From 2a733db6a4cd0ff038faa2f3524b3df4597e080c Mon Sep 17 00:00:00 2001 From: Karib0u Date: Fri, 16 Oct 2026 14:42:09 +0200 Subject: [PATCH] chore(release): prepare 1.10.0 --- .github/release-notes/1.10.0.md | 41 +++++++++++++++++++++++++++++++++ Cargo.lock | 2 +- Cargo.toml | 2 +- 3 files changed, 43 insertions(+), 2 deletions(-) create mode 100644 .github/release-notes/1.10.0.md diff --git a/.github/release-notes/1.10.0.md b/.github/release-notes/1.10.0.md new file mode 100644 index 00000000..1f5d9b4e --- /dev/null +++ b/.github/release-notes/1.10.0.md @@ -0,0 +1,41 @@ +## Highlights + +- **Know when the sensor loses events.** + The agent writes an `agent::loss::sensor_events` alert for each event category that dropped events in the last window, with the channel, category, and dropped count. + Tune the window with `telemetry.loss_alert_interval_secs` (default 60, `0` disables). + Loss alerts bypass deduplication and never reach active response. +- **Alerts identify their host and agent.** + Sigma, YARA, IOC, and correlation alerts carry `host.id`, `host.name`, `agent.id`, `agent.type`, and `agent.version`, identically in the NDJSON file and in webhook bodies. + `host.id` is a keyed one-way digest of the OS machine id, so the raw id is never emitted. +- **More honest `sigma doctor` verdicts.** + Fields measured as reliably populated on `process_creation` are reported as caveats instead of degrading a rule, so most process-creation rules now report that they can fire. + The command exits `0` when every rule can fire, with or without caveats, and `--json` gains `summary.can_fire_with_caveats`. +- **Fewer silent gaps on every platform.** + On Linux, file events are no longer lost on every CPU but CPU 0 on kernels with the perf syscall tracing backport (Ubuntu `7.0.0-38` and 7.1 from 7.1.6). + On Windows, a lost Event Log subscription recovers per channel and a channel missing at startup is retried instead of stopping the sensor, a service restart waits for a pending stop, NT device paths convert correctly on component boundaries and network shares, and written-file identity no longer slows process-image resolution. + On macOS, exec identities are retired on exit and startup processes are seeded. +- **Lower overhead under load.** + YARA reuses one scanner per thread, artifact I/O runs on long-lived workers behind a bounded completion channel, pooled scanners are released after a rule reload, and correlation buffering and Linux `/proc` enrichment do less work. + Windows release binaries are now signed through SignPath. + +## Upgrade notes + +- **Restart after upgrading:** restart the service after replacing the binary, then run `rustinel doctor` and verify a known detection. +- **Sensor loss alerts are on by default.** + Expect an `agent::loss::sensor_events` alert whenever a category drops events, plus a final one at shutdown. + The count is a per-window delta, not a total. + Route or filter on `event.dataset: "edr.agent"` in downstream pipelines, or set `telemetry.loss_alert_interval_secs = 0` to disable. +- **New alert fields and a new state file.** + Alerts add the `host.*` and `agent.*` fields above. + `agent.id` is a random UUID persisted owner-only in `/agent-id`, set with the new `[agent] directory` option, and managed layouts use a `state` directory. + If it cannot be persisted, `agent.id` is omitted. + Cloned or imaged hosts must not copy this file, or they will share an identity. +- **`sigma doctor` exit codes change.** + The command used to exit `1` for almost any ruleset on `process_creation`. + It now exits `0` when every rule can fire, so scripts that treated the old exit code as normal should be reviewed. +- **`rustinel doctor` judges drops as a loss rate.** + The telemetry counters are lifetime totals, so one shed event among millions used to keep a check at WARN until restart. + Pipeline queues and the artifact resolver now warn from 0.01% loss and pass below it, and alert loss fails from 0.1%. +- **Linux file descriptors:** the sensor raises its soft `RLIMIT_NOFILE` to the hard limit at start, because the per-CPU tracepoint fix opens one descriptor per hooked tracepoint per CPU. + If it cannot open them, `rustinel doctor` reports the feature as degraded. +- **Rule engine:** `rsigma` is updated to 0.24, and `rustls` to 0.23.46 for RUSTSEC-2026-0346 to 0349. diff --git a/Cargo.lock b/Cargo.lock index 642b945b..d4a445c2 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3229,7 +3229,7 @@ dependencies = [ [[package]] name = "rustinel" -version = "1.10.0-rc.1" +version = "1.10.0" dependencies = [ "anyhow", "arc-swap", diff --git a/Cargo.toml b/Cargo.toml index ff22fceb..67005261 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "rustinel" -version = "1.10.0-rc.1" +version = "1.10.0" edition = "2021" authors = [] description = "Open-source EDR for Windows, Linux, and macOS with Sigma, YARA, and IOC detection"