Viewing the YARA rule table

The table of user-defined YARA rules contains information about YARA rules that are used to scan events and create alerts; the table is displayed in the User rules section, YARA subsection of the program web interface window.

The table contains the following information:

• Created is the rule creation time.
•  —Alert importance for the Kaspersky Anti Targeted Attack Platform user depending on the impact this alert may have on computer or corporate LAN security based on Kaspersky experience.

  By default, alerts generated by uploaded YARA rules are assigned a high level of importance.

• Type is the type of the rule depending on the role of the server which generated it in distributed solution mode:
  • Global – the rule was created on the PCN server.
  • Local – the rule was created on an SCN server.
• Name – name of the rule.
• File name is the name of the file from which the rule was imported.
• Created by is the name of the user whose account was used to import the rule.
• Servers – name of the server with the Central Node component on which the rule is applied.

1. Traffic scan is the usage status of the rule when stream scanning files and objects arriving at the Central Node:
   • Enabled – the rule is being used.
   • Disabled – the rule is not being used.

See also Importing YARA rules Configuring YARA rule table display Viewing YARA rule details Filtering and searching YARA rules Clearing a YARA rule filter Enabling and disabling YARA rules Deleting YARA rules

Page top