Command Line

Check out Jibril's public recipes repository at https://github.com/garnet-org/jibril-balag.

Obtain Jibril binaries

$ sudo curl -L -o /usr/bin/jibril https://bit.ly/3FLyV1x

$ sudo chmod +x /usr/bin/jibril

$ /usr/bin/jibril --version

Run Jibril using command line

All configuration flags can be given to Jibril through command line. Example:

$ sudo -E jibril \
        --log-level info \
        --extension example \
        --plugin example:helloworld \
        --extension config \
        --extension data \
        --extension jibril \
        --plugin jibril:hold \
        --printer jibril:printers:stdout \
        --printer jibril:printers:varlog

This command does not show practical results, it is meant to show how Jibril can be executed. It runs the loader (binary named jibril), enables the example, config, data and jibril extensions, the helloworld plugin from the example extension, the hold plugin from the jibril extension, and the datakeeper and varlog printers from the jibril extension.

Find more information about components.

Select specific components

Jibril footprint can be minimized based on the amount of enabled components. Example:

$ sudo -E jibril \
        --log-level info \
        --extension config \
        --extension data \
        --extension jibril \
        --plugin jibril:detect \
        --event jibril:detect:net_sniff_tool_exec \
        --printer jibril:printers:stdout

Jibril will detect the execution of network sniffers and print the events to the stdout.

This command runs the loader (binary named jibril), enables the config, data and jibril extensions, the detect plugin from the jibril extension, the net_sniff_tool_exec event from the detect plugin, and the stdout printer from the jibril extension.