genian-edr-yara-rules
Lists the YARA rules of the console.
genian-edr-yara-rules [profile=VALUE] [name=VALUE]
- profile=VALUE
- Optional. Genian EDR connect profile name. Every Genian EDR profile is queried when omitted.
- name=VALUE
- Optional. Rule name filter
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| idx | Integer | Rule ID | e.g. 100002. ID the idx option takes. |
| name | String | Name | e.g. suspicious_strings. Rule name. |
| rule | String | Rule | e.g. rule suspicious_strings { strings: $a = "mimikatz" condition: $a }. Rule text. |
| msg | String | Message | e.g. Credential dumping tool. Detection message. |
| info | String | Info | Rule information |
| severity | Integer | Severity | e.g. 0. Severity code. |
| confidence | Integer | Confidence | e.g. 0. Confidence. |
| verdict | String | Classification | Classification code |
| cve | String | CVE | Related CVE |
| is_enabled | Boolean | Enabled | e.g. true. Whether the rule is in use. |
| provider | String | Provider | e.g. CUSTOM. CUSTOM for user rules. |
| created | Date | Created | e.g. 2026-11-07 00:14:20. When it was registered. |