy Bypass -File .\install-rustinel.ps1 -Run

macOS (experimental) — install the same way (drop --run), then grant Full Disk Access to your terminal app before the first start: Endpoint Security needs a one-time macOS approval, so the agent exits with NotPermitted and opens the right Settings pane until you grant it. Full walkthrough in Getting Started.

With the agent running, fire the bundled demo rule — same command on every platform:

whoami

Your alert lands in logs/alerts.json.<date> as ECS NDJSON — ready to ship straight to a SIEM.

Prefer to read before you run? Download the install script and inspect it, or grab a binary from the latest release. The installer only pulls published release binaries. macOS support is experimental and needs root plus user approval for the signed Endpoint Security client; see Getting Started.

Why Rustinel

A transparent endpoint detection engine you can read, run, test, and extend — no black box.

• Native telemetry — ETW on Windows, eBPF on Linux, Endpoint Security + /dev/bpf on macOS, normalized into one shared event model.
• Three detection layers — Sigma for behavior, YARA for files and memory, IOC matching for hashes, IPs, domains, and path regexes.
• Reuse community rules — bring existing Sigma and YARA rules instead of rewriting them into a proprietary format.
• SIEM-ready output — ECS 9.4.0 NDJSON alerts that drop into Elastic, Splunk, and friends.
• Operational basics — hot-reload for rules and IOCs, optional active response with dry-run + allowlists, Windows service and launchd support.

Platform support

Windows coverage is the broadest today; Linux and macOS focus on process, network, file, and DNS. macOS remains experimental while signed and notarized release packaging is validated across supported versions. Full notes are in the platform docs.

How detection works

  ETW (Windows) · eBPF (Linux) · ESF + /dev/bpf (macOS)
                        │
              Normalized event model
                        │
        ┌───────────────┼───────────────┐
      Sigma            YARA             IOC
    behavior        files +         hashes, IPs,
      rules          memory         domains, paths
        └───────────────┼───────────────┘
                        │
                ECS NDJSON alerts
                        │
              Optional active response

See the detection docs for rule authoring, YARA memory scanning, and IOC formats.

Detection packs

The bundled rules just prove the pipeline works. For real coverage, load curated content from rustinel-rules — the official, versioned, CI-tested detection repository.

rustinel        →  the engine that collects telemetry and evaluates rules
rustinel-rules  →  the Sigma / YARA / IOC packs it loads  (no conversion step)

Each pack materializes into folders you point config.toml straight at. Browse the pack catalog to get started.

Good for / not for

Use it for detection engineering, rule development and testing, blue-team labs, cross-platform detection research, and SIEM pipeline validation.

It is not a drop-in replacement for a mature commercial EDR. Rustinel does not provide kernel-level self-protection, pre-execution blocking, or anti-tamper guarantees, and a sufficiently privileged attacker may interfere with user-mode telemetry. It is a transparent detection engine — not a managed response platform.

Build from source

cargo build --release
sudo ./target/release/rustinel run

macOS requires the app-like signed bundle described in Getting Started.

Documentation

Website · Docs home · Getting Started · Configuration · Detection · Architecture · Operations · Troubleshooting · FAQ · Detection rules · Roadmap

Contributing

Testing, feedback, and detection ideas are all welcome — see CONTRIBUTING.md.

License

Apache 2.0.