YARA management¶
YARA integrates with Zeek on Corelight Sensors, providing YARA rules embedded into workflows, and eliminating the need to build additional processes and connect multiple tools. This provides end-to-end file extraction, inspection, and alerting capabilities without the need to maintain additional monitoring systems.
YARA prerequisites¶
Fleet Manager 28.1 or later
A Corelight Sensor or Software Sensor running 28.1 or later
A YARA feature license.
YARA management settings¶
yara_management: yara_file_cleanup: true max_yara_file_age: 24
Every time a new YARA file is generated, a copy of the file with the current timestamp is also created. The settings yara_file_cleanup
and max_yara_file_age
(in hours) control the retention of the timestamped copies.
Add YARA source¶
A YARA source is a YARA file (.yara or .yar) that contains YARA rules. One or more source files make up a YARA ruleset.
Corelight-update can collect YARA files from local or remote sources, and generate YARA files from enabled third-party integrations. Once collected, Corelight-update will automatically merge multiple YARA sources into a single YARA file named yara_rules.yar
.
The file is published as a YARA source in Fleet Manager using the user provided yara_source_namespace
in Fleet configuration. A namespace for a YARA source is a tag (an identifying string that must not contain a colon (:) character) that is combined with the name of each YARA rule in the source to ensure that YARA has a unique identifier for each rule.
To add local or remote YARA sources, see:
To review the order that the configurations are processed in, see Order of operations.