How to Add YARA Rules to the Console

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Add Custom YARA Rules to the Console.

Environment

• App Control Console: Version 8.9.0+
• App Control Windows Agent: 8.8.0+

Resolution

1. Log in to the Console and navigate to Rules > Software Rules > Yara
2. Click Add Yara Rule and create the relevant YARA Rule
   • It is recommended to add rules to the Classification namespace.
   • Avoid adding rules to the IsInteresting namespace unless absolutely required.
   • Review the YARA Rules in App Control documentation: TechDocs > Server > User Guide > YARA Rules > Add a YARA Rule
   • Review the official YARA Documentation 
3. Choose when to Rescan Files
   • Full scans could impact endpoint performance.
4. After saving the YARA Rule, if necessary be sure to also create the relevant Custom Rule to determine an action to be taken based on the new YARA Rule.

Additional Information

• More information on Yara Rules in App Control is available on TechDocs > Server > User Guide > Yara Rules.
• Performance Impacts With Write Rules Containing Yara Tags
• Troubleshooting Yara Rules
• Yara Documentation