yara-scan-reports
Lists YARA scan reports for a period, one row per scan, including scan status, target, and file counts.
yara-scan-reports [from=VALUE] [to=VALUE] [duration=VALUE]
- from=VALUE
- Optional. Start time as yyyyMMddHHmmss. Shorter forms such as yyyyMMdd are accepted.
- to=VALUE
- Optional. End time as yyyyMMddHHmmss. Shorter forms such as yyyyMMdd are accepted. The specified second is included.
- duration=VALUE
- Optional. Positive period length: s (seconds), m (minutes), h (hours), d (days), or w (weeks). A number without a unit means seconds. Default: 1d.
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| _time | Date | Time | e.g. 2026-09-12 23:34:22 - the row timestamp, same instant as start_time |
| guid | String | Scan GUID | e.g. 0545f99b-6bfd-4f4f-9be7-1e6d4a3b9c1a - matches scan_guid in yara-scan-logs |
| target_url | String | Scan target | e.g. sonar://samples/malware |
| status | String | Status | e.g. completed - one of compiling, running, completed, failed, cancelled |
| start_time | Date | Started | e.g. 2026-09-12 23:34:22 |
| end_time | Date | Finished | e.g. 2026-09-12 23:34:23 - empty while the scan is still running |
| is_recursive | Boolean | Recursive | e.g. true |
| total_count | Integer | Target files | e.g. 120 - empty when the target could not be counted up front |
| scanned_count | Integer | Scanned files | e.g. 120 |
| matched_count | Integer | Detected files | e.g. 3 |
| error_count | Integer | Errors | e.g. 0 |
| started_by | String | Started by | e.g. admin |
| ruleset_version | Long | User ruleset version | e.g. 4 |
| error | String | Error | e.g. interrupted by restart - empty unless the scan failed |
| source | String | Source | e.g. archived - live for a scan still in the database, archived for one in the log tables |