Creating Yara analysis units

Yara analysis units consist of one or several Yara rules.

You must hold the Resources-Modify privilege to create analysis units.

  1. Select the Resources menu.

  2. In the left panel, click on + Add a resource. The New analysis unit row appears.

  3. In the New analysis unit field, enter the name of your analysis, then a description below it if necessary.

  4. Choose the scan mode:

    • File scan to analyze files contained on agents,

    • Process scan to analyze memory on the processes that are executed on agents. Do note that this scan mode may detect the same pattern in several processes as memory from one process can be temporarily copied into other processes.

  5. Click on Import files and select the *.yar, and *.rule files that you wish to use in this analysis unit. You can also import Yara Index files that reference other Yara files.

    If imported Yara files contain inconsistencies or are likely to affect performance, Error, Warning or Performance messages appear in the Compile resources area with a description. If an error occurs, you must fix the issue or remove the file in question as you will not be able to save the analysis unit.
    You can filter these messages by severity, Yara version or SES Evolution agent version if needed. SES Evolution agents in version 2.3.2 are compatible with version 4.2.2 of Yara.

    Yara analysis units cannot be deleted while they are being used in a Yara task, scheduled scan or as an action when logs are generated in an SES Evolution rule.

    To obtain a local copy of Yara files, click on and select a destination folder. You can then look up these files, edit them and import them into the same analysis unit or into another unit.