Radegast Agent

Agent wrapper for the rustinel EDR binary. This project syncs detection packs from a backend, extracts rules into the local rules/ tree, and forwards alerts lines from logs/ to the backend as E2EE.

Features

Syncs detection packs via backend API
Extracts sigma, yara, and merged ioc rules
Tails alerts.json from rustinel logs and forwards encrypted alerts to the backend
Configures rustinel Active Response from the Web UI settings

Requirements

Python 3.11+
hatchling build backend for packaging

Installation

The best way to install agent is by creating a new device inside Radegast EDR Console.

However, for local development or tryout, you can also install this project as a UV tool directly from GitHub:

uv tool install radegast-edr-agent
# or
uv tool install git+https://github.com/radegast-edr/radegast-agent-python

radegast-edr-agent --version

Configuration

The agent uses environment variables prefixed with RADEGAST_AGENT_.

Variable	Default	Description
`RADEGAST_AGENT_BACKEND_URL`	`http://localhost:8000/api/v1`	Backend API URL, including the default `/api/v1` path
`RADEGAST_AGENT_DEVICE_TOKEN`	``	Device token for authenticating to the backend
`RADEGAST_AGENT_RUSTINEL_BINARY`	`./rustinel`	Local path to the `rustinel` binary
`RADEGAST_AGENT_RULES_DIR`	`./rules`	Base directory for extracted rules
`RADEGAST_AGENT_ALERTS_DIR`	`./logs`	Directory containing alert files
`RADEGAST_AGENT_ALERTS_FILENAME`	`alerts.json`	Alert file base name
`RADEGAST_AGENT_SEND_SEVERITY`	`true`	If `true`, parse the severity of the alert and send it unencrypted in the request
`RADEGAST_AGENT_SEND_RULE_ID`	`true`	If `true`, parse `rule.id` from the alert and sends it unencrypted in the request
`RADEGAST_AGENT_SEND_EXCLUDED_BY`	`true`	If `true`, send the exclusion ID for soft exclusions unencrypted in the request
`RADEGAST_AGENT_MAX_LOG_SIZE_MB`	`10`	Maximum size of the rustinel log file in MB before rotation
`RADEGAST_AGENT_MAX_LOG_AGE_DAYS`	`720`	Maximum age of rotated rustinel log archives in days before deletion
`RADEGAST_AGENT_SYNC_INTERVAL`	`300`	Seconds between pack sync checks
`RADEGAST_AGENT_AUTOUPDATE`	`true`	If `true`, enable periodic agent autoupdate from PyPI
`RADEGAST_AGENT_AUTOUPDATE_INITIAL_DELAY`	`300` (5 minutes)	Seconds until first autoupdate check after startup
`RADEGAST_AGENT_AUTOUPDATE_INTERVAL`	`86400` (24 hours)	Seconds between subsequent autoupdate checks
`RADEGAST_AGENT_AUTOUPDATE_DELAY_HOURS`	`96` (4 days)	Hours to wait after a release is published on PyPI before autoupdating
`RADEGAST_AGENT_INIT_WAIT_SECONDS`	`90`	Seconds to wait for backend to re-encrypt exclusions on new key registration
`RADEGAST_AGENT_SIGNING_KEY_PATH`	`${RADEGAST_AGENT_STATE_DIR:-./.radegast-agent}/device_key`	Path to the device signing keypair
`RADEGAST_AGENT_ENCRYPTION_KEY_PATH`	`${RADEGAST_AGENT_STATE_DIR:-./.radegast-agent}/device_enc_key`	Path to the device encryption keypair
`RADEGAST_AGENT_STATE_DIR`	`./.radegast-agent`	Local state directory for manifests, offsets, and the default signing key location
`RADEGAST_AGENT_RUSTINEL_CONFIG`	`config.toml`	Path to the rustinel configuration file to sync active response settings to
`RADEGAST_AGENT_HEALTHCHECK`	`true`	Enable periodic healthcheck probe rule generation and verification
`RADEGAST_AGENT_HEALTHCHECK_INTERVAL`	`60`	Seconds between healthcheck runs
`RADEGAST_AGENT_HEALTHCHECK_TIMEOUT`	`10.0`	Seconds to wait for rustinel alert detection before marking unhealthy
`RADEGAST_AGENT_HEALTHCHECK_RULE_DIR`	`${RADEGAST_AGENT_RULES_DIR:-./rules}/sigma/_healthcheck`	Directory where healthcheck probe Sigma rules are generated

