Full Example Configuration

Copy and paste this as your default initial configuration file.

Secure the Configuration

Remember to always secure the configuration file.

sudo chmod 600 /etc/jibril/config.yaml
sudo chown root:root /etc/jibril/config.yaml

It contains information such as the API token or LLM API keys.

Complete Configuration

#### jibril standalone config file.

run_time:
  log-level: info # debug, info, warn, error, fatal, panic, none, quiet, trace
  health: true # enable health check endpoint (:6060/health)
  cardinal: true # enable cardinal filters (skips some well known os resources)
  stdout: stdout # stdout file (stdout, stderr, or a file path)
  stderr: stderr # stderr file (stdout, stderr, or a file path)
  # api:
  #   # Register and get a token at https://dashboard.garnet.ai/.
  #   token: your-token-here

#### cadences.

# cadences are the intervals at which patterns are detected.
# https://jibril.garnet.ai/config/cadences/

cadences:
  file-access: 9
  network-peers: 9
  network-flows: 9

#### caches.

# caches are both the kernel maps and the in-memory caches for os resources.
# https://jibril.garnet.ai/config/caches/

caches:
  rec-tasks: 32
  tasks: 64
  cmds: 32
  files: 32
  dirs: 16
  bases: 32
  task-file: 32
  file-task: 32
  task-ref: 32
  flows: 32
  task-flow: 32
  flow-task: 32
  flow-ref: 32

#### functionalities.

functionalities:
  - jibril # core jibril functionality (required).

#### features.

features:
  - hold # hold agent execution until ctrl+c (or SIGINT).
  - procfs # enrich running tasks with procfs info at startup.
  - detect # enable the detection feature.
  - rules # load the built-in detection rules (see below).
  - enricher # enrich events with container information.
  # - network # report network flows, needed by the flow event.
  # - profile # report the behavioural profile, needed by the profile event.
  # - transformers # transform events before persisting/printing.
  # - attenuator # AI-powered event and noise reduction.
  # - policy # enforce network policy using netpolicy.yaml.

feature_options:
  # related feature must be enabled
  policy:
    file: /etc/jibril/netpolicy.yaml
  transformers:
    scoring: false
  # attenuator:
  #   enabled: true
  #   url: https://api.openai.com/v1/chat/completions
  #   port: 443
  #   model: gpt-5
  #   temp: 1
  #   mode: reason
  rules:
    # enable all built-in detection rules.
    builtin:
      enabled: true

#### events.

events:
  types:
    # informational events about network policy applied.
    # - dropip
    # informational events about network flows.
    # - flow
    # informational event about behavioral profiling.
    # - profile
    # detection recipes for file access patterns.
    # - file_example
    - auth_logs_tamper
    - binary_self_deletion
    - capabilities_modification
    - code_modification_through_procfs
    - core_pattern_access
    # - cpu_fingerprint
    - credentials_files_access
    - crypto_miner_files
    - environ_read_from_procfs
    # - filesystem_fingerprint
    - global_shlib_modification
    # - java_debug_lib_load
    # - java_instrument_lib_load
    # - machine_fingerprint
    # - os_fingerprint
    # - os_network_fingerprint
    # - os_status_fingerprint
    # - package_repo_config_modification
    - pam_config_modification
    # - sched_debug_access
    - shell_config_modification
    # - ssl_certificate_access
    - sudoers_modification
    # - sysrq_access
    - unprivileged_bpf_config_access
    # detection recipes for execution patterns.
    # - exec_example
    # - binary_executed_by_loader
    - code_on_the_fly
    - credentials_text_lookup
    - crypto_miner_execution
    - data_encoder_exec
    - denial_of_service_tools
    - exec_from_unusual_dir
    # - file_attribute_change
    - hidden_elf_exec
    - interpreter_shell_spawn
    - net_filecopy_tool_exec
    - net_mitm_tool_exec
    - net_scan_tool_exec
    - net_sniff_tool_exec
    - net_suspicious_tool_exec
    # - passwd_usage
    - runc_suspicious_exec
    # - webserver_exec
    - webserver_shell_exec

  # where events are written. a name per output, so several of the same type
  # can coexist. only restricts an output to some event types.
  outputs:
    - name: console
      type: stdout
      format: json
    - name: audit
      type: file
      path: /var/log/jibril.out
      format: jsonl
    # - name: profile_summary
    #   type: file
    #   path: /var/log/jibril.profile.md
    #   format: markdown
    #   only: [profile]