Issues

• Linux Advanced: file persistence rules fire on container image unpacking by containerd

  Karib0u/rustinel#686 · Filter by author rsilvio opened on Oct 1, 2026

• Linux: YARA and hash IOC scans fail for containerized processes (artifact path resolved in the host mount namespace)

  bug
  Karib0u/rustinel#685 · Filter by author rsilvio opened on Oct 1, 2026

• feat(rules): support additional local Sigma and YARA directories

  dxengineenhancementyara
  Karib0u/rustinel#684 · Filter by author rsilvio opened on Oct 1, 2026
  1

• test(atomic): extend sensor contracts with per-atomic behavior evidence

  testingwindows
  Karib0u/rustinel#671 · Filter by author Karib0u opened on Sep 30, 2026

• fix(powershell): preserve script-block fragment metadata in captures

  bugsensorwindows
  Karib0u/rustinel#670 · Filter by author Karib0u opened on Sep 30, 2026

• feat(windows-etw): add configurable registry query and enumeration telemetry

  enhancementsensorwindows
  Karib0u/rustinel#669 · Filter by author Karib0u opened on Sep 30, 2026

• fix(windows-etw): preserve actor PID and executable context in captures

  bugsensorwindows
  Karib0u/rustinel#668 · Filter by author Karib0u opened on Sep 30, 2026

• refactor(architecture): follow-ups from the 2026-09 architecture audit

  refactortracking
  Karib0u/rustinel#666 · Filter by author Karib0u opened on Sep 29, 2026

• chore(lint): document every unsafe block and enable undocumented_unsafe_blocks

  security
  Karib0u/rustinel#665 · Filter by author Karib0u opened on Sep 29, 2026

• chore(sensor): finish the RawEvent rename and remove the compatibility aliases

  good first issuerefactorsensor
  Karib0u/rustinel#664 · Filter by author Karib0u opened on Sep 29, 2026

• refactor(linux-ebpf): declare the kernel event ABI once

  linuxrefactorsensor
  Karib0u/rustinel#663 · Filter by author Karib0u opened on Sep 29, 2026

• refactor(telemetry): replace process-wide counters and registries with pipeline-owned handles

  observabilityrefactor
  Karib0u/rustinel#662 · Filter by author Karib0u opened on Sep 29, 2026

• refactor(models): derive event actions from one table

  enginerefactorsensor
  Karib0u/rustinel#661 · Filter by author Karib0u opened on Sep 29, 2026

• refactor(artifact): split artifact.rs into resolver, store, and pipeline-stage modules

  enginerefactor
  Karib0u/rustinel#660 · Filter by author Karib0u opened on Sep 29, 2026

• refactor(architecture): enforce a one-way module dependency direction

  designrefactor
  Karib0u/rustinel#659 · Filter by author Karib0u opened on Sep 29, 2026

• refactor(runtime): run live detection and capture through one sensor-set runner

  linuxmacosrefactorwindows
  Karib0u/rustinel#658 · Filter by author Karib0u opened on Sep 29, 2026

• design(ioc): per-indicator metadata, expiry, and feed import

  designengine
  Karib0u/rustinel#655 · Filter by author Karib0u opened on Sep 29, 2026

• design(sigma): expose process ancestry beyond the parent

  designengine
  Karib0u/rustinel#654 · Filter by author Karib0u opened on Sep 29, 2026

• design(macos-esf): expand Endpoint Security beyond process and file lifecycle

  designmacossensor
  Karib0u/rustinel#651 · Filter by author Karib0u opened on Sep 29, 2026

• feat(windows-etw): populate CurrentDirectory on process starts

  enhancementsensorwindows
  Karib0u/rustinel#650 · Filter by author Karib0u opened on Sep 29, 2026

• feat(windows-etw): collect PowerShell 7 script blocks and assess AMSI content

  designenhancementsensorwindows
  Karib0u/rustinel#649 · Filter by author Karib0u opened on Sep 29, 2026

• feat(windows-eventlog): collect operational channels beyond System, Security, and TaskScheduler

  enhancementsensorwindows
  Karib0u/rustinel#648 · Filter by author Karib0u opened on Sep 29, 2026

• feat(linux-ebpf): capture timestamp changes, symlinks, namespace changes, signals, and loader environment variables

  enhancementlinuxsensor
  Karib0u/rustinel#647 · Filter by author Karib0u opened on Sep 29, 2026

• feat(linux-ebpf): report listening sockets, unconnected UDP sends, and raw packet sockets

  enhancementlinuxsensor
  Karib0u/rustinel#646 · Filter by author Karib0u opened on Sep 29, 2026

• feat(linux-ebpf): add bounded sensitive file reads

  enhancementlinuxsensor
  Karib0u/rustinel#645 · Filter by author Karib0u opened on Sep 29, 2026