genian-edr-add-yara-rule
Registers a custom YARA rule after checking it with the console's validator; a failing rule is not saved. This command changes the console, so profile is required.
genian-edr-add-yara-rule profile=VALUE name=VALUE rule=VALUE [msg=VALUE] [info=VALUE] [severity=VALUE] [confidence=VALUE] [verdict=VALUE] [cve=VALUE] [is-enabled=VALUE]
- profile=VALUE
- Required. Genian EDR connect profile name. Required: a change is made on exactly one console.
- name=VALUE
- Required. Rule name
- rule=VALUE
- Required. YARA rule text
- msg=VALUE
- Optional. Detection message
- info=VALUE
- Optional. Rule information
- severity=VALUE
- Optional. Severity code. Follow the values existing rules carry.
- confidence=VALUE
- Optional. Confidence. Follow the values existing rules carry.
- verdict=VALUE
- Optional. Classification code. Follow the values existing rules carry.
- cve=VALUE
- Optional. Related CVE
- is-enabled=VALUE
- Optional. Use the rule right away (t/f). Defaults to t.
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| name | String | Name | e.g. suspicious_strings. Name of the registered rule. |