Events

Events are enabled explicitly under events.types in the configuration file.

Event Categories

Jibril supports multiple categories of events.

Each event corresponds to:

• A detection recipe.
• An informative event.

Informative events

Informative events provide context and operational visibility. These events are not necessarily security findings, they are useful for debugging, auditing, and understanding runtime behavior.

• flow: info about network flows.
• profile: info about aggregated behavior.
• dropip: info about network policy applied.

Configuration

events:
  types:
    # info events about network policy applied.
    - dropip

    # info events about network flows.
    - flow
    # info events about aggregated behavior.
    - profile

    # detection recipes.
    - auth_logs_tamper
    - binary_self_deletion
    - crypto_miner_execution

Former list form

events: used to be a plain list of event names. It is now a block holding types, options and outputs, and a configuration still using the list form fails to load.

Routing

Generated events are dispatched to the configured Outputs.

Event Dispatch

They are distinct from Jibril stdout and stderr logs, which are intended for operational logging and debugging of Jibril itself. Events can be routed to stdout if desired, but this is done by the stdout Printer, not by default.