Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Docs: bring the YARA wiki page up to date #7172

Merged
merged 11 commits into from
Jul 13, 2021

Conversation

mike-myers-tob
Copy link
Member

@mike-myers-tob mike-myers-tob commented Jun 23, 2021

Resolves #7110

  • Removes outdated column pattern and explains the WHERE path LIKE syntax with examples
  • Documents new flags and functionality added in the last year or so
  • Clarifies some of the usage, and forms an initial version of a troubleshooting section
  • Points to YARA rule-writing documentation
  • Updates the examples with the current table schema
  • I've tested all the examples myself (on Windows 10)

@mike-myers-tob mike-myers-tob requested review from a team as code owners June 23, 2021 01:20
@mike-myers-tob mike-myers-tob marked this pull request as draft June 23, 2021 01:20
@directionless
Copy link
Member

FWIW from my notes

testing in-line rules, I had to use newlines:

select * from yara where path LIKE '/tmp/example-data/%' and sigrule = 'rule hello_world {
strings:
$a = "Hello world"
condition: $a
}';

Scanning from a ruleset on disk:

select * from yara where path LIKE '/tmp/example-data/%' and sigfile = '/tmp/yara.sig';

@mike-myers-tob mike-myers-tob marked this pull request as ready for review July 8, 2021 23:12
Copy link
Member

@theopolis theopolis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

small nitpick, what do you think?

docs/wiki/deployment/yara.md Outdated Show resolved Hide resolved
@theopolis theopolis merged commit 2d060dc into osquery:master Jul 13, 2021
@mike-myers-tob mike-myers-tob deleted the mike/docs-yara branch July 14, 2021 00:13
sharvilshah pushed a commit to sharvilshah/osquery that referenced this pull request Aug 3, 2021
@mike-myers-tob mike-myers-tob restored the mike/docs-yara branch August 6, 2021 23:14
@mike-myers-tob mike-myers-tob deleted the mike/docs-yara branch August 6, 2021 23:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Update the YARA docs to explain recent functionality changes
4 participants