Question - Yara scanning error? about strelka HOT 4 CLOSED

Yes I was a noob. If you use that yara in other tools it will trow exceptions. (https://github.com/Neo23x0/signature-base#external-variables-in-yara-rules)

from strelka.

Hi,

What I did to find the yara file that was causing issues is to have a small python script to compile the files. It will throw an exception on the misbehaving yara file.

You obviously need to install yara-python

#!/bin/python
import yara
import os

directory = r'/opt/yara/path/etc'
for entry in os.scandir(directory):
    if (entry.path.endswith(".yar")
            or entry.path.endswith(".yara")) and entry.is_file():
        yara.compile(entry.path)

from strelka.

@markus-nclose - Glad you were able to troubleshoot that. Let me know if I can help with any issues while you experiment with the tool. Happy you checked it out!

from strelka.

Hello!
I have the same issue:

 "yara": {
      "elapsed": 0.032276,
      "flags": [
        "compiling_error"
      ]
    }

Steps to reproduce
Steps to reproduce the behavior:

1. Default install docker
2. Edit filestream config to add strelka-server IP and path to folder with files
3. Run Filestream to send files from folder
4. See error above

from strelka.