Skip to content

Rustinel v1.10.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Oct 13:14
· 6 commits to main since this release
v1.10.0
0beac7e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Know when the sensor loses events.
    The agent writes an agent::loss::sensor_events alert for each event category that dropped events in the last window, with the channel, category, and dropped count.
    Tune the window with telemetry.loss_alert_interval_secs (default 60, 0 disables).
    Loss alerts bypass deduplication and never reach active response.
  • Alerts identify their host and agent.
    Sigma, YARA, IOC, and correlation alerts carry host.id, host.name, agent.id, agent.type, and agent.version, identically in the NDJSON file and in webhook bodies.
    host.id is a keyed one-way digest of the OS machine id, so the raw id is never emitted.
  • More honest sigma doctor verdicts.
    Fields measured as reliably populated on process_creation are reported as caveats instead of degrading a rule, so most process-creation rules now report that they can fire.
    The command exits 0 when every rule can fire, with or without caveats, and --json gains summary.can_fire_with_caveats.
  • Fewer silent gaps on every platform.
    On Linux, file events are no longer lost on every CPU but CPU 0 on kernels with the perf syscall tracing backport (Ubuntu 7.0.0-38 and 7.1 from 7.1.6).
    On Windows, a lost Event Log subscription recovers per channel and a channel missing at startup is retried instead of stopping the sensor, a service restart waits for a pending stop, NT device paths convert correctly on component boundaries and network shares, and written-file identity no longer slows process-image resolution.
    On macOS, exec identities are retired on exit and startup processes are seeded.
  • Lower overhead under load.
    YARA reuses one scanner per thread, artifact I/O runs on long-lived workers behind a bounded completion channel, pooled scanners are released after a rule reload, and correlation buffering and Linux /proc enrichment do less work.

Upgrade notes

  • Restart after upgrading: restart the service after replacing the binary, then run rustinel doctor and verify a known detection.
  • Sensor loss alerts are on by default.
    Expect an agent::loss::sensor_events alert whenever a category drops events, plus a final one at shutdown.
    The count is a per-window delta, not a total.
    Route or filter on event.dataset: "edr.agent" in downstream pipelines, or set telemetry.loss_alert_interval_secs = 0 to disable.
  • New alert fields and a new state file.
    Alerts add the host.* and agent.* fields above.
    agent.id is a random UUID persisted owner-only in <agent.directory>/agent-id, set with the new [agent] directory option, and managed layouts use a state directory.
    If it cannot be persisted, agent.id is omitted.
    Cloned or imaged hosts must not copy this file, or they will share an identity.
  • sigma doctor exit codes change.
    The command used to exit 1 for almost any ruleset on process_creation.
    It now exits 0 when every rule can fire, so scripts that treated the old exit code as normal should be reviewed.
  • rustinel doctor judges drops as a loss rate.
    The telemetry counters are lifetime totals, so one shed event among millions used to keep a check at WARN until restart.
    Pipeline queues and the artifact resolver now warn from 0.01% loss and pass below it, and alert loss fails from 0.1%.
  • Linux file descriptors: the sensor raises its soft RLIMIT_NOFILE to the hard limit at start, because the per-CPU tracepoint fix opens one descriptor per hooked tracepoint per CPU.
    If it cannot open them, rustinel doctor reports the feature as degraded.
  • Rule engine: rsigma is updated to 0.24, and rustls to 0.23.46 for RUSTSEC-2026-0346 to 0349.

Downloads

Platform Architecture Package
Linux x86_64 rustinel-1.10.0-x86_64-unknown-linux-musl.tar.gz
Linux arm64 rustinel-1.10.0-aarch64-unknown-linux-musl.tar.gz
Windows x86_64 rustinel-1.10.0-x86_64-pc-windows-msvc.zip
macOS arm64 rustinel-1.10.0-aarch64-apple-darwin.tar.gz
macOS x86_64 rustinel-1.10.0-x86_64-apple-darwin.tar.gz

Installer

Linux and macOS

curl -fsSL https://rustinel.io/install.sh | sh -s -- --version 1.10.0
cd rustinel
sudo ./rustinel run

macOS support is experimental. Grant Full Disk Access before the first run: https://docs.rustinel.io/macos-permissions/

Windows (elevated PowerShell)

$env:RUSTINEL_VERSION='1.10.0'; irm https://rustinel.io/install.ps1 | iex; Remove-Item Env:\RUSTINEL_VERSION -ErrorAction SilentlyContinue
Set-Location rustinel
.\rustinel.exe run

Quickstart, configuration, and SIEM guides: https://docs.rustinel.io/getting-started/

Scripts install published release binaries only. Verify downloads with the signed rustinel-1.10.0-checksums-sha256.txt and its .minisig file.

