Configuration

Create a configuration file first.

Configuration File

Add the following options to the configuration file:

cadences:
  file-access: 9
  network-peers: 9
  network-flows: 9
  env-vars: 9

In this example, all cadences are set to 9 seconds.

Lower values = More frequent checks = Higher CPU usage
Higher values = Less frequent checks = Lower CPU usage
Default: 9 seconds (balanced performance)

Recommended

• Start with default 9-second intervals
• Run Jibril for at least couple of hours
• Identify Jibril's peak consumption during its cadences
• Depending on workload, cadences might last tens of seconds
• Constant CPU usage means cadences are too short
• Enable detections and adjust cadences accordingly
• Test in staging first!!!

Not Recommended

• Setting all intervals too short
• Using different values without reason
• Not testing after changes

Memory Considerations

Important Relationship

Shorter cadences may require larger caches:

• Less time to process cached data before new data arrives
• Risk of cache overflow if processing takes too long
• Need to maintain more granular behavioral state

Solution: Balance cadence intervals with cache sizes.