Rustinel v0.1.2

v0.1.2 - Configuration & Detection Engine Improvements

This release introduces runtime configuration flexibility and enhanced Sigma detection capabilities.

✨ New Features

CLI Configuration Overrides

• Added --log-level flag for runtime log level control

  rustinel run --log-level debug

• New configuration precedence: CLI flags → Environment variables → config.toml → Built-in defaults
• Note: Service mode does not support CLI flags; use environment variables or config.toml

Sigma Engine Enhancements

• Alternative field criteria support (OR between mapping groups in sequences)
• Configurable rule evaluation error logging (respects global log level)
• Improved modifier handling with correct pattern matcher precedence
• Better support for complex Sigma rule syntax

Build Configuration

• Added .cargo/config.toml with increased stack size (16MB) for large YARA rulesets

🐛 Bug Fixes

• Fixed registry event field mapping with proper fallback handling
• Fixed pattern matcher ordering for all and base64offset modifiers
• Registry events now correctly use both event and modify field mappings

📊 Logging Improvements

Reduced Noise at INFO Level

• Rule logic evaluation errors only visible at warn, debug, or trace levels
• YARA rule loading messages moved to debug level
• Detection alerts changed from warn → info (they're expected, not errors)
• Failed normalization moved to debug (expected for unsupported event types)

Severity Adjustments

• Alert serialization failures upgraded to error (requires attention)
• ETW trace processing errors properly logged as warnings

📚 Documentation

• Updated configuration precedence documentation across README and docs/
• Added CLI flag usage examples
• Clarified service runtime behavior with configuration sources

🔧 Internal Improvements

• Refactored selection compilation for better maintainability
• Performance optimization: NumericOp now derives Copy
• Added comprehensive unit tests for new Sigma modifier behavior

---

Full Changelog: v0.1.1...v0.1.2

Installation

1. Download rustinel-0.1.2-x86_64-pc-windows-msvc.zip
2. Extract to your desired location
3. Review and customize config.toml
4. Add Sigma rules to rules/sigma/
5. Add YARA rules to rules/yara/
6. Run as Administrator: .\rustinel.exe run

Requirements

• Windows 10/11 or Server 2016+ (x64)
• Administrator privileges (required for ETW access)
• Rust runtime NOT required (statically linked binary)

What's Changed

See auto-generated release notes below.

Full Changelog: v0.1.1...v0.1.2