rustinel-rules documentation

June 9, 2026 · View on GitHub

Detection content for the Rustinel endpoint detection engine. This repository holds curated Sigma, YARA and IOC detections, organizes them into cumulative packs, validates them in CI, and builds flat artifacts the engine loads directly.

Start here

New to the repo? Read these in order:

  1. Repository model — how detections, packs and the build pipeline fit together.
  2. Packs — the catalog of packs and every rule they contain.
  3. Using packs with Rustinel — install a pack and wire config.toml.

Reference

  • Rustinel support reference — the authoritative list of what the engine can detect: telemetry channels, Sigma log sources and fields, supported Sigma operators/modifiers, YARA behavior, and IOC types/formats. Read this before writing a rule — anything outside it won't load or fire.
  • Authoring rules — step-by-step for adding Sigma, YARA and IOC content.
  • Detection as Code — the CI checks and the dynamic-testing policy.

At a glance

ConceptSummary
ArtifactOne detection (Sigma rule, YARA rule, or IOC set). Lives once under rules/, has a stable id.
PackA manifest (packs/<os>/<level>/pack.yml) listing artifact ids. Packs are cumulative via extends.
Levelessential (safe default) ⊂ advanced ⊂ hunting (analyst-driven, noisy).
Buildtools/build_packs.py materializes each pack into a flat, zipped folder + index.json.
Validationtools/validate.py enforces metadata, unique ids, ATT&CK tags, Rustinel telemetry compatibility, IOC sanity.

Tooling commands

uv sync                                 # one-time: install pinned tooling into .venv
uv run python tools/validate.py         # Detection-as-Code checks (run before every PR)
uv run python tools/build_packs.py      # Materialize packs into dist/ (folders + zips + index.json)

Tooling is managed with uv: dependencies (PyYAML, jsonschema, yara-x) and dev tools (ruff, ty) are pinned in pyproject.toml / uv.lock. Lint, format and type-check with:

uv run ruff check tools         # lint
uv run ruff format tools        # format
uv run ty check                 # type-check