EDR Yara Components Explained, Installed, Configured with Troubleshooting Tips

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

To understand, install, configure and troubleshoot Yara in both EDR standalone and cluster environments.

Environment

• EDR Server: 7.7.x 
• Yara Connector: 2.2.0
• Yara Manager: 2.2.0

Resolution

Yara, a rules engine from VirusTotal, alerts on binaries executing in the environment.  The yml style rules are created with text or binary patterns.  The Yara Connector processes, analyzes and stores (Solr, Yara DB) the analysis for EDR Console to obtain.  The (Yara Manager, optional) provides access to the Yara-connector via the EDR Console.

1.  Understanding Yara Components

2.  Install and Configure Yara Connector

3.  Install and Configure Yara Manager (optional)

4.  Adding Yara Rules and Validating

5.  Troubleshooting Yara

Additional Information

• Yara Complete - Understanding and Deploying Yara