Comments (2)
That's right. Maybe some folks would still prefer to run metadata validation on them, hence an optional flag. Maybe ON by default. which means don't skip validation on private rules.
I don't mind waiting for other ppl to give their opinion on this :)
Cheers.
from cccs-yara.
I think this could make sense in general without a special flag. The idea of the metadata is to provide more definitive context on YARA hit (ie. if a rule hits in Assemblyline and the rule indicates the file belongs to certain malware family). So if the private rules don't show up in the hit, I don't see a lot of reason to perform the metadata validation on them (other than perhaps for consistency's sake 😅)
from cccs-yara.
Related Issues (17)
- Validation Reject Valid Rules with Non-ASCII Characters HOT 2
- Rule Hashing Duplicates plyara Function HOT 2
- Sample rule is not CCCS valid HOT 2
- Dependabot couldn't authenticate with https://pypi.python.org/simple/
- Feature Request: Treat Warnings as Errors HOT 9
- Bug: Invalid yara rules pass validation HOT 5
- Bug: Whitespace Formatting Loop HOT 3
- Issue with import modules HOT 2
- last_modified date being overwritten
- Recommended changes HOT 2
- Add Malware Behavior Catalog Codes
- Invalid field name "typelib" HOT 2
- Metadata Parsing Errors HOT 1
- Field has Invalid Value: TLP:AMBER+STRICT
- How to describe cases when a yara rule have multiple hashes HOT 2
- README Suggestions HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cccs-yara.