Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Getting Started

Requirements

  • Rust 1.87+ (for building from source)
  • Linux 5.13+ (Landlock v1 support for sandtrace run)
  • Linux 5.3+ (PTRACE_GET_SYSCALL_INFO for sandtrace run)

sandtrace audit, sandtrace scan, and sandtrace watch work on any Linux kernel. The kernel version requirements above only apply to the sandtrace run sandbox.

Install

cargo build --release
cp target/release/sandtrace ~/.cargo/bin/

Initialize

sandtrace init

This creates ~/.sandtrace/ with default configuration and rules:

FilePurpose
config.tomlGlobal settings — redaction markers, custom patterns, thresholds
rules/credential-access.yml14 credential file monitoring rules
rules/supply-chain.yml4 supply-chain attack detection rules
rules/exfiltration.ymlData exfiltration detection rules

Use sandtrace init --force to overwrite existing files.

Quick examples

Audit a project for secrets

sandtrace audit ./my-project

Scan your home directory for obfuscation

sandtrace scan

Watch credential files

sandtrace watch --alert desktop

Sandbox an npm install

sandtrace run --allow-path ./project --output trace.jsonl npm install

Generate SARIF for GitHub Code Scanning

sandtrace audit ./my-project --format sarif > sandtrace.sarif