List a YARA rule

Lists a YARA rule file.

Syntax

GET https://<address>/wsapis/v2.0.0/customioc/yara/list

Availability

This command is available on the following appliances:

Central Management System
Malware Analysis
Email Security — Server
File Protect
Network Security

Required header:

X-FeApi-Token: [API-Token]

Request content-type:

application/json

Parameters

address—This is the IP address of the appliance running the Web Services API.
API-Token—This token authenticates the session. By default, the session times out after 15 minutes of inactivity.
yara_type—(Optional) Specifies which YARA type should be listed. Valid types are:
- active_content—Extracts the macros from files and executes special YARA rules on them.
- base—Default. If file contains a macro, don’t extract and analyze macros; only analyze the base file.
- all—Does both.
appliance—Central Management System only. Specifies the name of the sensor.

Example request

To list a YARA rule with base content, use:

GET https://<address>/wsapis/v2.0.0/customioc/yara/list?yara_type=pdf

Results

The specified YARA rule is returned as a PDF file.

List a YARA rule response

Line breaks have been added for readability.

GET https://<address>/wsapis/v2.0.0/customioc/yara/list?yara_type=pdf

{
  "pdf":["sample.yara"]
}

GET https://<address>/wsapis/v2.0.0/customioc/yara/list

{
  "masala":{
    "common":[
      "sample1.yara"
    ]
  },
  "mas-scale-1":{
    "txt":[],
    "common":[
      "sample1.yara"
    ]
  },
  "A13-ex5500v-3":{},
  "nice":{
    "common":[
      "sample1.yara"
    ]
  }
}

GET https://<address>/wsapis/v2.0.0/customioc/yara/list?yara_type=common

{
  "masala":{
    "common":[
      "sample1.yara"
    ]
  },
  "mas-scale-1":{
    "common":[
      "sample1.yara"
    ]
  },
  "nice":{
    "common":["
      sample1.yara"
    ]
  }
}

GET https://<address>/wsapis/v2.0.0/customioc/yara/list?yara_type=common&appliance=masala

{
  "masala":{
    "common":[
      "sample1.yara"
    ]
  }
}

Response fields

Response Code—A standard HTML response code.

200—Request successful.
400—No files found for the YARA type requested

Response Message—A standard HTML response message.

OK—Request successful.
Not found—No files found for the YARA type requested

cURL code sample: list a YARA rule

The following code sample can be copied and executed from any command-line interface that includes the cURL library.

Note

In this sample, line breaks are added for readability. Remove these line breaks before you paste the code sample into your command-line tool.

curl -qgsSk --header "${COOKIE}" "https://${HOST}/wsapis/v2.0.0/customioc/yara/list?yara_type=pdf"

This cURL sample includes the following options:

-q—This option specifies that the curlrc config file is not read or used. Although this is an optional setting, Trellix recommends that you include this option.
-g—This option turns off the URL globbing parser. Although this is an optional setting, Trellix recommends that you include this option.
-s—This option turns off the progress meter and error message. Although this is an optional setting, Trellix recommends that you include this option.
-S—When used with the -s option, this option shows error messages if your cURL switch fails. Although this is an optional setting, Trellix recommends that you include this option.
-k—This option explicitly allows cURL to perform insecure SSL connections and transfers. This allows you to test your SSL connection without installing a CA certificate.
-H—This option allows you to specify a custom header.

https://xxx.xxx.xxx.xxx/wsapis/v2.0.0/customioc/yara/list?yara_type=pdf—The request URL. Replace the IP address xxx.xxx.xxx.xxx with the IP address of your appliance.