Rustinel v1.9.1

Highlights

• Keep your own rules next to a managed pack.
  scanner.sigma_local_rules_paths and scanner.yara_local_rules_paths load local rule directories after the pack at startup, on reload, in replay, and in doctor.
  rules install and rules update leave them untouched, and a local rule with the same Sigma id or YARA name replaces the pack rule, with a warning and a doctor check.
  rules update now reuses the catalog URL recorded at install time.
• Run integrations without root.
  security.integration_group lets an unprivileged integration such as Radegast edit the configuration in place and read logs, on Unix by group and on Windows by service account.
  security.integration_rules_directory delegates a single rules directory the same way.
  On Windows, folders under C:\Program Files are no longer refused for being owned by TrustedInstaller.
• More trustworthy diagnostics and captures.
  rustinel doctor reports a missing, unreadable, corrupt, or stale telemetry snapshot instead of a passing check.
  Windows captures keep the acting process ID and image for registry, file, DNS, PowerShell, and image-load events, and PowerShell script blocks keep MessageNumber and MessageTotal so fragments can be told from whole scripts.
• Fewer silent gaps in detection.
  Windows memory scans now include pages that carry modifier bits such as PAGE_NOCACHE or PAGE_WRITECOMBINE.
  On macOS, network capture picks up new interfaces without a restart and restarts failed BPF workers with backoff.
• Smoother first runs.
  Portable packages no longer ship an empty logs directory that sudo ./rustinel run rejected, and install.sh prints a working command to read restricted alerts.

Upgrade notes

• Updating: run rustinel update or install 1.9.1 explicitly with the installer version option.
  Restart the service after replacing the binary, then run rustinel doctor.
• capture and replay --output refuse to overwrite.
  An existing capture payload, manifest, or replay report now stops the command instead of being replaced.
  Remove or rename the old files, or choose a new path, in scripts that reuse output locations.
• doctor can now warn where it used to pass.
  A running service with a missing or stale telemetry snapshot exits 1, and --json gains a telemetry_snapshot entry.
  Check monitoring that treats any nonzero exit as a failure.
• Integration access is opt-in.
  The new security.* options are file-only, require a restart, and cannot be set through environment variables.
  Defaults are unchanged, and each option delegates control of the configuration or rules to that group or account, so grant it deliberately.
• Portable first run: if an earlier run left a user-owned logs directory, remove it or rerun the installer with --force.
• Alert fields: Windows PowerShell script-block alerts add edr.powershell.message_number and edr.powershell.message_total.
  Older captures without them still replay.

Downloads

Platform	Architecture	Package
Linux	x86_64	rustinel-1.9.1-x86_64-unknown-linux-musl.tar.gz
Linux	arm64	rustinel-1.9.1-aarch64-unknown-linux-musl.tar.gz
Windows	x86_64	rustinel-1.9.1-x86_64-pc-windows-msvc.zip
macOS	arm64	rustinel-1.9.1-aarch64-apple-darwin.tar.gz
macOS	x86_64	rustinel-1.9.1-x86_64-apple-darwin.tar.gz

Installer

Linux and macOS

curl -fsSL https://rustinel.io/install.sh | sh -s -- --version 1.9.1
cd rustinel
sudo ./rustinel run

macOS support is experimental. Grant Full Disk Access before the first run: https://docs.rustinel.io/macos-permissions/

Windows (elevated PowerShell)

$env:RUSTINEL_VERSION='1.9.1'; irm https://rustinel.io/install.ps1 | iex; Remove-Item Env:\RUSTINEL_VERSION -ErrorAction SilentlyContinue
Set-Location rustinel
.\rustinel.exe run

Quickstart, configuration, and SIEM guides: https://docs.rustinel.io/getting-started/

Scripts install published release binaries only. Verify downloads with the signed rustinel-1.9.1-checksums-sha256.txt and its .minisig file.

Provenance

All release artifacts have SLSA build provenance attestations signed by GitHub:

gh attestation verify <artifact> \
  --repo Karib0u/rustinel \
  --signer-workflow Karib0u/rustinel/.github/workflows/release.yml

What's Changed

Bug Fixes

• fix(nix): update release pin to 1.9.0 by @Karib0u in #701
• fix(integrations): support explicit Unix group access by @Karib0u in #704
• fix(integrations): support Windows service accounts by @Karib0u in #705
• fix(doctor): distinguish unavailable and stale telemetry from healthy runtime state by @Karib0u in #707
• fix(windows-etw): preserve actor PID and executable context in captures by @Karib0u in #709
• fix(macos-network): reconcile interfaces and restart failed BPF capture workers by @Karib0u in #710
• fix(windows-memory): classify pages after masking protection modifiers by @Karib0u in #706
• fix(output): prevent accidental overwrites in capture and replay by @Karib0u in #708
• fix(rules): keep user rules alongside the managed pack across install and update by @Karib0u in #712
• fix(onboarding): make portable first runs compatible with output ownership checks by @Karib0u in #711
• fix(rules): persist the catalog URL so rules update reuses the install source by @Karib0u in #713
• fix(powershell): preserve script-block fragment metadata in captures by @Karib0u in #714

Documentation

• docs(rules): consolidate pack and authoring guidance by @Karib0u in #694

Dependencies

• chore(deps): bump the patch-updates group with 3 updates by @dependabot[bot] in #703

Maintenance

• fix(ci): share the atomic rules pin across workflows by @Karib0u in #697
• chore(deps): bump taiki-e/install-action from 2.87.17 to 2.87.21 by @dependabot[bot] in #702

Full Changelog: v1.9.0...v1.9.1