EDR: CB-Yara-Connector: How to Export Yara Rules

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Export Yara rules to another server instance

Environment

• EDR Server: All Supported Versions
• CB-Yara-Connector: 2.2.x +

Resolution

• Rules can be downloaded from the Yara-Manager UI page by using the 'Download' button.
• A more efficient way of exporting the rules would be by using the terminal to backup the rule files, then move them to the new Yara Connector instance in the same yara_rules directory.  The Yara rule files are in the file format of <file>.yar.  The yara_rules directory is located here:

/etc/cb/integrations/cb-yara-connector/yara_rules/*