YARA - File Scan

A playbook to run YARA scan against uploaded file. To run the playbook, provide the YARA rule content and the entry ID of the file you intend to scan.

Pack

Yara

Tasks

10

Inputs

• EntryID — The entry ID of a file to scan
• YARA — The YARA rule content
• Query — A query to match the relevant YARA rule indicators from TIM. Example: type:"YARA Rule"

Outputs

• Yara — The Yara context path.
• Yara.Filename — The filename of the file that was scanned.
• Yara.HasError — Whether there was an error when performing the scan.
• Yara.HasMatch — Whether the file matched any of the rules.
• Yara.entryID — The entry ID of the scanned file.
• Yara.fileID — The file ID of the scanned file.
• Yara.MatchCount — The number of rules that matched the file.
• Errors — A list of errors that occurred during the scan.
• Matches — The matches from the YARA scan.
• Matches.Meta — Metadata about the rule (as defined in the rule itself).
• Matches.Namespace — The namespace defined in the rule.
• Matches.RuleName — The rule name that matched.
• Matches.Strings — A list of strings that the rule matched.
• Matches.Tags — A list of tags that are defined in the rule.