Analyst1 YARA

The Analyst1 YARA integration is designed to fetch YARA rules from a specified sensor, of type “YARA”, within the Analyst1 platform.

If the ‘interval_hours’ is set to 0, the integration will attempt to download additional content each time the Corelight-update service runs. See General settings

Once downloaded, the ruleset will be processed with the rulesets from all other sources.

Settings

analyst1_yara:
  client_id: ""                     # Analyst1 API Client ID
  client_secret: ""                 # Analyst1 API Secret
  url: ""                           # Analyst1 Base URL
  enabled: false
  yara_sensor_id: 0                 # Sensor ID with type YARA
  debug: false
  ignore_tls: false
  request_limit: 1000
  interval_hours: 24