This procedure describes how to configure YARA rules-based analysis using the CLI. This feature can be configured using CLI commands only.
Prerequisites
Operator or Admin access
To enable or disable the use of custom YARA rules:
Go to CLI configuration mode.
vx-hostname > enable vx-hostname # configure terminal
Enable the compute node to use custom YARA rules in addition to Trellix-provided YARA rules:
vx-hostname (config) # yara policy both
Verify your changes. In the following example, the Intelligent Virtual Execution - Server appliance is configured to use both Trellix-provided and custom YARA rules:
vx-hostname (config) # show static-analysis config Static Analysis enabled : yes AV-suite enabled : yes AV-suite version : 6 SA on AV-suite whitelist enabled : no AV-check enabled : yes Dropper enabled : yes YARA enabled : yes Embedded object extraction enabled : no Embedded URL extraction enabled : yes Max URLs from files to be analyzed : 5 Static info policy : Disable Yara Configuration Yara policy : both Yara customer match limit : 3 ........
Save your changes.
vx-hostname (config) # write memory