-
-
Notifications
You must be signed in to change notification settings - Fork 95
Add a yara
operator
#3594
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add a yara
operator
#3594
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Lots of smaller comments; generally this works, but I think the default to match on individual chunks is dangerous and should be made an option instead. The default behavior of an operator should be what users want most of the time, and that isn't the case here as indicated by the warning in the documentation.
I'm approving because the required changes are really small and should not need another review. Please make them before merging, or let's postpone the blog post and discuss.
d7dad38
to
e3a4f31
Compare
This PR adds a
yara
operator that makes it possible to match YARA rules on byte chunks.