YARA Rule Manager

YARA Rule Manager is a standalone daemon that keeps YARA rules up to date. YARA identifies malicious files by matching rules against their contents, and those rules change frequently as new threats appear. The daemon downloads, validates and compiles rules from multiple git repositories, and stores the compiled rule set where software that uses YARA-based malware scanning, such as DTS, can read it. Its program name is yara_rule_manager.

Always-current rules

A malware scanner is only as good as its rules. YARA Rule Manager ships with a default list of git repositories, and the administrator decides how many hours pass between updates, with a minimum of one hour. Nobody has to download, check or compile rules by hand.

Only good rules get used

Rules are validated and compiled before anything is installed. Only rules that validate and compile cleanly are written, and they are written atomically to the compiled rule set, so software that uses the rules never sees a half-written or broken rule set.

How software picks up new rules

After each successful update, the daemon signals that a new rule set is available by updating a flag file that sits alongside the compiled rules. Software that uses the rules checks the flag and, when it is newer than the rule set it last loaded, reads the new rules. DTS works this way, and any other FreeGateway software that uses YARA can do the same.