Viewing YARA rule details

To view YARA rule details:

1. In the window of the program web interface, select the User rules section, YARA subsection.

   This opens the YARA rule table.

2. Select the rule for which you want to view information.

This opens a window containing information about the rule.

The window contains the following information:

• Alerts Click the link to display the Alerts table in a new browser tab. The alerts are filtered by the Technologies and Details columns, that is, the YARA technology and the name of the YARA rule that you are working on.
• Scan host. The link opens the Start YARA scan task creation window.
• Download. The link lets you download a file with YARA rules.
• Rule name is the name of the rule specified in the file.
• Traffic scan is the usage status of the rule when stream scanning files and objects arriving at the Central Node:
• Type is the type of the rule depending on the role of the server which generated it:
  • Global—Created on the PCN server. These rules are used to scan files and objects received at the PCN server and all SCN servers connected to that PCN server. Scanned files and objects belong to the company which the user is managing in the program web interface (in the distributed solution and multitenancy mode).
  • Local—Created on the SCN server. These rules are used to scan files and objects received at the SCN server. Scanned files and objects belong to the company which the user is managing in the program web interface (in the distributed solution and multitenancy mode).
• Importance—Importance level that is assigned to an alert generated using this rule.

  By default, alerts generated by uploaded YARA rules are assigned a high level of importance.

• Description is any additional information about the rule that you specified.
• Apply to – name of servers with the Central Node component on which the rule is applied.

See also Importing YARA rules Viewing the YARA rule table Configuring YARA rule table display Filtering and searching YARA rules Clearing a YARA rule filter Enabling and disabling YARA rules Deleting YARA rules

Page top