Rustinel v1.0.0

Rustinel v1.0.0

v1.0.0 is the first official stable release of Rustinel.

This release brings official Linux support alongside Windows, with a shared cross-platform detection pipeline. Rustinel collects host telemetry through ETW on Windows and eBPF on Linux, normalizes events into one model, evaluates Sigma, YARA, and IOC detections, writes ECS 9.3.0 NDJSON alerts, and can optionally terminate malicious processes.

Highlights

• First official stable Rustinel release
• Official Windows support via ETW
• Official Linux support via eBPF
• Shared detection pipeline across both platforms
• Sigma, YARA, and IOC detection support
• Hot reload for Sigma, YARA, and IOC files
• Expanded documentation for setup, operations, troubleshooting, and architecture
• Updated CI/CD and release packaging for Windows x86_64, Linux x86_64, and Linux arm64

Downloads

Platform	Architecture	Package
Windows	x86_64	rustinel-1.0.0-x86_64-pc-windows-msvc.zip
Linux	x86_64	rustinel-1.0.0-x86_64-unknown-linux-musl.tar.gz
Linux	arm64	rustinel-1.0.0-aarch64-unknown-linux-musl.tar.gz

Checksums are available in rustinel-1.0.0-checksums-sha256.txt.

What Changed

• Added a Linux eBPF sensor with process, network, file, and DNS telemetry
• Split the sensor stack into explicit Windows and Linux paths while keeping one shared userspace engine
• Improved normalization and rule handling so Windows and Linux events can be evaluated through the same detection model
• Added platform-specific demo Sigma rules: rules/sigma/windows_whoami.yml and rules/sigma/linux_whoami.yml
• Added rustinel.service for Linux deployments using systemd
• Added new operator docs, including Operations, Troubleshooting, and FAQ guides
• Updated the release workflow to lint, test, package, and publish all supported targets

Full Changelog: v0.4.0...v1.0.0