I’m pleased to announce the first production-ready release of Fibratus. The tool is now available via the pip package manager by typing pip install fibratus (the C compiler is required to build the kernel stream collector). The multiprocessing and Python serialization don’t play well together when compiled with nuitka. Until I figure out how to make it work I’ll not ship the compiled versions of Fibratus.
What’s new
There are a bunch of new features and bug fixes in this release:
- filament’s execution model allows scheduling the execution of the filament in a new process
- streaming kernel events via output adapters (SMTP and AMQP are supported)
- yaml based configuration file
- interval based scheduling inside the filaments
- writing to console using the standard Windows API
- asciiart package to group the common table drawing functionality
- shipping new filaments (
top_in_packets,top_out_packets,top_hives_io) - resolve filaments directory from the environment variable
--no-enum-handlescommand line flag to disable the system handles enumeration- setuptools script for building the Fibratus distribution
- hosting Fibratus on PyPi
- check for the kernel event filters when calling the
processmethod on filament - initialize the kernel event parameters when hive or key does not satisfy the condition in
RegSetValueorRegQueryValue - fixed style violations and code smells
- migrated from coveralls to codecov platform
- improved code coverage
- code refactoring and comments
If you have any feedback, you can reach out via Github or drop me an email.