Rustinel is an open-source endpoint detection agent for Windows, Linux, and macOS that runs Sigma, YARA, and IOC rules against native telemetry locally, with no cloud account required.

What it is

Rustinel is a cross-platform endpoint detection agent written in Rust, licensed under Apache-2.0, and operated entirely on the endpoint it monitors. It evaluates three kinds of detection content: Sigma rules for behaviour, YARA rules for executables and process memory, and IOC lists covering hashes, IPs, domains, and paths. Alerts are written locally as ECS NDJSON files that Elastic, Splunk, or any log pipeline can ingest, and the agent sends nothing home. It lives in the endpoint security and detection engineering ecosystem, where it replaces a cloud-managed EDR agent for teams that want detection rules running against native telemetry without registering an account or shipping data to a vendor.

The concrete problem it addresses is testing and running detections against real endpoint behaviour without surrendering data to a hosted service. On Windows it reads ETW and Windows Event Log telemetry; on Linux 5.8+ it uses eBPF; on macOS 11+ it uses Endpoint Security and /dev/bpf. A single engine, one config format, and Sysmon-style field names apply across all three, although coverage varies by platform.

Key capabilities

• Runs Sigma rules for behaviour, YARA rules for executables and process memory, and IOC lists for hashes, IPs, domains, and paths against local telemetry.
• Captures activity once with rustinel capture --output ~/captures/session.ndjson and replays it later with rustinel replay against improving rules, needing no privileges and working across platforms — a Windows recording replays on Linux.
• Reports on rule coverage and runtime health through rustinel sigma doctor, which explains which rules can fire, and rustinel doctor, which reports runtime health and events dropped under load.
• Emits alerts as local ECS NDJSON files in rustinel/logs/alerts.json for ingestion by Elastic, Splunk, or any log pipeline.
• Provides telemetry across platforms: Windows 10/11 and Server 2016+ (process, image load, network, file, registry, DNS, PowerShell, WMI, service, task, Security audit events), Linux 5.8+ (process, network, file, DNS), and macOS 11+ (process, file, network, DNS).
• Installs and runs as an endpoint service via rustinel setup --yes from the rustinel folder, in addition to foreground operation with rustinel run.
• Ships detection packs and documentation at docs.rustinel.io for rule sets and operations guidance.

Who uses it and how

• Detection engineers test Sigma and YARA rules by capturing a session once and replaying it on any machine as rules change, including re-running a recording under a candidate.toml configuration.
• Blue teams and incident responders monitor endpoints where they want alerts kept locally as ECS NDJSON rather than sent to a vendor cloud.
• Analysts feeding Elastic, Splunk, or another log pipeline ingest Rustinel's alert files alongside existing telemetry.
• Teams running SIEM pipeline testing exercise recorded endpoint behaviour without provisioning an EDR management console.
• Lab and Linux security practitioners deploy on Linux 5.8+ hosts, with macOS treated as experimental and requiring Full Disk Access first.

Getting started

Install into a local rustinel folder with curl -fsSL https://rustinel.io/install.sh | sh, then start it with cd rustinel && sudo ./rustinel run; on Windows, run irm https://rustinel.io/install.ps1 | iex in an elevated PowerShell and start .\rustinel.exe run.

How it compares

Among similar tools named in these facts, Rustinel is positioned explicitly against commercial EDR, which it states it is not a replacement for: it has no anti-tamper, no pre-execution blocking, and no management console. It fits instead as an endpoint monitoring, detection engineering, lab, and SIEM pipeline testing tool that keeps data on the endpoint under an Apache-2.0 licence.

When to use it — and when not

A self-hoster runs the agent itself and operates the downstream log pipeline, since alerts are local ECS NDJSON files that need Elastic, Splunk, or another ingester; Linux requires kernel 5.8+, macOS needs Full Disk Access, and macOS support is experimental with coverage varying by platform. Do not pick it if you need anti-tamper, pre-execution blocking, or a management console — Rustinel states plainly it is not a replacement for a commercial EDR — and note that the project carries 60 open issues alongside its 501 stars.

curl -fsSL https://rustinel.io/install.sh | sh
cd rustinel && sudo ./rustinel run

irm https://rustinel.io/install.ps1 | iex
Set-Location rustinel; .\rustinel.exe run

curl -fsSL https://rustinel.io/install.sh | sh
cd rustinel && sudo ./rustinel run

sudo ./rustinel capture --output ~/captures/session.ndjson   # Ctrl-C when done
sudo chown -R "$USER" ~/captures
./rustinel replay ~/captures/session.ndjson
./rustinel replay ~/captures/session.ndjson --config candidate.toml