🎨 Customization

🎯 Tailor Jibril to Your Security Needs

Customize Jibril with powerful automation, dynamic detection rules, and AI-powered analysis. Transform passive monitoring into active defense with programmable responses and intelligent filtering.

🚀 Customization Features

⚡

Reactions

Automated Response System

Program JavaScript or shell-based responses to security events with full access to process management, network policy enforcement, and forensic data collection.

🧪

Alchemies

Dynamic Recipe System

Create custom detection rules in YAML format with hot reload support, built-in validation, and comprehensive pattern matching for file, execution, and network events.

🤖

Attenuator

AI-Powered Analysis

Leverage cutting-edge AI models to analyze security events, reduce false positives, and enrich detections with contextual insights using GPT-4o or local LLMs.

🛡️ Network Policy Feature

🌐 Real-Time Network Control

Jibril's Network Policy feature provides granular control over network traffic through declarative policy definitions. Define and enforce sophisticated traffic policies based on CIDR ranges and domain resolutions, with flexible rule configurations supporting active enforcement and alerting for denied traffic.

🚫 Block Traffic

Block malicious IPs, CIDRs, and entire subnets in real-time.

🌐 Domain Filtering

Prevent access to malicious or policy-violating domains.

🔔 Alert Mode

Generate alerts for policy violations without blocking.

⚡ Enforce Mode

Actively block traffic that violates policies.

📋 Configuration Overview

All customization features are configured through Jibril's main configuration file (config.yaml). Features can be enabled or disabled independently, and each feature supports detailed option configuration:

features:
  - attenuator  # Enable AI-powered analysis
  - alchemies   # Enable custom detection recipes
  - netpolicy   # Enable network policy enforcement
  - detect      # Enable built-in detection recipes

feature_options:
  attenuator:
    enabled: true
    model: gpt-4o
    mode: amend
  alchemies:
    builtin:
      enabled: true
    public:
      enabled: false
      paths:
        - /etc/jibril/alchemies/public
  netpolicy:
    file: /etc/jibril/netpolicy.yaml

🚀 Getting Started

1️⃣

Start with Reactions to automate threat response

2️⃣

Add Alchemies for custom detection rules

3️⃣

Enable Attenuator to filter false positives