CLI

run

The primary command for starting Fibratus-whether running the rule engine, operating as an event forwarder, or executing a filament. It also accepts an optional filter expression. Examples:

  1. Collect all events
$ fibratus run --forward
  1. Run a filament
$ fibratus run -f watch_files
  1. Collect and filter events
$ fibratus run --forward evt.category = 'file' and ps.name = 'cmd.exe'

capture

Writes the event stream to capture files. It accepts an optional filter expression. Example:

$ fibratus capture evt.category = 'net' and net.dip=172.17.2.3 -o events

replay

Reconstructs the event stream from the capture file. It accepts an optional filter expression. Example:

$ fibratus replay net.sip=172.2.2.3 -k events

rules

The root command that exposes various subcommands for listing/validating rules and creating detection rule templates.

List all rules located in the Rules directory.

Validates rules for structural and syntactic correctness.

Create a new rule template. The command requires a rule name and an optional MITRE tactic identifier, for example TA0001, that can be passed via the --tactic-id flag.

config

Prints the options loaded from configuration sources including files, command line flags or environment variables. Sensitive data, such as passwords are masked out.

service

This is the root command that exposes multiple subcommands for interacting with the Windows Service Control Manager.

Starts the Fibratus service that previously registered with the Windows Service Control Manager.

Stops the Fibratus Windows service.

Restarts the Fibratus Windows service.

Removes the Fibratus service from the Windows Service Control Manager.

Checks the status of the Fibratus Windows service.

docs

Launches the default web browser and opens the Fibratus documentation site.

list

The command consists of various subcommands to list available filaments, event types or filter fields.

Displays available filaments. Filaments live in the %PROGRAMFILES\Fibratus\Filaments directory, but you can override this location with the --filament.path flag or the corresponding key in the yaml configuration file.

Shows all field names that can be used in rule conditions.

Shows available event types.

stats

Returns the runtime metrics that are exposed through the expvar HTTP endpoint. Useful for debugging.

version

Displays the Fibratus version along with the commit hash and the Go compiler version.

help

Displays detailed usage information for commands, including available flags and options.