Falcon YARA ruleset

The CrowdStrike Falcon YARA ruleset file will only be downloaded if it has changed since the last interval.

If the ‘interval_hours’ is set to 0, the integration will attempt to download additional content each time the Corelight-update service runs. See Configuration settings

Once downloaded, the data will be merged with all other YARA rule files (if there are any), and published as a YARA source on Fleet Manager. If “yara_source” is enabled in the “push_content” settings, the file will automatically get pushed to the Fleet Manager YARA source. See Push content settings for more details.

Attention

Downloading YARA rules from CrowdStrike requires a Falcon Intelligence Premium subscription. The Client ID and Client Secret need access to the following API: https://api.crowdstrike.com/intel/entities/rules-latest-files/v1

Settings

crowdstrike_yara:
  id:                               # Falcon API Client ID
  secret:                           # Falcon API Secret
  member_cid:                       # Falcon API Member_CID (multi-tenant only)
  cloud:                            # Falcon Cloud (us-1, us-2, eu-1, us-gov-1)
  host_override:
  base_path_override:
  debug: false
  enabled: false
  interval_hours: 0