YaraScan

Details

ID	`YaraScan`
Language	python
From Version	5.0.0
Docker Image	`demisto/yarapy:1.0.0.9067966`

README

Performs a Yara scan on the specified files.

Script Data

Name	Description
Script Type	python3
Tags	-

Inputs

Argument Name	Description
yaraRule	The Yara rule to use for the file scan.
entryIDs	A comma-separated list of file entry IDs to scan.

Outputs

Path	Description	Type
Yara.Filename	The filename of the file that was scanned.	string
Yara.HasError	Whether there was an error when performing the scan.	boolean
Yara.HasMatch	Whether the file matched any of the rules.	boolean
Yara.entryID	The entry ID of the scanned file.	string
Yara.fileID	The file ID of the scanned file.	string
Yara.MatchCount	The number of rules that matched the file.	number
Errors	A list of errors that occurred during the scan.	Unknown
Matches.Meta	Metadata about the rule (as defined in the rule itself).	Unknown
Matches.Namespace	The namespace defined in the rule.	string
Matches.RuleName	The rule name that matched.	string
Matches.Strings	A list of strings that the rule matched.	string
Matches.Tags	A list of tags that are defined in the rule.	Unknown

Source

YaraScan.py YaraScan_test.py YaraScan.yml

Download History Raw

import demistomock as demisto
from CommonServerPython import entryTypes
from YaraScan import main


def test_main(mocker):
    rule = """rule PE_file_identifier
{
    meta:
        author = "Adam Testburt"
        description = "Detects PE files"
        date = "12/08/2016"

    strings:
        $MZ = "MZ" ascii

    condition:
        $MZ at 0
}"""

    def executeCommand(name, args=None):
        if name == "getFilePath":
            return [
                {"Type": entryTypes["note"], "Contents": {"path": "test_data/unzip.exe", "name": "unzip.exe", "ID": "testfileid"}}
            ]
        else:
            raise ValueError(f"Unimplemented command called: {name}")

    mocker.patch.object(demisto, "args", return_value={"entryIDs": "test@1111", "yaraRule": rule})
    mocker.patch.object(demisto, "executeCommand", side_effect=executeCommand)
    mocker.patch.object(demisto, "results")
    main()
    results = demisto.results.call_args[0]
    assert len(results) == 1
    assert results[0]["Type"] == entryTypes["note"]
    assert results[0]["Contents"][0]["HasMatch"]
    assert results[0]["Contents"][0]["Matches"][0]["RuleName"] == "PE_file_identifier"