Troubleshooting Yara Rules
book
Article ID: 377893
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Steps to troubleshoot when a Custom Yara Rule is not properly tagging files.
Environment
- App Control Console: Version 8.9.0+
- App Control Windows Agent: 8.8.0+
Resolution
- Verify any Qualifiers are formatted correctly and applicable.
- Verify the Yara Tags
- Verify case-sensitive information, examples:
- Verify File Scanning was chosen correctly, example: if existing files need to be assigned tags, Rescan known files.
- Verify Yara Keywords and other features are supported by the Yara Library version mentioned in the Agent's Release Notes.
- Example: As of Windows Agent 8.9.6 the Yara Library was updated to version 4.05.
- Verify the Yara Rule has been received by the Agent by using dascli.
- Compare the Yara Rule version shown in dascli status matches the value from Assets > Computers.
- Use dascli find <file> to verify Yara results.
- Verify any relevant Custom Rule has the appropriate Yara Tag(s) specified.
If issues persist, open a case with Support and provide:
Additional Information
- Use extreme caution and thorough testing when using the Namespace IsInteresting
- Yara Rules can create significant performance issues especially when IsInteresting is used.
- In general, consider Yara Rules to be case-sensitive, examples:
- ABC and abc can identify different Yara Rules.
- Operators such as == and contains use case-sensitive semantics.
Feedback
thumb_up
Yes
thumb_down
No