Detections

​

Events Dashboard

​

Event Types

​

Filtering Events

​

By Severity

​

By Environment

• GitHub Actions - CI/CD pipeline events
• Kubernetes - Cluster and pod events
• Docker - Container and host events
• All Environments - Combined view

​

By Time Range

• Last hour - Real-time monitoring
• Last 24 hours - Daily review
• Last 7 days - Weekly analysis
• Custom range - Specific time periods

​

Event Details

​

Core Information

• Timestamp - When the event occurred
• Agent - Which Jibril agent detected it
• Severity - Critical, High, Medium, Low
• Status - New, Investigating, Resolved, False Positive

​

Process Details

• Command - Full command line executed
• PID - Process identifier
• Parent - Parent process information
• User - User context
• Working Directory - Execution path

​

Network Details

• Source IP - Origin of connection
• Destination IP - Target of connection
• Port - Network port used
• Protocol - TCP, UDP, ICMP
• Bytes Transferred - Data volume

​

File Details

• Path - File system location
• Operation - Read, write, delete, execute
• Size - File size
• Hash - SHA256 fingerprint
• Permissions - File access rights

​

Taking Action

​

Mark as False Positive

1. Click “Mark as False Positive”
2. Add optional comment explaining why
3. Event is hidden from future views
4. Similar events auto-marked as safe

​

Create Allowlist Rule

1. Click “Create Allowlist Rule”
2. Choose rule scope:
   • Global - All environments
   • Environment - Specific deployment
   • Agent - Single agent only
3. Define pattern to match
4. Save rule

​

Block Network Destination

1. Click “Block Destination”
2. Choose block scope:
   • Global - All agents
   • Cluster - Kubernetes cluster
   • Agent - Single agent
3. Confirm block action
4. Traffic is immediately blocked

​

Export Event Data

1. Select events to export
2. Choose format: JSON, CSV, PDF
3. Include forensic details
4. Download file

​

Event Analytics

​

Threat Trends

• Volume - Number of events per day
• Types - Most common threat categories
• Sources - Top attacking IPs/domains
• Targets - Most targeted assets

​

Environment Comparison

• Event Frequency - Events per environment
• Severity Distribution - Risk levels
• Response Times - Time to resolution
• False Positive Rates - Detection accuracy

​

Agent Performance

• Detection Rate - Events per agent
• Coverage - Monitored vs total assets
• Health Status - Agent connectivity
• Resource Usage - CPU/memory impact

​

Automation

​

Webhooks

# Configure webhook endpoint
Dashboard → Settings → Notifications → Webhooks

{
  "event_id": "evt_123456",
  "severity": "critical",
  "type": "crypto_mining",
  "agent": "github-runner-01",
  "timestamp": "2024-01-15T10:30:00Z",
  "process": {
    "command": "xmrig -o pool.minexmr.com:4444",
    "pid": 12345,
    "user": "runner"
  },
  "action_taken": "process_killed"
}

​

Slack Integration

1. Create Slack webhook
2. Add webhook URL to Garnet dashboard
3. Choose alert severity levels
4. Test integration

​

SIEM Integration

• Splunk - HTTP Event Collector
• Elasticsearch - Direct indexing
• Azure Sentinel - Log Analytics API
• AWS Security Hub - FindingsGenerator API

​

Best Practices

​

Daily Review

1. Check critical events - Review all critical severity events
2. Triage high events - Investigate high severity within 1 hour
3. Update allowlists - Add legitimate activities to reduce noise
4. Monitor trends - Look for unusual patterns

​

Weekly Analysis

1. Review false positives - Adjust detection rules
2. Analyze attack patterns - Identify recurring threats
3. Update security policies - Strengthen weak areas
4. Performance review - Optimize agent coverage

​

Incident Response

1. Immediate containment - Block threats automatically where possible
2. Investigation - Use forensic details to understand scope
3. Remediation - Remove malware, patch vulnerabilities
4. Lessons learned - Update policies and procedures

​

Troubleshooting

curl http://malicious.test.garnet.ai

​

Next Steps