Karib0u

Karib0u/rustinel

Open-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.

6 good first / help-wanted issues · Rust · last activity Jul 9, 2026

414 stars 46 forks 414 watchers Rust Apache License 2.0
blue-team detection-engineering ebpf edr endpoint-detection endpoint-security etw incident-response linux linux-security malware-detection rust security-monitoring security-tools siem sigma sysmon threat-detection windows-security yara
View on GitHub Website
6 Open Issues Need Help Last updated: Jul 9, 2026

Open Issues Need Help

View All on GitHub
chore(lint): document every unsafe block and enable undocumented_unsafe_blocks 26 days ago
good first issue security
Karib0u/rustinel
414

Open-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.

Rust
#blue-team#detection-engineering#ebpf#edr#endpoint-detection#endpoint-security#etw#incident-response#linux#linux-security#malware-detection#rust#security-monitoring#security-tools#siem#sigma#sysmon#threat-detection#windows-security#yara
chore(sensor): finish the RawEvent rename and remove the compatibility aliases 26 days ago
good first issue refactor sensor
Karib0u/rustinel
414

Open-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.

Rust
#blue-team#detection-engineering#ebpf#edr#endpoint-detection#endpoint-security#etw#incident-response#linux#linux-security#malware-detection#rust#security-monitoring#security-tools#siem#sigma#sysmon#threat-detection#windows-security#yara
test(ci): switch Rust test execution to cargo-nextest 26 days ago
good first issue
Karib0u/rustinel
414

Open-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.

Rust
#blue-team#detection-engineering#ebpf#edr#endpoint-detection#endpoint-security#etw#incident-response#linux#linux-security#malware-detection#rust#security-monitoring#security-tools#siem#sigma#sysmon#threat-detection#windows-security#yara
test(alerts): cover alert construction and event field-mapping degradation paths 2 months ago
good first issue testing p2
Karib0u/rustinel
414

Open-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.

Rust
#blue-team#detection-engineering#ebpf#edr#endpoint-detection#endpoint-security#etw#incident-response#linux#linux-security#malware-detection#rust#security-monitoring#security-tools#siem#sigma#sysmon#threat-detection#windows-security#yara
fix(logging): restrict permissions on alert and log files 4 months ago
good first issue security p2
Karib0u/rustinel
414

Open-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.

Rust
#blue-team#detection-engineering#ebpf#edr#endpoint-detection#endpoint-security#etw#incident-response#linux#linux-security#malware-detection#rust#security-monitoring#security-tools#siem#sigma#sysmon#threat-detection#windows-security#yara
refactor(doctor): split doctor.rs into a module 4 months ago
good first issue refactor p3
Karib0u/rustinel
414

Open-source cross-platform endpoint detection engine for Windows, macOS, and Linux using ETW, ESF, eBPF, Sigma, YARA, IOCs, and ECS NDJSON alerts.

Rust
#blue-team#detection-engineering#ebpf#edr#endpoint-detection#endpoint-security#etw#incident-response#linux#linux-security#malware-detection#rust#security-monitoring#security-tools#siem#sigma#sysmon#threat-detection#windows-security#yara