Project layout

radegast_edr_agent/ — application package
- cli.py — main entry point
- config.py — environment-backed config schema
- client.py — backend API client
- packs.py — pack synchronization and extraction
- process.py — subprocess management for rustinel
- tailer.py — alert file tailing and forwarding
- version.py — version reporting and detection utilities
- autoupdate.py — agent autoupdate functionality
tests/ — unit tests
pyproject.toml — package metadata and build config

Testing

Run the test suite with:

uv run pytest

Metadata

Release files for radegast-edr-agent 1.0.1

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for radegast-edr-agent 1.0.1
File	Size	Uploaded
radegast_edr_agent-1.0.1.tar.gz	99.6 kB	Oct 5, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for radegast-edr-agent 1.0.1
File	Interpreter	ABI	Platform	Reset
radegast_edr_agent-1.0.1-py3-none-any.whl 34.6 kB Oct 5, 2026	Python 3	none	any	Details

Total release size: 134.3 kB

Release files / radegast_edr_agent-1.0.1.tar.gz

Download URL	radegast_edr_agent-1.0.1.tar.gz
Size	99.6 kB
Tags	Source
SHA-256 checksum How to use checksums	`9bd3ecf31586ceddb9888d607b9d3da45b156eb7147e9bb167def6038a6b6ef6`
BLAKE2b-256 checksum How to use checksums	`6307fcd5574e010f573dfb17eab2da71edf2952b3296ffaf1c6de99835daaf84`
Upload date	Oct 5, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/radegast-edr/radegast-agent-python
Publishing commit: github.com/radegast-edr/radegast-agent-python/tree/2ee3ae18775ef2024a04207a6165fe3fe913925f

Workflow

Publishing configuration: github.com/radegast-edr/radegast-agent-python/blob/2ee3ae18775ef2024a04207a6165fe3fe913925f/.github/workflows/ci-cd.yml
Publishing logs: github.com/radegast-edr/radegast-agent-python/actions/runs/37269740342/attempts/1

Artifact

Subject: radegast_edr_agent-1.0.1.tar.gz
SHA-256 checksum: 9bd3ecf31586ceddb9888d607b9d3da45b156eb7147e9bb167def6038a6b6ef6 Verifying attestations

Release files / radegast_edr_agent-1.0.1-py3-none-any.whl

Download URL	radegast_edr_agent-1.0.1-py3-none-any.whl
Size	34.6 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`b441dad127b31e164f5ab9f53ead2aae72d303bec7798bb797c041fcd0f275ea`
BLAKE2b-256 checksum How to use checksums	`4b2b00d9fcc498a6227fcb664bddc11ec482137fe98c9297555c5fdfe726c404`
Upload date	Oct 5, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/radegast-edr/radegast-agent-python
Publishing commit: github.com/radegast-edr/radegast-agent-python/tree/2ee3ae18775ef2024a04207a6165fe3fe913925f

Workflow

Publishing configuration: github.com/radegast-edr/radegast-agent-python/blob/2ee3ae18775ef2024a04207a6165fe3fe913925f/.github/workflows/ci-cd.yml
Publishing logs: github.com/radegast-edr/radegast-agent-python/actions/runs/37269740342/attempts/1

Artifact

Subject: radegast_edr_agent-1.0.1-py3-none-any.whl
SHA-256 checksum: b441dad127b31e164f5ab9f53ead2aae72d303bec7798bb797c041fcd0f275ea Verifying attestations