Quick Start

By default, Fibratus operates in rule engine mode observing the system activity and alerting when the rule policy is violated. Fibratus sends security alerts to Eventlog or other configurable senders and remmediates threats via response actions. To see Fibratus in action, we can trigger a rule by executing a native Windows binary.

Realtime Detection

To learn more about detection rules, head to rules.

Telemetry Exploration

Detection and Protection is Fibratus' primary operating mode. However, you can access live kernel telemetry by running Fibratus in event forwarder mode as a CLI tool.

!> If Fibratus is already running as Windows Service, stop the service before running the CLI tool.

To gain access to the live kernel telemetry, run the following command from an elevataed terminal.

The argument passed to the run command is a filter expression. You’ll learn more about filters in the upcoming section, but in short, they enable fine-grained inspection of kernel events. In this example, only events generated by the svchost.exe process are accepted and streamed to the output sinks.

Once the command is run, a continuous stream of events is rendered on the console, as shown below. Console is the default output sink, but you can also route the telemetry to Elasticsearch, HTTP or other destinations.

Each individual event line is comprised of the following segments:

• monotonic sequence value
• timestamp of event occurrence and the delta from previous event
• CPU where the event was captured
• process name and the pid that produced the event
• event type
• event parameters

To stop Fibratus CLI, hit the Ctr + C key combination.