Endpoint detection
under your control.
Self-hosted, open-source detection for Windows, Linux, and macOS. Native telemetry, local rules, open ECS alerts.
As featured in
One runtime. Three ways to use it.
The same detection engine protects a live endpoint, proves a rule works before you deploy it, and drops into another product as a sensor.
Self-hosted endpoint detection
Run Rustinel continuously as a native service. Evaluate detections locally, store alerts locally, and forward only what your environment requires.
Private servers, sovereign infrastructure, air-gapped networks, homelabs, small security teams, and organizations that already run their own SIEM.
Detection engineering
Capture real endpoint behaviour, edit a rule, then replay the same events through the same detector used in production.
rustinel capture rustinel replay recording.ndjson
Reproduce detections without rerunning malware, attack simulations, or fragile manual test steps.
Embedded detection engine
Use Rustinel as the endpoint detection component inside a sandbox, DFIR appliance, security platform, or internal defensive system.
Consume open ECS alerts instead of building another proprietary sensor and rule engine from scratch.
Used by defenders who want control of their tooling
"Exactly what I was looking for... will for sure keep my eyes on every release you make going forward. Already deployed it and testing it."
"What you built with the ETW telemetry + Sigma/YARA combo is exactly what we need right now... love seeing Rust tackle this space properly."
"Looks very cool!"
"Great work man, I've been using Rustinel the last weeks as part of my lab environment and really liking it."
Running in one command.
Installs Rustinel on your own machine and starts a portable evaluation.
The bundled demo rule fires on the first whoami you run.
curl -fsSL https://rustinel.io/install.sh | sh -s -- --run
Keep it
sudo rustinel setup --yes
Check it
rustinel doctor
Prefer release archives, a source build, or the full setup reference? Read the getting-started guide →
Endpoint detection you can actually inspect.
Every detection follows the same visible path, from the operating-system event to the alert on disk. There is no hidden scoring service in between.
Collect
Native endpoint telemetry
ETW and the Windows Event Log on Windows. eBPF on Linux. Endpoint Security and /dev/bpf on macOS. No third-party agent in between, and nothing shipped off the host to collect it.
Normalize
One shared event model
Platform-specific records become consistent Sysmon-style fields. Process context, DNS caches, SID resolution, and connection aggregation enrich events in flight, before any detector sees them.
Detect
Sigma · YARA · IOC
Behavioural rules, file and memory signatures, and indicator matching all run on the endpoint itself. Rules and indicators hot reload without restarting the detector.
Alert
Open ECS NDJSON
Detection hits are written as ECS-shaped NDJSON on local disk. Keep them there, collect them with your existing shipper, or consume them from your own application.
A real detector for servers and workstations.
Rustinel is not only a rules test tool. It runs continuously as a Windows service, systemd unit, or launchd service and watches endpoint activity as it happens.
Windows
StableETW + Event Log
The broadest coverage of the three: process, network, file, registry, image load, DNS, PowerShell script bodies, WMI, services, and scheduled tasks.
Linux
StableeBPF · kernel 5.8+
Process, network, file, and DNS telemetry for headless servers, workstations, VMs, and lab hosts. Static musl builds, no kernel module, no DKMS.
macOS
ExperimentalEndpoint Security · /dev/bpf
Process, file, network, and DNS telemetry. Signed and notarized, but still experimental, and Endpoint Security needs Full Disk Access first.
The pipeline is shared, but rule compatibility depends on the telemetry each operating system provides, so a Windows registry rule has nothing to match on Linux. See full telemetry and Sigma logsource coverage →
Open rule formats you already own.
No proprietary rule language stands between the endpoint event and the alert.
Sigma
Behavioural rules evaluated against normalized endpoint events using Sysmon-style field names, with full modifier support and hot reload.
YARA
Executable scanning on process start, with optional memory scanning for packed payloads. Scanning runs outside the event hot path.
IOC matching
Plain-text indicator files for hashes, addresses, domains, and paths, easy to automate from your own threat intel feeds.
Test detections against behaviour, not assumptions.
Capture records the normalized events seen by the live detector. Replay evaluates that recording again after every rule or configuration change.
Because the operating-system events are already normalized, a Windows recording can be analysed on another supported system. Live protection and Replay share the same detection service, so a successful replay exercises the same matching path that handles live events.
Reproducible by construction
Reproduce a detection without rerunning malware, attack simulations, or fragile manual test steps.
Safe to run anywhere
Replay never performs active response, and it never writes into the live alert directory.
Separate outputs
Operational logs, live alerts, recordings, and replay results stay distinct, so endpoint evidence is never confused with offline testing.
# record the normalized event stream $ sudo rustinel capture # edit a rule, then evaluate the same events again $ rustinel replay recording.ndjson INFO replaying recording.ndjson INFO detectors loaded Sigma · YARA · IOC WARN Sigma match "Linux Reverse Shell via /dev/tcp" INFO replay complete active response skipped
The loop
- 1
Generate or observe behaviour
on a lab host, or on a real endpoint already running Rustinel
- 2
Capture normalized events
the same canonical stream the live detector sees, recorded before detection
- 3
Write or modify detections
edit a Sigma rule, tune a filter, add an indicator
- 4
Replay the recording
through the same event-based detector service that handles live events
- 5
Compare alerts, then deploy
ship the rule once you can prove what it does and does not match
Run detection where your endpoint data already lives.
No cloud account, no hosted console, no remote management service. Rules execute locally and alerts are written to local storage by default — keep them on the endpoint, collect them with the shipper you already run, or consume them from your own application.
Local evaluation
Sigma, YARA, and IOC matching happen on infrastructure you control. No telemetry is sent anywhere to be scored.
Open storage
Line-delimited JSON on local disk, not rows in a proprietary backend you cannot query.
Auditable behaviour
Read the code responsible for collection, normalization, detection, and output. Apache 2.0, all of it.
{ "@timestamp": "2026-05-18T12:00:05.000Z", "rule": { "name": "Whoami Execution" }, "event": { "severity": 3, "kind": "alert" }, "process": { "name": "whoami", "executable": "/usr/bin/whoami", "parent": { "name": "bash" } } }
Operational logs, live alerts, recordings, and Replay results stay in separate outputs.
Your alerts should not require our backend.
ECS-shaped NDJSON is straightforward to ingest wherever you already work. Integration is an option you switch on, not a condition of running the detector.
Start with curated rules. Keep full ownership.
The official rules repository ships versioned Sigma, YARA, and IOC packs maintained alongside the engine, from low-noise Essential defaults through to broader Hunting coverage. Browse the coverage, inspect every rule, then fork, tune, and version it as your own.
Linux Essential
Low-noise, high-confidence Linux detections for Rustinel. Safe default pack.
Windows Essential
Low-noise, high-confidence Windows detections for Rustinel. Safe default pack.
Advanced and hunting packs
Expand from strict defaults to broader production and hunting coverage when you are ready to tune.
View all packs →A transparent detection engine, not a managed security service.
These are deliberate, documented boundaries. A sufficiently privileged attacker can interfere with any user-mode detector, and Rustinel says so rather than hiding the trade-off behind a black box.
Rustinel provides
- Native endpoint sensors on Windows, Linux, and macOS
- Local Sigma, YARA, and IOC evaluation
- Structured local alerts in an open format
- Service management, Capture, and Replay
Rustinel does not provide
- A SaaS fleet-management console
- Managed detection and response
- Kernel-level anti-tamper protection
- Guaranteed prevention against a privileged attacker
Deploy endpoint detection without surrendering control.
Start with a portable evaluation, inspect the first alert, then promote Rustinel to a managed service when you are ready.
