yara-scan
Scans a file or directory in the file store with enabled YARA rules and returns one row per file, including files without detections and files with errors.
yara-scan url=VALUE [recursive=VALUE] [timeout=VALUE] [max-size=VALUE]
- url=VALUE
- Required. File store URL of a file or directory, for example sonar://samples/malware. Quote values containing spaces.
- recursive=VALUE
- Optional. Include subdirectories: t or f. Default: t.
- timeout=VALUE
- Optional. Per-file scan timeout in seconds. Default: 60.
- max-size=VALUE
- Optional. Maximum file size in bytes. Default: 67108864 (64 MiB). Larger files produce an error result.
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| _time | Date | Scan time | e.g. 2026-09-12 14:00:00 |
| file_url | String | File url | e.g. sonar://samples/malware/a.exe |
| file_name | String | File name | e.g. a.exe |
| file_size | Long | File size | Bytes |
| is_matched | Boolean | Matched | e.g. true |
| match_count | Integer | Match count | e.g. 2 |
| rules | String | Matched rules | e.g. EICAR_Test_File,SUSP_Just_EICAR |
| tags | String | Rule tags | e.g. exe,packed |
| error | String | Error | e.g. file too large: 104857600 |