Details
| ID | YaraScan |
|---|---|
| Language | python |
| From Version | 5.0.0 |
| Docker Image | demisto/yarapy:1.0.0.9067966 |
README
Performs a Yara scan on the specified files.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | - |
Inputs
| Argument Name | Description |
|---|---|
| yaraRule | The Yara rule to use for the file scan. |
| entryIDs | A comma-separated list of file entry IDs to scan. |
Outputs
| Path | Description | Type |
|---|---|---|
| Yara.Filename | The filename of the file that was scanned. | string |
| Yara.HasError | Whether there was an error when performing the scan. | boolean |
| Yara.HasMatch | Whether the file matched any of the rules. | boolean |
| Yara.entryID | The entry ID of the scanned file. | string |
| Yara.fileID | The file ID of the scanned file. | string |
| Yara.MatchCount | The number of rules that matched the file. | number |
| Errors | A list of errors that occurred during the scan. | Unknown |
| Matches.Meta | Metadata about the rule (as defined in the rule itself). | Unknown |
| Matches.Namespace | The namespace defined in the rule. | string |
| Matches.RuleName | The rule name that matched. | string |
| Matches.Strings | A list of strings that the rule matched. | string |
| Matches.Tags | A list of tags that are defined in the rule. | Unknown |
commonfields: id: YaraScan version: -1 name: YaraScan script: '' type: python tags: [] comment: Performs a Yara scan on the specified files. enabled: true args: - name: yaraRule required: true description: The Yara rule to use for the file scan. - name: entryIDs required: true description: A comma-separated list of file entry IDs to scan. isArray: true outputs: - contextPath: Yara.Filename description: The filename of the file that was scanned. type: string - contextPath: Yara.HasError description: Whether there was an error when performing the scan. type: boolean - contextPath: Yara.HasMatch description: Whether the file matched any of the rules. type: boolean - contextPath: Yara.entryID description: The entry ID of the scanned file. type: string - contextPath: Yara.fileID description: The file ID of the scanned file. type: string - contextPath: Yara.MatchCount description: The number of rules that matched the file. type: number - contextPath: Errors description: A list of errors that occurred during the scan. - contextPath: Matches.Meta description: Metadata about the rule (as defined in the rule itself). - contextPath: Matches.Namespace description: The namespace defined in the rule. type: string - contextPath: Matches.RuleName description: The rule name that matched. type: string - contextPath: Matches.Strings description: A list of strings that the rule matched. type: string - contextPath: Matches.Tags description: A list of tags that are defined in the rule. scripttarget: 0 subtype: python3 dockerimage: demisto/yarapy:1.0.0.9067966 runas: DBotWeakRole fromversion: 5.0.0 tests: - No tests