Analyst1 YARA¶
The Analyst1 YARA integration is designed to fetch YARA rules from a specified sensor, of type “YARA”, within the Analyst1 platform.
If the ‘interval_hours’ is set to 0, the integration will attempt to download additional content each time the Corelight-update service runs. See General settings
Once downloaded, the ruleset will be processed with the rulesets from all other sources.
Settings¶
analyst1_yara: client_id: "" # Analyst1 API Client ID client_secret: "" # Analyst1 API Secret url: "" # Analyst1 Base URL enabled: false yara_sensor_id: 0 # Sensor ID with type YARA debug: false ignore_tls: false request_limit: 1000 interval_hours: 24