rustinel

Rustinel is an open-source endpoint detection tool designed for Windows, Linux, and macOS systems, focusing on providing native telemetry and alerting capabilities. It supports detection formats like Sigma and YARA, enabling rule reuse without needing proprietary adaptations, and produces SIEM-ready alerts in the Elastic Common Schema format. Key features include hot reloading for rules and IOC management, active response options for Windows and Linux, and comprehensive logging of alerts.