How rabbitstack/fibratus works
Fibratus is a Windows security sensor that observes system activity, evaluates events for threats, and can respond or route telemetry for analysis. Its principal runtime path is ETW capture, event processing, rule evaluation, then alerting and output; capture files and Python filaments provide forensic and extension branches. The README also identifies YARA memory scanning and protection as product capabilities. Source excerpts confirm selected rule, output-worker, API, and service behavior; other subsystem links rely on the README and repository structure, so uncertain wiring is omitted.
Main entry points: event Event model · engine.go Rule engine · bootstrap.go Application bootstrap · etw ETW event source
Components 21
Sensor runtime
- Application bootstrap
internal/bootstrap/bootstrap.go - ETW event source
internal/etw - Event processors
internal/etw/processors - Event model
pkg/event
Threat detection
- Rule engine
pkg/rules/engine.go - Filter language
pkg/filter - YARA scanner
pkg/yara/scanner.go - Threat actions
pkg/rules/action - Process memory
pkg/ps/snapshotter_windows.go
Telemetry and forensics
- Event aggregation
pkg/aggregator/aggregator.go - Output clients
pkg/outputs - Capture files
pkg/cap - Capture replay
cmd/fibratus/app/replay/replay_windows.go
Interfaces and extensions
- Python filaments
pkg/filament - HTTP API
pkg/api/server.go
Configuration and operations
- Configuration
pkg/config - CLI commands
cmd/fibratus/app/root.go - Windows service
cmd/fibratus/app/service/control_service_windows.go
Other components
- Operator
- Windows system
- External sinks
Connections 20
- Operator → CLI commands: invokes
- CLI commands → Application bootstrap: starts sensor
- Windows service → Application bootstrap: starts sensor
- Configuration → Application bootstrap: configures
- Windows system → ETW event source: provides events
- ETW event source → Event processors: dispatches events
- Event processors → Event model: produces events
- Event model → Rule engine: evaluated by
- Rule engine → Filter language: compiles conditions
- Rule engine → Threat actions: dispatches matches
- Rule engine → YARA scanner: uses scanning
- YARA scanner → Process memory: scans memory
- Event model → Event aggregation: batches events
- Event aggregation → Output clients: publishes batches
- Output clients → External sinks: sends telemetry
- Event model → Capture files: writes capture
- Capture files → Capture replay: reads capture
- Event model → Python filaments: exposes events
- Operator → HTTP API: queries
- HTTP API → Configuration: serves config