Hi everyone How to update yara files from kolide fleet serve

Question

Hi everyone How to update yara files from kolide fleet server to all client

poisonous97 · Answer

i want to use yara table but i must create sig files in client How to mgt it for 1000 clients

seph · Answer

Are you asking about Kolide s SaaS or about Fleet

seph · Answer

regarding launcher we do not maintain a mechanism to distribute yara configuration You may be able to use other tool or to use the newer yara rule funtions

seph · Answer

Yara rules can be distributed by URL or embeded in the queries

poisonous97 · Answer

`Yara rules can be distributed by URL` Could you show me the example

poisonous97 · Answer

i am using kolile fleet + launcher

seph · Answer

<https github com osquery osquery pull 6607|https github com osquery osquery pull 6607> and 6568

poisonous97 · Answer

thank you great =

seph · Answer

Kolide no longer maintains fleet You may wish to loo at fleet for the community and vendors there We do maintain launcher it is the agent for our SaaS

poisonous97 · Answer

`W0127 09 17 21 964015 60020 yara cpp 247 Failed to get YARA rule url sig url 2` i have a problem

poisonous97 · Answer

< seph> i dont find flag to enable it

seph · Answer

I don t understand your question

seph · Answer

Launcher has nothing related to this

seph · Answer

If you need to pass a flag to osquery set it in osquery s config or use launcher s `osquery flag`

poisonous97 · Answer

`W0127 09 17 21 964015 60020 yara cpp 247 Failed to get YARA rule url sig url 2`

poisonous97 · Answer

The feature will be disabled by default and can be enabled with a hidden flag `enable yara sigurl`

poisonous97 · Answer

but i dont find enable yara sigurl flag

seph · Answer

That s an osquery flag

poisonous97 · Answer

but osquery dont have this flag slightly smiling face

seph · Answer

I m not sure that flag is needed Have you either read the PR or tried this

poisonous97 · Answer

i tried it return err is `W0127 09 17 21 964015 60020 yara cpp 247 Failed to get YARA rule url sig url 2`