https://github.com/osquery/osquery logo
m

mike maxwell

05/17/2021, 6:35 PM
If you have a Yarafile, that includes other yara files, when you do a query, only the TOP level Yara file is shown, not the file that caused that trigger. Is there a way display the Yara file that was triggered by the event?
s

seph

05/17/2021, 8:49 PM
I think the
matches
column is the rule name. Is that not sufficient?
3 Views