https://github.com/osquery/osquery logo
#general
Title
# general
p

peanut butter

10/09/2022, 9:43 AM
s

Stefano Bonicatti

10/09/2022, 9:49 AM
It has quotes, but I suggest checking the “latest” link (https://osquery.readthedocs.io/en/latest/deployment/yara/), because the whole format to express those url was incorrect in the wiki. The PR implementing it originally had that format but then it was changed before merging it.
n

nick fury

10/09/2022, 2:56 PM
i'm using osquery 4.8,
Copy code
"yara": {
  "signature_urls": [
    "<https://raw.githubusercontent.com/Yara-Rules/rules/master/cve_rules/CVE-2010-0805>\\.yar",
    "<https://raw.githubusercontent.com/Yara-Rules/rules/master/crypto/crypto_signatures>\\.yar",
    "<https://raw.githubusercontent.com/Yara-Rules/rules/master/malware/APT_APT3102>\\.yar",
    "<https://raw.githubusercontent.com/Yara-Rules/rules/devel/CVE_Rules/CVE-.*>"
  ]
}
does it still possible there?
s

Stefano Bonicatti

10/09/2022, 7:06 PM
Yes, the format never was the one on the wiki