xdr_yara_rule_matching

KO | EN

gitlite — search

#javascript #python #hacktoberfest #llm #android #rust #docker #macos #nodejs #java #vue #security #openai #open-source

xdr_yara_rule_matching

(★ 14)

custom Python script to perform Yara matching in Cortex XDR

xdr_yara_rule_matching 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# xdr_yara_rule_matching
This Python script must be used as part of Palo Alto Networks' Cortex XDR custom scripts. It allows you to perform a Yara-based file search on Windows machines running the Cortex XDR agent.

For performance reasons, this script embeds a compiled version of the Yara engine as it’s performing several orders of magnitude faster than the Python version of the same engine.

## Installation
The script must be uploaded directly on the Cortex XDR console in Response / Action Center / Scripts Library:
1. Click on the **New Script** button and upload the script.
2. **Script Name** could be any name or description.
3. **Supported OS** must be Windows.
4. **Timeout** could be configured to any value you want but starting with 600 seconds is good practice. Depending on your Yara search, you may need to increase this value at a later stage.
5. **Input** must be set to **Run by entry point** with **main** as an entry point. root_path and yararule are strings.
6. **Output Type** must be **Auto Detect**

And then click on **Create**

## Usage
To run your script on some of your Windows machines, right-click on your script from the **Scripts Library** menu and select **Run**. Copy/Paste your complete Yara rule in the **YARARULE** script parameter and provides the **ROOT_PATH** of your search.

For example:

***YARARULE***
```
rule string_match
{
	strings:
		$my_text_string = "a string to search"

condition:
		$my_text_string

}
```

***ROOT_PATH***

`C:\Users\`

## Results
When your action has been launched, you can get its results in ***Action Center / All actions***

xdr_yara_rule_matching

xdr_yara_rule_matching 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

xdr_yara_rule_matching

xdr_yara_rule_matching 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README