Provenance

All release artifacts have SLSA build provenance attestations signed by GitHub:

gh attestation verify <artifact> \
  --repo Karib0u/rustinel \
  --signer-workflow Karib0u/rustinel/.github/workflows/release.yml

What's Changed

Performance

  • perf(yara): reuse yara-x scanners instead of creating one per scan by @Karib0u in #732
  • perf(pipeline): cut hot-path costs in artifact dispatch, correlation buffering, and /proc reads (#607) by @Karib0u in #741
  • fix(artifact): bound the I/O pool completion channel by @Karib0u in #753
  • fix(yara): release pooled scanners that outlive a reloaded rule set by @Karib0u in #754

Features

  • feat(ecs): add stable host and agent identity to alerts by @Karib0u in #734
  • feat(sigma): report measured-reliable fields as caveats instead of degraded by @Karib0u in #766
  • feat(telemetry): alert when sensor events are dropped by @Karib0u in #771

Bug Fixes

  • fix(windows): convert NT device paths only at component boundaries and map network shares by @Karib0u in #755
  • fix(linux): keep syscall tracepoints firing on every CPU by @Karib0u in #759
  • fix(yara-memory): keep partial Windows reads and retry fixture spawn on ETXTBSY by @Karib0u in #767
  • fix(event-log): recover a lost subscription per channel by @Karib0u in #772
  • fix(windows-service): restart waits for a pending stop before starting by @Karib0u in #769
  • fix(macos-esf): retire exec identities on exit and seed startup processes by @Karib0u in #770
  • fix(windows-etw): Task Scheduler 106 no longer trips the Never-field assertion by @Karib0u in #777
  • fix(windows): measure written-file identity off the resolver receive loop by @Karib0u in #778
  • fix(windows): retry an Event Log channel missing at startup by @Karib0u in #788
  • fix(doctor): judge drop counters as a loss rate, not a bare count by @Karib0u in #796

Documentation

  • docs: fix drift between the documentation and current behavior by @Karib0u in #790

Dependencies

  • chore(deps): bump rsigma-parser and rsigma-eval to 0.24.0 by @dependabot[bot] in #763
  • chore(deps): bump the patch-updates group with 3 updates by @dependabot[bot] in #761
  • chore(deps): bump uuid from 1.26.1 to 1.27.0 by @dependabot[bot] in #764
  • fix(deps): bump rustls to 0.23.46 by @Karib0u in #773
  • fix(deps): ignore unreachable wasmtime advisories to restore supply chain CI by @Karib0u in #775

Maintenance

  • chore(sensor): finish the RawEvent rename and remove the compatibility aliases by @Karib0u in #716
  • chore(lint): document every unsafe block and enable undocumented_unsafe_blocks by @Karib0u in #719
  • refactor(linux-ebpf): declare the kernel event ABI once by @Karib0u in #720
  • refactor(models): derive file and registry event actions from one table by @Karib0u in #717
  • refactor(runtime): run live detection and capture through one sensor-set runner by @Karib0u in #721
  • refactor(architecture): enforce a one-way module dependency direction by @Karib0u in #722
  • refactor(artifact): split the artifact module and move admission and deferred detection into stages by @Karib0u in #723
  • refactor(normalizer): read the host through a NormalizerHost trait by @Karib0u in #725
  • refactor(telemetry): replace process-wide counters and registries with pipeline-owned handles (#662) by @Karib0u in #724
  • fix(normalizer): restore main after #724 and #725 merged by @Karib0u in #726
  • ci: pin atomic rules to rustinel-rules v0.4.0 by @Karib0u in #727
  • ci: pin atomic rules to rustinel-rules 4449986 by @Karib0u in #728
  • ci: fix action pin version comments flagged by zizmor by @Karib0u in #729
  • test(rules): cover unsafe zip entries and size caps in pack extraction by @Karib0u in #731
  • test: make reload, skip, and memory_target tests deterministic and visible by @Karib0u in #733
  • refactor(windows-etw): decode through a property trait and test with recorded records by @Karib0u in #736
  • ci(windows): sign the release binary with SignPath by @Karib0u in #765
  • chore(deps): bump taiki-e/install-action from 2.87.21 to 2.87.25 by @dependabot[bot] in #760
  • test(response): exercise the kill path, full-path allowlist, and worker config refresh in CI by @Karib0u in #776
  • test(ci): fail the eBPF smoke test on degraded hooks and run the live Linux tests by @Karib0u in #768
  • ci: cache macOS atomic build, share one build per OS, shard Windows atomics by @Karib0u in #783
  • ci: repin atomic rules to the squash-merged rustinel-rules#115 by @Karib0u in #784
  • ci: stop rust-cache misses from runner image rollouts by @Karib0u in #785
  • ci(release): overlap Windows and macOS builds with the gates, shard atomics by @Karib0u in #787
  • ci: shorten the PR critical path by @Karib0u in #786
  • ci: restore rust-cache's lockfile hash, strip stray toolchains instead by @Karib0u in #789
  • feat(bench): realistic and stress benchmark, and fail bench runs that lose events by @Karib0u in #797

Full Changelog: v1.9.1...v1.10.0

Contributors

Karib0u and dependabot
Assets 9
Loading