Radegast Agent

Agent wrapper for the rustinel EDR binary. This project syncs detection packs from a backend, extracts rules into the local rules/ tree, and forwards encrypted alert lines from logs/ to the backend.

Features

• Syncs detection packs via backend API
• Extracts sigma, yara, and merged ioc rules
• Tracks IOC ownership across packs so removed pack IOC files are cleaned up safely
• Tails alerts.json logs and forwards encrypted alerts to the backend
• Optional local rustinel process startup controlled by configuration

Requirements

• Python 3.11+
• hatchling build backend for packaging

Installation

You can also install this project as a UV tool directly from GitHub:

uv tool install git+https://github.com/radegast-edr/radegast-agent-python

radegast-edr-agent --version

Configuration

The agent uses environment variables prefixed with RADEGAST_AGENT_.

Notes

• The agent does not launch rustinel — it must be started separately. The agent only tails alerts from the configured alerts_dir.
• If RADEGAST_AGENT_SIGNING_KEY_PATH is unset, it defaults to ${RADEGAST_AGENT_STATE_DIR:-./.radegast-agent}/device_key.
• IOC files are merged into rules/ioc/ and an ownership registry is kept in rules/ioc/ioc_packs.json.

Usage

Run the agent via the console script:

radegast-edr-agent

Print the installed version:

radegast-edr-agent --version

Or with Python directly:

python -m radegast_edr_agent.cli

Project layout

• radegast_edr_agent/ — application package
  • cli.py — main entry point
  • config.py — environment-backed config schema
  • client.py — backend API client
  • packs.py — pack synchronization and extraction
  • process.py — subprocess management for rustinel
  • tailer.py — alert file tailing and forwarding
  • version.py — version reporting and detection utilities
  • autoupdate.py — agent autoupdate functionality
• tests/ — unit tests
• pyproject.toml — package metadata and build config

Testing

Run the test suite with:

.venv/bin/python -m pytest

License

This project does not include a license file by default. Add a LICENSE file if you want to define reuse terms.