fibratus.io valid

Fibratus

Runtime threat detection, protection, and eradication for Windows.

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-26T04:46:24.282Z. Cached copy · Source on fibratus.io

# Fibratus

> Runtime threat detection, protection, and eradication for Windows.

Fibratus is an open-source security engine that captures kernel-level telemetry via ETW (Event Tracing for Windows) and analyzes it using behavior-driven detection rules and YARA memory scanning. It detects, blocks, and eradicates advanced adversary tradecraft in real time.

## Pages

- [Home](/): Runtime threat detection, protection, and eradication for Windows.
- [How It Works](/how-it-works): Architecture and execution model end-to-end.
- [Kernel Runtime Security](/kernel-runtime-security): Kernel-level event capture via ETW.
- [Behavioral Detection](/behavioral-detection): Behavior-driven rules over kernel telemetry.
- [Detection Engineering](/detection-engineering): Author, test, and ship detections.
- [Product Overview](/product/overview): Product capabilities and components.
- [Extensibility](/product/extensibility): Filaments, outputs, and custom logic.
- [Downloads](/downloads): Download the latest Fibratus release.
- [Roadmap](/roadmap): Upcoming features and direction.
- [Changelog](/changelog): Release notes and version history.
- [Detection Rules](/rules): Library of behavioral detection rules.
- [Documentation](https://docs.fibratus.io): Setup, configuration, and reference.
- [Glossary](/glossary): Windows internals and detection terminology.
- [Blog](/blog): Research, detection notes, and engineering posts.
- [About / Mission](/about/mission): Why Fibratus exists.
- [Team](/about/team): Engineers and contributors.
- [Open Source](/about/open-source): Apache 2.0 licensing and contribution.
- [Contact](/contact): Get in touch.

## Key Facts

- License: Apache 2.0
- Language: Go
- Platform: Windows 10, Windows 11, Windows Server
- Creator: Nedim Šabić (@rabbitstack)
- GitHub: https://github.com/rabbitstack/fibratus
- Website: https://fibratus.io

## Core Capabilities

- Kernel-level event capture via ETW (process, thread, file, registry, network, memory, handle, driver, image load)
- Behavior-driven detection rules in YAML with MITRE ATT&CK mapping
- YARA memory scanning for in-memory threat detection
- Live process tree with ancestry tracking and execution context
- Sequence-based rules for multi-stage attack correlation
- Automated threat blocking and process termination
- Python-based filament plugins for custom logic and integrations
- Output sinks: Elasticsearch, AMQP/RabbitMQ, HTTP webhooks, Windows Event Log

## Architecture

Fibratus operates entirely in user-space (no kernel driver required). Events flow through a pipeline: collection → enrichment → rule evaluation → response/output. The enrichment stage maintains a live process tree, correlates events with process ancestry, loaded modules, and handles.

## Documentation

- Getting Started: https://docs.fibratus.io/setup/installation
- Detection Rules: https://docs.fibratus.io/filters-and-rules
- CLI Reference: https://docs.fibratus.io/cli
- Outputs: https://docs.fibratus.io/outputs
- Filaments
…

Related sites

Explore similar publishers →

Category suggestions: other listed sites in Cybersecurity. These share a category. See the whole category →

Machine-readable: GET /v1/resolve?q=fibratus.io · GET /v1/domain/fibratus.io · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for fibratus.io:
1. POST https://agentwebmap.com/v1/sites/fibratus.io/claims and keep claim_id and claim_secret private.
2. Publish the verification line "AgentWebMap verification: <token>" (token from step 1) in https://fibratus.io/llms.txt, or use the DNS, meta-tag or well-known method the response describes. This only verifies the listing; your website and domain remain yours.
3. POST https://agentwebmap.com/v1/sites/fibratus.io/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/fibratus.io).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.