// the take
Rustinel is a single-binary endpoint detection agent for Windows, Linux, and macOS that runs Sigma, YARA, and IOC rules against native telemetry (ETW, eBPF, Endpoint Security framework) and writes alerts to local ECS NDJSON files. It's aimed at detection engineers, blue teams, and anyone building or testing SIEM detection content who wants a real multi-platform telemetry source without standing up a commercial EDR or sending data to a vendor cloud.
Capture/replay is the standout feature — record real activity once as NDJSON, then replay it deterministically against new rule configs, even cross-platform (a Windows capture replays on Linux), which turns rule tuning into something you can actually test instead of guessing. It unifies three rule formats (Sigma for behavior, YARA for binaries/memory, IOC lists for hashes/IPs/domains) into one engine and emits plain ECS NDJSON, so it drops into an existing Elastic/Splunk pipeline instead of inventing its own alert schema. `sigma doctor` and `doctor` giving you rule-coverage and dropped-event diagnostics is the kind of operational honesty most detection tooling skips — you find out what isn't firing before an incident, not during one. Native telemetry per platform (ETW/Event Log on Windows, eBPF on Linux, ESF on macOS) instead of a lowest-common-denominator syscall shim means the Windows and Linux sensors get real field coverage, not just process exec events.
The README is upfront that this has no anti-tamper, no pre-execution blocking, and no management console — it's detect-and-log only, not a replacement for a commercial EDR, so there's no story for stopping an attacker or managing rules/alerts across a fleet of endpoints. macOS support is explicitly experimental and needs Full Disk Access configured manually, and the project's own docs say telemetry coverage varies by platform, so parity across the three OSes isn't there yet. There's no central console or alert aggregation built in, so running this past a handful of machines means you're wiring your own Elastic/Splunk ingestion and dashboards from day one. At ~1.10 and a small contributor base, treat any production-hardening or anti-evasion claims with the skepticism you'd give any young security tool that hasn't been through a third-party audit.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →