During YARA static analysis, Trellix identifies and reports on the first five matching YARA rules. YARA rules are specific enough that only one or two rules will match malicious samples at a time; therefore, more than five matches are rare.
Note
You cannot configure YARA rules using the sensor CLI.
Prerequisites
An established connection between the Network Security appliance and the Internet.
Administrator or Operator access to the Network Security appliance.
To configure the limit for matching YARA rules:
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Specify the limit for YARA matches.
hostname (config) # yara match limit <number>
where:
<number>is an integer between 0 and 100 for customer YARA rules. Any number larger than 100 is truncated to 100.Verify your configuration.
hostname (config) # show static-analysis config ..... Yara Configuration ..... Yara customer match limit : 5
Save your changes.
hostname (config) # write memory