Create YARA rulesets request

Users can create one or more YARA rulesets at a time.

POST https://<etp_instance_addr>//api/v1/policies/policy_uuid/configuration/rules/yara/rulesets

Required header:

x-fireeye-api-key: <key>—Specifies your personal API key.

Content-Type: multipart/form-data—Content-type of the request body.

Options

policy_uuid—Universally unique identifier (UUID) of the policy.

Request body schema

The following table provides the request body schema:

Parameter	Mandatory field	Data type	Value	Description
`rulesets`	Yes	array of ruleset objects	-	This is the Meta information.
`is_new_file`	Yes	boolean	true/false	Must be true while creating rulesets.
`name`	Yes	string	-	Name of the ruleset.
`description`	No	string	-	Description of the ruleset.
`content_type`	Yes	string	base/active/base_and_active	Content type of the request body. `base`: This includes all contents of an e-mail message like headers, body, and attachments. `active`: This includes only attachments that have active content like macros embedded in them. For example, macros within MS Office documents. `base_and_active`: This includes both file and macros embedded in them. For example, MS Office documents and macros within them.
`attachment_type`	Yes	string	3gp, 7zip, a3x, accdb, ace, acrobatsecuritysettings, ahk, alz, apk, app, applet, arj, asf, ashx, asp, aspx, au3, avi, bat, bz2, cab, chm, cmd, com, com1, contact, css, csv, daa, dll, dmg, doc, docm, docx, dwg, dylib, eeml, egg, elf, eml, eot, exe, fas, fdf, flv, gen, gz, hlp, hml, hta, htm, hwp, hwpx, hwt, ico, inf, jar, js, jsp, jtd, lnk, lsp, lurl, lzh, mach-o, mht, mhtml, midi, mov, mp3, mp4, mpg, mpkg, msg, msi, mso, one, pdf, php, pkg, pl, png, ppsx, ppt, pptx, ps1, pub, pyc, qt, rar, raw32, raw64, rb, reg, rm, rmi, rtf, scf, sct, settingcontent-ms, sh, swf, tiff, tnef, unk, url-applet, uue, vbs, vcf, vcs, war, wav, wma, woff, wsf, xcoff, xdp, xls, xlsx, xml, xps, xsl, zip, common, custom_ehdr, custom_ehdr_hdr_only, custom_ehdr_body_only	`attachment_type`: This represents the email part to which yara rules are applied. If `common` is selected, rules are applied to all the supported file types. When a specific attachment extension is selected, rules are applied to only that specific type. If `custom_ehdr` is selected, rules are applied to header and body. If `custom_ehdr_hdr_only` is selected, rules are applied to only header. If `custom_ehdr_body_only` is selected, rules are applied to only body.
`yara_file_name`	Yes	string	low_confidence.yara	This is the YARA file name.
`enabled`	No	boolean	true/false	This is the API request enabled or disabled.
`override_rule_weights`	No	boolean	true/false	Use true to override the weight given in YARA rule file and use the weight in the `default_file_weight` field of the meta.json file.
`default_file_weight`	No	integer	-	This is the global weight of the file. This is optional.

Request body

Important
The request body must be a file and the file name should be meta.json. The meta.json and the .yara files in meta.json must be zipped and sent in the request.
max rules/client = 3000
max file upload limit = 4MB

{
    "configuration":
    {
        "rules":
        {
            "yara":
            {
                "rulesets":
                [
                    {
                        "name": "ruleset",
                        "description": "desc3",
                        "override_rule_weights": true,
                        "default_file_weight: 70,
                        "content_type": "base",
                        "attachment_type": "pdf",
                        "yara_file_name": "file3.yara",
                        "enabled": true,
                        "is_new_file": true,
                    },
                    {
                        "name": "ruleset4",
                        "description": "desc4",
                        "override_rule_weights": false,
                        //"default_file_weight": 100, this is optional if you have override = false
                        "content_type": "base",
                        "attachment_type": "common",
                        "yara_file_name": "file4.yara",
                        "enabled": true,
                        "is_new_file": true,
                    }
                ]
            }
        }
    }
}

Example of the request

Values for ID and other fields are for illustration only.

POST https://etp.us.fireeye.com/api/v1/policies/6d92fac1-f8e6-11eb-993c-02a7fc9eb3d9/configuration/rules/yara/rulesets

Example of the response

{
    "data": {
        "policy_master_uuid": "policy_uuid",
        "rulesets": [{
                "uuid": "ruleset_uuid",
                "uri": "/api/v1/policies/policy_uuid/configuration/rules/yara/rulesets/ruleset_uuid/attributes",
                "name": "ruleset",
                "description": "desc1",
                "override_rule_weights": true,
                "default_file_weight": 70,
                "content_type": "base",
                "attachment_type": "common",
                "yara_file_name": "file3.yara",
                "enabled": true
            },
            {
                "uuid": "ruleset4_uuid",
                "uri": "/api/v1/policies/policy_uuid/configuration/rules/yara/rulesets/ruleset4_uuid/attributes",
                "name": "ruleset4",
                "description": "desc1",
                "override_rule_weights": false,
                "content_type": "base",
                "attachment_type": "common",
                "yara_file_name": "file4.yara",
                "enabled": true
            }
        ]
    },
    "meta": {
        "total": 2,
        "copyright": "Copyright 2021 FireEye Inc",
        "type": "Yara Rules"
    }
}

cURL code sample: create YARA rulesets

curl -k -XPOST https://etp.us.fireeye.com/api/v1/policies/6d92fac1-f8e6-11eb-993c-02a7fc9eb3d9/configuration/rules/yara/rulesets -H 'x-fireeye-api-key: <feye-key>' -F file=@/Users/abc.xyz/old_downloads/yara-test-04-ext.zip

This cURL sample includes the following options:

-X POST—This option changes the HTTP method to POST.
--header "Content-Type: multipart/form-data"—This header specifies that the server's response body is expected to be in multipart/form-data format.
--header 'x-fireeye-api-key: <feye-key>'—This header specifies your personal API key.
https://etp.us.fireeye.com/api/v1/policies/6d92fac1-f8e6-11eb-993c-02a7fc9eb3d9/configuration/rules/yara/rulesets—The create YARA rulesets URL. Replace etp.us.fireeye.com with the IP address of your Email Security — Cloud instance and 6d92fac1-f8e6-11eb-993c-02a7fc9eb3d9 with the UUID of the YARA policy.

Results

This example returns the rulesets created under the YARA policy.