Ensure you test a YARA rule before it is distributed. It is strongly recommended to do this to avoid unintended results.
Procedure
- Restrict a rule to a small number of endpoints, possibly as few as one endpoint. When you add the rule, specify an OnlyIf macro in the Qualifiers field, such as
<OnlyIf:HostId:784827>
or <OnlyIf:HostName:machine name>
. This will restrict the scope of the rule.
- Confirm that the new rule is on the agent. Use the dascli status command and search for
"Yara Rule Version:"
. Compare the value with the value on the top-right of the Computers page in the console, for example, Current Yara rule version: 32.
- Confirm that the rule is active on the agent.
- Test the rule. Copy files that are expected to match and not match to the agent, wait for the analysis, and issue a dascli find command.
- Correct the rule if results are not as intended. Edit or delete the rule, as required.
- When you have determined the rule is ready for publication, edit it and remove the qualifier that restricted it to a small number of endpoints.
- Enable the rule and save it.
Results
When you have tested the rule and corrected any issues, ensure the final results are as you intended.