Open-source endpoint detection has long been split between Windows-focused tools built around Sysmon and Linux tools built around eBPF or auditd. Defenders running mixed environments have had to stitch together separate pipelines, separate rule sets, and separate maintenance burdens. Rustinel, a Rust-based endpoint agent, is an attempt to collapse that work into a single codebase. A single agent across two operating systems Rustinel collects telemetry through ETW on Windows and eBPF on Linux, normalizes the … More →
The post Rustinel: Open-source endpoint detection for Windows and Linux appeared first on Help Net Security.