YARA management

YARA integrates with Zeek on Corelight Sensor, providing YARA rules embedded into workflows, and eliminating the need to build additional processes and connect multiple tools. This provides end-to-end file extraction, inspection, and alerting capabilities without the need to maintain additional monitoring systems.

YARA prerequisites

  1. Fleet Manager 28.1 or later

  2. A Corelight Sensor or Software Sensor running 28.1 or later

  3. A YARA feature license.

YARA management settings

yara_management:
    yara_file_cleanup: true
    max_yara_file_age: 24

Every time a new YARA file is generated, a copy of the file with the current timestamp is also created. The settings yara_file_cleanup and max_yara_file_age (in hours) control the retention of the timestamped copies.

Add YARA source

A YARA source is a YARA file (.yara or .yar) that contains YARA rules. One or more source files make up a YARA ruleset.

Corelight-update can collect YARA files from local or remote sources, and generate YARA files from enabled third-party integrations. Once collected, Corelight-update will automatically merge multiple YARA sources into a single YARA file named yara_rules.yar.

The file is published as a YARA source in Fleet Manager using the user provided yara_source_namespace in Fleet configuration. A namespace for a YARA source is a tag (an identifying string that must not contain a colon (:) character) that is combined with the name of each YARA rule in the source to ensure that YARA has a unique identifier for each rule.

To add local or remote YARA sources, see:

To review the order that the configurations are processed in, see Order of operations.