Falcon YARA ruleset¶
The CrowdStrike Falcon YARA ruleset file will only be downloaded if it has changed since the last interval.
If the ‘interval_hours’ is set to 0, the integration will attempt to download additional content each time the Corelight-update service runs. See General settings
Once downloaded, the data will be merged with all other YARA rule files (if there are any), and published as a YARA source on Fleet Manager. If “yara_source” is enabled in the “push_content” settings, the file will automatically get pushed to the Fleet Manager YARA source. See Push content settings for more details.
Attention
Downloading YARA rules from CrowdStrike requires a Falcon Intelligence Premium subscription. The Client ID and Client Secret need access to the following API: https://api.crowdstrike.com/intel/entities/rules-latest-files/v1
Settings¶
crowdstrike_yara: id: # Falcon API Client ID secret: # Falcon API Secret member_cid: # Falcon API Member_CID (multi-tenant only) cloud: # Falcon Cloud (us-1, us-2, eu-1, us-gov-1) host_override: base_path_override: debug: false enabled: false interval_hours: 0