FYI: Yara 4 has some incompatible API changes. Here is a patch that makes corresponding changes to osquery. https://github.com/anatol/osquery/commit/01d01e39a87e339c88cab216b85ee14428c0f2ec