YARA Scanning by LimaCharlie automates management of YARA signature sets and their use in scanning. YARA helps malware researchers identify and classify malware samples. Users can create descriptions of malware families based on textual or binary patterns. Each description, also known as a rule, consists of a set of strings and a boolean expression that determine its logic. The YARA service automates YARA scanning, transforming a manual process into a streamlined framework. Once configured, YARA scans can be run on-demand for specific endpoints or continuously across a fleet without performance impact. On-demand scans provide full control but may increase memory usage and affect performance. Continuous scanning, also known as trickle scanning, targets 1% CPU usage and may take longer to complete. To start YARA scanning, users can access the YARA Scanners view in their organization, pull YARA rules from sources like GitHub, and configure scanners to scan for matching signatures on sensors.
