App Control: What Are Yara Rules?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

What are Yara rules?

Environment

• App Control: 8.0 and Higher

Resolution

Yara rules are used for core logic in the App Control agent. They contain information such as "is this file an installer?" and "is this file a script?". They have the potential to change over time and the architecture is in place to deliver upgrades via the Collective Defense Cloud (much like how Updaters and Rapid Configs get updated).