​
Product

Jibril = Agent (open source, free)
Garnet Platform = Dashboard to manage agents (paid)You need both for full experience.
Yes, but you won’t get dashboard, alerts, or multi-agent management. Good for single-server testing only.
Similar eBPF approach, but Garnet actively blocks threats, not just detects. Also has managed platform option.
  • Free for 3 agents
  • $49/agent/month for Pro
  • Custom for Enterprise
See pricing →

​
Technical

Linux kernel ≥5.15
# Check yours:
uname -r
<1% CPU overhead, ~50MB RAM per agentDetailed benchmarks →
Yes, ARM64 supported.
No. Requires CAP_BPF + CAP_SYS_ADMIN minimum or privileged: true.
Yes, monitors at kernel level, agnostic to service mesh.
We see connection metadata (IPs, domains, ports) but not payload.

​
Deployment

Kubernetes:
kubectl set image daemonset/jibril \
  jibril=ghcr.io/garnetlabs/jibril:latest \
  -n garnet-system
GitHub Actions:
Update version in workflow file.
No need - one agent monitors entire host.
Kubernetes/Docker will restart it. No events are lost (buffered).
Kubernetes:
helm uninstall jibril -n garnet-system
kubectl delete namespace garnet-system
Docker:
docker stop jibril && docker rm jibril

​
Security

Process metadata, network metadata, file events. No file contents or secrets.See security details →
Yes, SOC 2 Type 2 certified.View report →
  • US (AWS us-east-1) by default
  • EU region available for Enterprise
  • 7 days (Free)
  • 90 days (Pro)
  • Custom (Enterprise)

​
Troubleshooting

This is normal if no threats. Test detection →
Create allowlist at dashboard.garnet.ai/settings/allowlist
Can’t find your answer? Ask in Discord