# rabbitstack/fibratus architecture

> Architecture diagram of the GitHub repository rabbitstack/fibratus, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/rabbitstack/fibratus
- Repository: https://github.com/rabbitstack/fibratus

## Overview

Fibratus is a Windows security sensor that observes system activity, evaluates events for threats, and can respond or route telemetry for analysis. Its principal runtime path is ETW capture, event processing, rule evaluation, then alerting and output; capture files and Python filaments provide forensic and extension branches. The README also identifies YARA memory scanning and protection as product capabilities. Source excerpts confirm selected rule, output-worker, API, and service behavior; other subsystem links rely on the README and repository structure, so uncertain wiring is omitted.

Main entry points: [`pkg/event`](https://github.com/rabbitstack/fibratus/tree/master/pkg/event) (Event model), [`pkg/rules/engine.go`](https://github.com/rabbitstack/fibratus/blob/master/pkg/rules/engine.go) (Rule engine), [`internal/bootstrap/bootstrap.go`](https://github.com/rabbitstack/fibratus/blob/master/internal/bootstrap/bootstrap.go) (Application bootstrap), [`internal/etw`](https://github.com/rabbitstack/fibratus/tree/master/internal/etw) (ETW event source)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Sensor runtime"]
  node_bootstrap["Application bootstrap<br/>[bootstrap.go]"]
  node_etw["ETW event source"]
  node_processors["Event processors"]
  node_events["Event model"]
end

subgraph group_detection["Threat detection"]
  node_rules["Rule engine<br/>[engine.go]"]
  node_filters["Filter language"]
  node_yara["YARA scanner<br/>[scanner.go]"]
  node_actions["Threat actions"]
  node_memory["Process memory"]
end

subgraph group_telemetry["Telemetry and forensics"]
  node_aggregator["Event aggregation<br/>[aggregator.go]"]
  node_outputs["Output clients"]
  node_capture["Capture files"]
  node_replay["Capture replay<br/>[replay_windows.go]"]
end

subgraph group_extensions["Interfaces and extensions"]
  node_filaments["Python filaments"]
  node_api["HTTP API<br/>[server.go]"]
end

subgraph group_operations["Configuration and operations"]
  node_config["Configuration"]
  node_cli["CLI commands<br/>[root.go]"]
  node_service["Windows service"]
end

node_operator(("Operator"))
node_windows(("Windows system"))
node_sinks(("External sinks"))

node_operator -->|"invokes"| node_cli
node_cli -->|"starts sensor"| node_bootstrap
node_service -->|"starts sensor"| node_bootstrap
node_config -->|"configures"| node_bootstrap
node_windows -->|"provides events"| node_etw
node_etw -->|"dispatches events"| node_processors
node_processors -->|"produces events"| node_events
node_events -->|"evaluated by"| node_rules
node_rules -->|"compiles conditions"| node_filters
node_rules -->|"dispatches matches"| node_actions
node_rules -.->|"uses scanning"| node_yara
node_yara -->|"scans memory"| node_memory
node_events -->|"batches events"| node_aggregator
node_aggregator -->|"publishes batches"| node_outputs
node_outputs -->|"sends telemetry"| node_sinks
node_events -->|"writes capture"| node_capture
node_capture -->|"reads capture"| node_replay
node_events -.->|"exposes events"| node_filaments
node_operator -->|"queries"| node_api
node_api -->|"serves config"| node_config

