EDR Yara-Connector: New Yara Rule Does Not Run on Binaries
search cancel

EDR Yara-Connector: New Yara Rule Does Not Run on Binaries

book

Article ID: 284932

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When adding a new Yara rule to the cb-yara-connector, it does not retroactively scan binaries.

Environment

  • EDR Server: All Supported Versions
  • EDR Yara-Connector: 2.x

Resolution

  • This is expected and by design, as a full modulestore/binary scan can be expensive on resources.
  • To re-scan the binaries against all rules, including new ones:
    • The cb-yara-connector database can be reset using the cb-yara-manager UI via the Reset DB button:
      • User-added image
    • This can also be reset by removing or backing up the cb-yara-connector database and restarting the cb-yara-connector service:
rm /var/cb/data/cb-yara-connector/feed_db/binary.db
systemctl restart cb-yara-connector
  • Note: this will initiate a re-scan of the modulestore.