Skip to content

Rustinel v1.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Jul 06:06
· 54 commits to main since this release
v1.2.0
ec69230
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Rustinel 1.2.0: test it → keep it → check it

Rustinel 1.2 turns a pile of primitives into a clear lifecycle. One command installs the agent and starts a portable evaluation that makes no persistent changes to the machine; one command promotes the same binary into a managed endpoint deployment; and one command diagnoses the result. The bundled Sigma demo rule still fires on your first whoami, but now there's a straight path from that first alert to a running, self-checking service on Windows, Linux, and macOS.

Highlights

  • One-command portable evaluation. install.sh / install.ps1 download a signed release archive and, with --run, start Rustinel in place: bundled config, demo rules, active response off, no persistent machine changes.
  • One-command managed deployment: rustinel setup. Promote the same binary into a managed install with stable platform paths for binary, config, rules, state, and logs. (#117, #123)
  • Native service management: rustinel service …. install, start, stop, restart, status, and uninstall behave consistently across the Windows Service Manager, systemd, and launchd. (#119)
  • Read-only diagnostics: rustinel doctor. Installation, service, rules, path, and configuration health with actionable output. Read-only by design: it never modifies the host. (#118, #124)
  • Safe rules-pack management: rustinel rules list / rustinel rules install. Install production packs without hand-editing config.toml; a failed install or update preserves the previous working state. (#120)
  • Opt-in RSigma engine backend. An alternate library backend for Sigma detection, off by default. (#101)
  • macOS packages are signed and notarized (still experimental). setup now resolves the release symlink and copies the complete signed app bundle, so the managed app bundle is valid. Endpoint Security still requires root and a one-time Full Disk Access approval before the first successful start. (#154, #157)

What's Changed

Features

  • rustinel setup and the portable/managed install layouts by @Karib0u in #117, #123
  • rustinel service native service management (Windows SCM, systemd, launchd) by @Karib0u in #119
  • rustinel doctor read-only diagnostics by @Karib0u in #118, #124
  • rustinel rules list / rustinel rules install for released rules packs by @Karib0u in #120
  • Opt-in RSigma library backend for Sigma detection by @mostafa in #101
  • Portable evaluation installers (install.sh / install.ps1) by @Karib0u in #128
  • Rule ID field added to the alert structure by @esoadamo in #70
  • Improved I/O handling for YARA scanning and hot reload by @esoadamo in #94

Bug Fixes

  • Fix Sigma multi-document rule loading by @Karib0u in #127
  • Correct the Microsoft-Windows-Kernel-File ETW provider GUID by @ymat19 in #132
  • Stop scanning the current directory when YARA is disabled by @ymat19 in #150
  • macOS: copy the signed app bundle during setup by @Karib0u in #154
  • macOS: resolve the release symlink during setup by @Karib0u in #157
  • Resolve stale lockfile resolution by @Karib0u in #95
  • Mark prerelease tags as prereleases so latest only points at stable builds by @Karib0u in #126

Documentation

  • Rewrite onboarding and operations guidance around test / deploy / diagnose by @Karib0u in #156
  • Clean up docs and release notes by @Karib0u in #89
  • Standardize OS ordering in docs by @Karib0u in #90

Refactoring

Security & CI

Dependencies

  • Bump yara-x 1.17 → 1.19 in #93, #99; aya 0.13 → 0.14 in #100; aya-ebpf 0.1 → 0.2 in #96
  • Bump zip 2.4.2 → 8.6.0 in #121; criterion 0.5.1 → 0.8.2 in #113
  • Bump actions/checkout 6 → 7 in #91; actions/cache 5 → 6 in #97; zizmorcore/zizmor-action 0.5.6 → 0.5.7 in #112
  • Grouped patch updates in #92, #98; ignore evalexpr 12 updates in #125

Release engineering

New Contributors

Full Changelog: v1.1.4...v1.2.0

Upgrading from 1.1.4

Existing portable users can keep running from their extracted archive. To adopt the managed lifecycle:

# Linux / macOS
curl -fsSL https://rustinel.io/install.sh | sh -s -- --run
sudo rustinel setup --yes
rustinel doctor

Config written for 1.1.x remains compatible; rustinel doctor flags any path or service issues after promotion.

Downloads

Platform Architecture Package
Linux x86_64 rustinel-1.2.0-x86_64-unknown-linux-musl.tar.gz
Linux arm64 rustinel-1.2.0-aarch64-unknown-linux-musl.tar.gz
Windows x86_64 rustinel-1.2.0-x86_64-pc-windows-msvc.zip
macOS arm64 rustinel-1.2.0-aarch64-apple-darwin.tar.gz
macOS x86_64 rustinel-1.2.0-x86_64-apple-darwin.tar.gz

Installer

Linux

curl -fsSL https://rustinel.io/install.sh | sh -s -- --version 1.2.0 --run

macOS

curl -fsSL https://rustinel.io/install.sh | sh -s -- --version 1.2.0
cd rustinel

macOS support is experimental. Endpoint Security requires root and a one-time Full Disk Access approval before the first successful start. See the install guide for the interactive terminal and LaunchDaemon approval paths, then run sudo ./rustinel run.

Windows (PowerShell)

$env:RUSTINEL_VERSION='1.2.0'; irm https://rustinel.io/install.ps1 | iex; Remove-Item Env:\RUSTINEL_VERSION -ErrorAction SilentlyContinue

Full install, configuration, and SIEM ingestion guides: https://docs.rustinel.io/getting-started/

Scripts install published release binaries only. Verify downloads with rustinel-1.2.0-checksums-sha256.txt.

Contributors

mostafa, esoadamo, and 3 other contributors
Assets 8
Loading