maybe someone here can help me? https://osquery.slack.com/archives/C08V7KTJB/p1667498031761929?thread_ts=1667417810.607959&cid=C08V7KTJB

@peanut butter Did you add the missing comma that @zwass pointed out and restart

osquery

? If you add a rule directly to the configuration file, does that rule work properly?

https://osquery.slack.com/archives/C01DXJL16D8/p1667577306951229?thread_ts=1667576895.324369&cid=C01DXJL16D8 yes

Hey @peanut butter. I may have missed a response in here somewhere... are you able to scan using a rule defined in the configuration or an inline rule?

do you mean something like that? "signatures": { // Each key is an arbitrary group name to give the signatures listed "sig_group_1": [ "/Users/wxs/sigs/foo.yar", "/Users/wxs/sigs/bar.yar" ], "sig_group_2": [ "/Users/wxs/sigs/baz.yar" ] },

And did you try this suggestion in the original thread? (I know that's relatively recent, but it's a good test!: https://osquery.slack.com/archives/C08V7KTJB/p1668008703107579?thread_ts=1667417810.607959&cid=C08V7KTJB

@Kathy Satterlee I think that my error is because, for some reason my osquery agent get do get request to that url properly, because the conf file is valid, and I get only that two lines of error: YARA signature url "{my ulr}" not allowed Failed to get YARA rule url: "{my ulr}", and that error is also happens when I give him some fake url. but this is strange because when I do curl "{my url}" it works.

Can you share your updated config?

sorry i accidently writed not allowed

If you could send the updated config, that would be great! Feel free to DM it to me if you'd prefer. If you could also send me the actual url, I could test it out myself and hopefully save you some back and forth 🙂

we just tested it and it works, on http on localhost

is the osquery configured to use the CA that issued the certificate for the web server you are trying to reach ?

yes

Can you try applying the config like this? (from other thread in genearl?

"yara": { 
   "signature_urls": [
     "<https://dev.prod.rules/.*>"
   ]
 }

yes didn't work