Document difference between yara and yara_events
#7744
Conversation
specs/yara/yara_events.table
Outdated
| @@ -1,5 +1,5 @@ | |||
| table_name("yara_events") | |||
| description("Track YARA matches for files specified in configuration data.") | |||
| description("Historical YARA matches for files and PIDs as specified in configuration.") | |||
There was a problem hiding this comment.
Hrm. IIRC this is an evented table basically identical to the way file events works. We describe that one as Track time/action changes to files specified in configuration data
I'm a little leery of "historical" since evented tables don't really store history. (Well, they might. But usually they drop it after it's queried)
There was a problem hiding this comment.
Hmmmm ok... it sounds like these evented tables work differently from what I understand. I will need to read up on them a bit more.
There was a problem hiding this comment.
I reverted this change. How about just merging the explanation for the yara table?
There was a problem hiding this comment.
It's sorta "historical". Evented tables store events, and then usually purge them out when queried. Generally they're not good for thigns like "show me last tuesday", they're for things like "how do I capture all the processing that are running, since some are shorter lived than my query interval"
yara and yara_events
specs/yara/yara.table
Outdated
| @@ -1,5 +1,5 @@ | |||
| table_name("yara") | |||
| description("Track YARA matches for files or PIDs.") | |||
| description("Fetch one-off YARA matches for files or PIDs at the specified path.") | |||
There was a problem hiding this comment.
Well, this has caused me to look at how things work. And while I agree your language is an improvement, I think we can be better.
- I don't think this uses pids at all.
trackisn't right, but I don't know iffetchis right either. It triggers an on-demand yara scan. (Like if you queried for a hash, it's not fetching the hash, per se, it's generating it)- It's not listed here, but at least one of
sig_groups,sigfile, orsigrulemust be specified. I don't know if you'd like to add that.
There was a problem hiding this comment.
Updated the language! WDYT?
I've been learning about YARA and found that the descriptions in the table were not very informative. I think this is my best understanding of what the two YARA tables do. I think it might be more informative/clear for newcomers?