Possible to use Yara command line options?

[PhantasmalBow]

If you run yara standalone from the command line you can use options like -L or -s. Is it possible to add those in the configuration somewhere?

[aaguero96]

Short answer: no — those are flags of the yara CLI binary, and Strelka never shells out to it. ScanYara uses yara-python directly, so there's no place to pass them through.

From src/python/strelka/scanners/scan_yara.py:

import yara
...
self.compiled_yara = yara.compile(filepaths=yara_filepaths)
...
yara_matches = self.compiled_yara.match(data=data)

-L, -s, -m, -g are declared in cli/yara.c purely as output-formatting switches for what the binary prints to stdout. yara-python hands back match objects instead, and Strelka decides what goes into the event — so the useful question is which ScanYara options expose the same data. Most already exist in backend.yaml:

CLI flag	What it does	Strelka equivalent
-g --print-tags	print tags	always on → event["tags"] (de-duplicated)
-m --print-meta	print metadata	show_all_meta: true → event["meta"], or meta_fields: [...] to select keys
-s --print-strings	print matching strings	store_offset: true + offset_meta_key → event["hex"] (hexdump with context, not the raw string)
-L --print-string-length	print matched length	not emitted today
-e --print-namespace	print namespace	partial — namespace lands as ruleset, but only for categories with show_meta: True
-f --fast-scan	fast matching mode	not exposed; match() is called without fast=True

One gotcha worth calling out on the -s equivalent: store_offset alone isn't enough, because the hexdump is gated per-rule:

if self.store_offset and self.offset_meta_key:
    if match.meta.get(self.offset_meta_key):

The rule itself has to carry that meta key. The shipped backend.yaml uses:

store_offset: True
offset_meta_key: "StrelkaHexDump"
offset_padding: 32

so you need StrelkaHexDump = true in a rule's meta before anything shows up in event["hex"]. Note offset_padding is split evenly around the match (half_padding = offset_padding // 2), so the default 32 gives you ~16 bytes of context on each side, not 32.

If you specifically want true -s semantics (the literal matched bytes) or -L (lengths), the data is already in the loop — instance.matched_data is right there next to instance.offset — it just isn't written to the event. That would be a small scanner change rather than a config one.