Output

Where events go. Outputs belong to the events, not to the features, and each one is a named instance so that several of the same type can coexist.

Renamed

printers: and printer_options: no longer exist, and output names are no longer features. A configuration still carrying either key fails to load rather than being ignored. The daemon's own logs are a separate concern and are configured under run_time:.

Configuration

events:
  types:
    - flow
    - profile

  outputs:
    - name: console
      type: stdout
      format: json

    - name: audit
      type: file
      path: /var/log/jibril.out
      format: jsonl

    - name: profile_summary
      type: file
      path: /var/log/jibril.profile.md
      format: markdown
      only: [profile]

    - name: garnet-ai
      type: garnet

Field	Required	Values	Notes
name	yes	unique	Identifies the instance, and appears in the logs
type	yes	stdout, file, garnet, void
path	for file	a path	Rejected on other types
format	no	json, jsonl, markdown	Defaults to json; rejected on garnet and void
only	no	event type names	Empty means every event

A field that does not apply to its type is refused at load rather than ignored, so a configuration that cannot do what it says never starts.

Leaving only out

An output without only receives every event, including the profile. There is no filtering anywhere else: the dispatcher hands each event to every output, and only is the one thing that narrows it. An empty only: [] reads the same as leaving it out. To stop an output receiving anything, remove the output.

Formats

format	Written
json	Beautified, and coloured when the destination is a terminal
jsonl	One event per line, for log collectors
markdown	The profile summary, which needs only: [profile]

Types

stdout

Events to standard output, captured by docker or systemd. Takes no path.

Use cases

• Docker containers
• Systemd services
• Container orchestration platforms (Kubernetes)
• Log aggregation systems (ELK, Splunk)

file

Events to a file on disk. path is required.

- name: audit
  type: file
  path: /var/log/jibril.out
  format: jsonl

Environment override

JIBRIL_OUTPUT_<NAME>_PATH moves one output's file, with the name uppercased and dashes turned into underscores. For the instance above that is JIBRIL_OUTPUT_AUDIT_PATH. Used where the configuration file cannot be edited.

File permissions

sudo mkdir -p /var/log
sudo touch /var/log/jibril.out
sudo chown jibril:jibril /var/log/jibril.out

Log rotation

# /etc/logrotate.d/jibril
/var/log/jibril.out {
    daily
    rotate 7
    compress
    delaycompress
    missingok
    notifempty
    create 0644 jibril jibril
}

garnet

Posts events to Garnet Dashboard. Takes neither path nor format.

Requirements

• Valid Garnet API configuration
• Network connectivity to Garnet API
• Project with dashboard access

API token vs the garnet output

• API token — agent registration and authentication
• A garnet output — event forwarding to the dashboard

The API token is always needed for registration and authentication. A garnet output is not, unless events should reach the dashboard.

void

Discards everything. Testing only.

- name: sink
  type: void

Warning: Do not use in production. Events will be lost.

The profile

The profile is one event with more than one useful rendering, so it is written by ordinary outputs restricted to it:

features:
  - profile

events:
  types:
    - profile
  outputs:
    - name: profile_summary
      type: file
      path: /var/log/jibril.profile.md
      format: markdown
      only: [profile]
    - name: profile_json
      type: file
      path: /var/log/jibril.profile.json
      format: json
      only: [profile]

TIP

The profile also reaches any output without an only, as an ordinary event. These two are extra renderings, not the only way to see it.

Several outputs

Outputs are independent, and two of the same type differ only by name:

events:
  outputs:
    - name: console
      type: stdout
    - name: audit
      type: file
      path: /var/log/jibril.out
      format: jsonl
    - name: detections_only
      type: file
      path: /var/log/jibril.detections.out
      format: jsonl
      only: [binary_self_deletion, hidden_elf_exec]
    - name: garnet-ai
      type: garnet