Cadence

Cadence is the time interval (in seconds) between each pattern evaluation.

Cadence controls how often Jibril analyzes behavioral data for security threats. Think of it as the "heartbeat" of monitoring—balancing detection speed against system resource use.

How it impacts Jibril's performance?

Cadence settings directly influence overall CPU utilization and cache sizing: shorter intervals enable smaller caches, with more frequent data processing, while longer intervals require larger caches to remember context between checks. Consequently, longer intervals will spread CPU utilization across more time.

How It Works

At every cadence interval (e.g., every 9 seconds), Jibril reviews all collected data for signs of threats.

0s -------- 9s -------- 18s -------- 27s -------- 36s
|           |           |            |            |
Collect     Eval #1     Eval #2      Eval #3      Eval #4

• Collect: Behavioral data is gathered from the system, nonstop.
• Eval: At each interval (example: every 9s), Jibril examines recent and prior data for suspicious patterns.
• Events: If a threat is found, a detection event is generated.
• Policies: Enforcement actions (like blocking) happen instantly, not on a cadence.
• Reactions: Automated responses trigger immediately upon detection.

Every action is observed in real time, but detection and alerts follow the cadence you set.