App Control: How to Rebuild the Yara Rules File
book
Article ID: 290786
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Rebuild the Yara.bt9 rules file downloaded by Agents from the App Control Server.
Environment
- App Control Server: All Supported Versions
- Windows Server: All Supported Versions
Resolution
- Login to the application server as the Carbon Black Service Account.
- Browse to: "C:\Program Files (x86)\Bit9\Parity Server\configxml"
- Move all Yara*.bt9 files to a backup location outside of the Bit9 directory, such as the desktop.
- Browse to: "C:\Program Files (x86)\Bit9\Parity Server\hostpkg"
- Move the Yara.bt9 file to the backup location.
- Restart the service: App Control Server.
- Verify the Yara files were recreated in the "configxml" and "hostpkg" directories.
Additional Information
- The new Yara.bt9 file will have a new hash, and all Agents will be instructed to download the updated Yara file.
- If the Resource Download Location has been altered the new Yara.bt9 file will need to be copied to this location.
Feedback
thumb_up
Yes
thumb_down
No