Deletes a YARA rule file.
POST https://<address>/wsapis/[v1.2.0|v2.0.0]/customioc/yara/remove/<yaraType>/<yaraFile>
Availability
This command is available on the following appliances:
Central Management System
Malware Analysis
Email Security — Server
File Protect
Network Security
Required header:
X-FeApi-Token: [API-Token]
Request content-type:
application/json
Parameters
address—This is the IP address of the appliance running the Web Services API.
API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.
yaraType—The file type of the YARA rules file being submitted, such as exe, pdf, or ppt. See the Filetype dropdown in the Upload YARA Rule dialog in your appliance's Web UI for a complete list of file types.
yaraFile—Name of the YARA rules file to be deleted.
target_type—Specifies which contentType the new YARA rule should be applied to. Valid types are:
active_content—Extracts the macros from files and executes special YARA rules on them.base—Default. If file contains a macro, don’t extract and analyze macros; only analyze the base file.all—Does both.
Example request
To delete a YARA rule with base content, use:
POST https://<address>/wsapis/v1.2.0/customioc/yara/remove/<yaraType>/<yaraFile>
To delete a YARA rule using v.2.0.0 with base, active_content or all, use:
POST https://<address>/wsapis/v2.0.0/customioc/yara/remove/<yaraType>/<yaraFile>?target_type=base
POST https://<address>/wsapis/v2.0.0/customioc/yara/remove/<yaraType>/<yaraFile>?target_type=active_content
POST https://<address>/wsapis/v2.0.0/customioc/yara/remove/<yaraType>/<yaraFile>?target_type=all
Results
The specified YARA rule is deleted from the server.
Delete a YARA rule response
Response Code—A standard HTML response code.
200—Request successful.
500—Request unsuccessful because the server encountered a problem.
Response Message—A standard HTML response message.
OK—Request successful.
Internal Server Error—Request unsuccessful because the server encountered a problem.
cURL code sample: delete a YARA rule
The following code sample can be copied and executed from any command-line interface that includes the cURL library.
Note
In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.
curl -qgsSk --header "${COOKIE}" -X POST "https://xxx.xxx.xxx.xxx/wsapis/${API_ VERSION}/customioc/yara/remove/xls/<yaraFile>?target_type=all"
This cURL sample includes the following options:
-q—This option specifies that thecurlrcconfig file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.-g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.-s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.-S—When used with the-soption, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.-k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.--header—This option allows you to specify a custom header.-F filename=@${file}—This option specifies the YARA file to remove.
https://xxx.xxx.xxx.xxx/wsapis/${API_ VERSION}/customioc/yara/remove/xls/<yaraFile>?target_type=all—The remove request URL. Replace the IP addressxxx.xxx.xxx.xxxwith the IP address of your appliance.