Rules

Built-in Detection Recipes

Jibril implements most of its detection recipes through rules. These are declarative YAML-based files that define patterns used to match attack patterns. Each rule leverages one or more detection mechanisms to match attack patterns.

Learn To Create Your Own Rules

How Rules Work

Rules are declarative YAML files that specify:

Detection Mechanisms

• file_access
• execution
• network_peers
• env_vars

Detection Breeds

• file_access (file_access, execution)
• remote_cidrs (network_peers)
• remote_domains (network_peers)
• env_vars (env_vars)

Severity levels

• Severity
• Description
• Documentation
• MITRE ATT&CK mappings

Built-in Rules

Jibril ships with comprehensive built-in rules covering the full attack lifecycle, but not all are available as public YAML recipes. Some remain private for competitive advantage.

Enable Rules

To use the rules feature, add it to your configuration file:

features:
  - rules

feature_options:
  rules:
    builtin:
      enabled: true

Rule directories are no longer read

Earlier versions watched directories under /etc/jibril/rules/ through public:, private: and tests: entries carrying a paths: list. Those entries are accepted but ignored, and jibril logs a warning for each one that is enabled. Only the rules built into the binary are loaded.

Deprecated feature name

The feature was named alchemies before it became rules. The old name still loads so existing configurations keep working, but new configurations should use rules.