By default, the Intelligent Virtual Execution - Server appliance identifies and reports malware when the sample under analysis matches five YARA rules. YARA rules are specific enough that only one or two rules will match malicious samples at a time; therefore, more than five matches are rare.
Prerequisites
Operator or Admin access
To configure the match limit for custom YARA rules:
Go to CLI configuration mode.
vx-hostname > enable vx-hostname # configure terminal
Use the
yara match limit <number>command, where<number>is the maximum number of custom YARA rules matched. The following example changes the maximum number of matched YARA rules to 3:vx-hostname (config) # yara match limit 3
Verify your changes.
vx-hostname (config) # show static-analysis config Static Analysis enabled : yes AV-suite enabled : yes AV-suite version : 6 SA on AV-suite whitelist enabled : no AV-check enabled : yes Dropper enabled : yes YARA enabled : yes Embedded object extraction enabled : no Embedded URL extraction enabled : yes Max URLs from files to be analyzed : 5 Static info policy : Disable Yara Configuration Yara policy : both Yara customer match limit : 3 ........
Save your changes.
vx-hostname (config) # write memory