opseclint 1.0.0

Detection-coverage analyzer for Linux/auditd, Windows/Sysmon, and macOS/Endpoint Security: resolve shell/command actions to ATT&CK techniques, the telemetry they emit, and the detections that would fire.
1
2
3
4
5
6
7
8
9
10
11
12
13
# Build a static (musl) opseclint binary, then ship it in a scratch image.
# opseclint makes no network calls of its own — it only reads the files it
# analyzes — so no shell or CA certificates are needed in the final image.

FROM rust:alpine AS builder
RUN apk add --no-cache musl-dev
WORKDIR /build
COPY . .
RUN cargo build --release --locked

FROM scratch
COPY --from=builder /build/target/release/opseclint /opseclint
ENTRYPOINT ["/opseclint"]