Disabling custom YARA rules using the CLI

This procedure describes how to disable the use of custom YARA rules on the Intelligent Virtual Execution - Server appliance. This setting can be configured using CLI commands only.

Usage guidelines

On Intelligent Virtual Execution - Server appliances, custom YARA rules can be enabled, disabled, or limited to a specified number of matches using CLI commands only.

Prerequisites

Operator or Admin access

To enable or disable the use of custom YARA rules:

Go to CLI configuration mode.

vx-hostname > enable
vx-hostname # configure terminal

Disable custom YARA rules:
```
vx-hostname (config) # yara policy fe
```
Note
The Intelligent Virtual Execution - Server appliance can use either the Trellix-provided YARA rules only, or both the Trellix-provided YARA rules and the custom YARA rules.

Verify your changes. In the following example, the Intelligent Virtual Execution - Server appliance is configured to use Trellix-provided YARA rules and no custom YARA rules:

vx-hostname (config) # show static-analysis config
  
  Static Analysis enabled                : yes
    AV-suite enabled                     : yes
    AV-suite version                     : 6
    SA on AV-suite whitelist enabled     : no
    AV-check enabled                     : yes
    Dropper enabled                      : yes
    YARA enabled                         : yes
    
  Embedded object extraction enabled     : no
  Embedded URL extraction enabled        : yes
  Max URLs from files to be analyzed     : 5
  Static info policy                     : Disable

  Yara Configuration
    Yara policy                       : fe
    Yara customer match limit            : 3
........

Save your changes.
```
vx-hostname (config) # write memory
```