⚡ Performance

🚀 Optimization Guidelines

Performance considerations and optimization guidelines for creating efficient reactions.

⚙️ Performance Considerations

⚡ Parallel Execution

Multiple reactions run concurrently for optimal performance.

🔧 V8 Compilation

JavaScript reactions are pre-compiled for fast execution.

🔒 Context Isolation

Each reaction runs in its own isolated environment.

🧹 Memory Management

Automatic cleanup of reaction contexts.

🛡️ Resource Limits

Built-in safeguards prevent resource exhaustion.

✅ Best Practices for Performance

1. ⚡ Keep reactions lightweight - Avoid complex computations
2. 💾 Use the data store efficiently - Don't store large objects
3. 📁 Minimize file I/O - Only write essential data
4. ⚠️ Handle errors gracefully - Don't let failed reactions impact others
5. 🧪 Test thoroughly - Validate reactions before production deployment

💡 Example: Optimized Reaction

Example of a performance-optimized reaction:

reactions:
  - format: js
    code: |
      function process(data) {
        // Fast path for common cases
        if (!data.process || !data.process.cmd) {
          return; // Exit early if no process data
        }

        // Efficient data access
        let cmd = data.process.cmd;
        let isHighRisk = cmd.includes("wget") || cmd.includes("curl");

        if (isHighRisk) {
          // Only log essential information
          Info("High-risk process: " + cmd);

          // Use efficient data store operations
          let count = parseInt(DataGet("risk_count") || "0") + 1;
          DataSet("risk_count", String(count));

          // Take action only when necessary
          if (count > 5) {
            NetBlockIp();
          }
        }
      }

In a detection system, distinguishing between what belongs in the reaction phase and what should be part of the detection logic is crucial. Think of reactions as an extension of Jibril: they encompass scripts that collect, analyze, interpret, and act on data-similar to the Jibril detection mechanism.

Key Points

• Jibril Detection Mechanism
  Optimized for enhanced results, efficient caching, and additional functionalities.
• Reaction Logic
  Should focus on responding to events, without being responsible for filtering or decision-making, which is handled by arbitraries or specific detection features.

Remember: Jibril detection mechanisms are faster and optimized. This makes the use of reactions logic, such as showed above, targeted to fine-grained business logic (and not to replace it).