click node_bootstrap "https://github.com/rabbitstack/fibratus/blob/master/internal/bootstrap/bootstrap.go"
click node_config "https://github.com/rabbitstack/fibratus/tree/master/pkg/config"
click node_etw "https://github.com/rabbitstack/fibratus/tree/master/internal/etw"
click node_processors "https://github.com/rabbitstack/fibratus/tree/master/internal/etw/processors"
click node_events "https://github.com/rabbitstack/fibratus/tree/master/pkg/event"
click node_rules "https://github.com/rabbitstack/fibratus/blob/master/pkg/rules/engine.go"
click node_filters "https://github.com/rabbitstack/fibratus/tree/master/pkg/filter"
click node_yara "https://github.com/rabbitstack/fibratus/blob/master/pkg/yara/scanner.go"
click node_actions "https://github.com/rabbitstack/fibratus/tree/master/pkg/rules/action"
click node_aggregator "https://github.com/rabbitstack/fibratus/blob/master/pkg/aggregator/aggregator.go"
click node_outputs "https://github.com/rabbitstack/fibratus/tree/master/pkg/outputs"
click node_capture "https://github.com/rabbitstack/fibratus/tree/master/pkg/cap"
click node_replay "https://github.com/rabbitstack/fibratus/blob/master/cmd/fibratus/app/replay/replay_windows.go"
click node_filaments "https://github.com/rabbitstack/fibratus/tree/master/pkg/filament"
click node_api "https://github.com/rabbitstack/fibratus/blob/master/pkg/api/server.go"
click node_cli "https://github.com/rabbitstack/fibratus/blob/master/cmd/fibratus/app/root.go"
click node_service "https://github.com/rabbitstack/fibratus/blob/master/cmd/fibratus/app/service/control_service_windows.go"
click node_memory "https://github.com/rabbitstack/fibratus/blob/master/pkg/ps/snapshotter_windows.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_bootstrap,node_etw,node_processors,node_events toneBlue
class node_rules,node_filters,node_yara,node_actions,node_memory toneAmber
class node_aggregator,node_outputs,node_capture,node_replay toneMint
class node_filaments,node_api toneRose
class node_config,node_cli,node_service,node_operator,node_windows,node_sinks toneIndigo
```

## Components

### Sensor runtime

- [Application bootstrap](https://github.com/rabbitstack/fibratus/blob/master/internal/bootstrap/bootstrap.go): `internal/bootstrap/bootstrap.go`
- [ETW event source](https://github.com/rabbitstack/fibratus/tree/master/internal/etw): `internal/etw`
- [Event processors](https://github.com/rabbitstack/fibratus/tree/master/internal/etw/processors): `internal/etw/processors`
- [Event model](https://github.com/rabbitstack/fibratus/tree/master/pkg/event): `pkg/event`

### Threat detection

- [Rule engine](https://github.com/rabbitstack/fibratus/blob/master/pkg/rules/engine.go): `pkg/rules/engine.go`
- [Filter language](https://github.com/rabbitstack/fibratus/tree/master/pkg/filter): `pkg/filter`
- [YARA scanner](https://github.com/rabbitstack/fibratus/blob/master/pkg/yara/scanner.go): `pkg/yara/scanner.go`
- [Threat actions](https://github.com/rabbitstack/fibratus/tree/master/pkg/rules/action): `pkg/rules/action`
- [Process memory](https://github.com/rabbitstack/fibratus/blob/master/pkg/ps/snapshotter_windows.go): `pkg/ps/snapshotter_windows.go`

### Telemetry and forensics

- [Event aggregation](https://github.com/rabbitstack/fibratus/blob/master/pkg/aggregator/aggregator.go): `pkg/aggregator/aggregator.go`
- [Output clients](https://github.com/rabbitstack/fibratus/tree/master/pkg/outputs): `pkg/outputs`
- [Capture files](https://github.com/rabbitstack/fibratus/tree/master/pkg/cap): `pkg/cap`
- [Capture replay](https://github.com/rabbitstack/fibratus/blob/master/cmd/fibratus/app/replay/replay_windows.go): `cmd/fibratus/app/replay/replay_windows.go`

### Interfaces and extensions

- [Python filaments](https://github.com/rabbitstack/fibratus/tree/master/pkg/filament): `pkg/filament`
- [HTTP API](https://github.com/rabbitstack/fibratus/blob/master/pkg/api/server.go): `pkg/api/server.go`

### Configuration and operations

- [Configuration](https://github.com/rabbitstack/fibratus/tree/master/pkg/config): `pkg/config`
- [CLI commands](https://github.com/rabbitstack/fibratus/blob/master/cmd/fibratus/app/root.go): `cmd/fibratus/app/root.go`
- [Windows service](https://github.com/rabbitstack/fibratus/blob/master/cmd/fibratus/app/service/control_service_windows.go): `cmd/fibratus/app/service/control_service_windows.go`

### Other components

- **Operator**
- **Windows system**
- **External sinks**

## Connections

- Operator → CLI commands: invokes
- CLI commands → Application bootstrap: starts sensor
- Windows service → Application bootstrap: starts sensor
- Configuration → Application bootstrap: configures
- Windows system → ETW event source: provides events
- ETW event source → Event processors: dispatches events
- Event processors → Event model: produces events
- Event model → Rule engine: evaluated by
- Rule engine → Filter language: compiles conditions
- Rule engine → Threat actions: dispatches matches
- Rule engine → YARA scanner: uses scanning
- YARA scanner → Process memory: scans memory
- Event model → Event aggregation: batches events
- Event aggregation → Output clients: publishes batches
- Output clients → External sinks: sends telemetry
- Event model → Capture files: writes capture
- Capture files → Capture replay: reads capture
- Event model → Python filaments: exposes events
- Operator → HTTP API: queries
- HTTP API → Configuration: serves config