Joined 2 years ago
Jibril is a cutting-edge runtime monitoring and threat detection engine, designed to deliver real-time insights with minimal impact on system performance. Powered by eBPF, it remains efficient even under heavy event loads exceeding hundreds of thousands of events per second–delivering real-time protection for modern environments from dev to prod. Jibril's query-driven eBPF approach, unlike traditional event-streaming models, collects kernel behavioral data with minimal overhead, eliminating performance bottlenecks while maintaining monitoring integrity.
## Read more:
The 3rd Generation EDR with in-depth context: - https://jibril.garnet.ai/jibril/readme/new-era
Why Jibril out performs other runtime engines: - https://jibril.garnet.ai/jibril/readme/theory-behind
## Give it a try:
Command Line - https://jibril.garnet.ai/jibril/installation/command-line
Systemd service - https://jibril.garnet.ai/jibril/installation/systemd-service
Docker Container - https://jibril.garnet.ai/jibril/installation/docker-containe...
Kubernetes - https://jibril.garnet.ai/jibril/installation/kubernetes
## Features
Create your own detection recipes (Alchemies) using YAML - https://jibril.garnet.ai/jibril/components/alchemies/create-...
Reduce false positives using The Attenuator (powered by AI) - https://jibril.garnet.ai/jibril/components/attenuator
Block network using the network policy - https://jibril.garnet.ai/jibril/components/network-policy
## Repositories
Find our public repositories - https://jibril.garnet.ai/jibril/installation/repositories
Unmarshal detection events using the public types package - https://github.com/garnet-org/jibril-ashkaal
Find & Share public detection recipes - https://github.com/garnet-org/jibril-wahy
Jibril (https://jibril.garnet.ai/) is a free runtime monitoring and threat detection tool for Linux, designed for development, CI/CD, and production environments. It captures system activity - processes, files, network connections, users - with high precision and low overhead, processing hundreds of thousands of events per second. Installation takes under 5 minutes, and it integrates with GitHub Actions for CI/CD or Kubernetes for cluster monitoring.
## Introduction
Jibril delivers real-time visibility into system behavior, detecting threats like unauthorized executions, file tampering, or network anomalies. Its modular design, driven by a centralized configuration file, balances flexibility and performance, scaling from single systems to enterprise deployments. It provides comprehensive telemetry with tamper-evident logs, ensuring reliable security insights.
## Features
- *Attenuator*: Filters security events using private & public LLM models in order to reduce false-positives noise. Analyzes events for context, like process ancestry or executable paths, and deduplicates repetitive alerts. Useful for prioritizing alerts in automated pipelines. - *Alchemies*: Custom detection rules framework. Users can create "detection recipes" to define specific monitoring conditions, e.g., file access patterns or network activity. Includes built-in recipes and supports enabling/disabling rules on-demand for tailored security. - *Cache Configurations*: Manages memory for event storage. Users set cache sizes via config files to handle large event volumes, preventing performance degradation in high-load environments. - *Cadence Configurations*: Controls timing of operations, like event polling or cache updates. Adjusts frequency to balance responsiveness and resource usage, ensuring efficient monitoring in real-time. - *Network Policies*: Enables blocking of network connections based on domains or IP CIDRs. Provides a complete view of remote peers per process, linking detections to corresponding peers with full DNS resolution paths. Groups all processes communicating with the same remote node and flags detections for each entry. - *High Event Load Handling*: Processes hundreds of thousands of events per second with minimal performance impact, leveraging eBPF’s efficiency and a so called 3rd-generation EDR architecture.
## More information
https://jibril.garnet.ai/ https://jibril.garnet.ai/jibril/installation/systemd-service https://jibril.garnet.ai/jibril/installation/command-line https://jibril.garnet.ai/jibril/installation/docker-containe... https://jibril.garnet.ai/jibril/installation/kubernetes
