The Investigation Insights – Yara Finder integration utilizes the Google Custom Search Engine to search different sites for known Yara rules. Allowing analysts to quickly find and understand what might be happening with malware.
Please check out the reference links for all the sites the integration utilizes.
For more on Google Custom Search Engines please see: https://developers.google.com/custom-search/v1/overview
Examples
Yara Finder Data Overview
- Summary Tags: When running a search with the Yara Finder integration, analysts can quickly determine if there are any rules associated with their search. For example searching for a hash they can find any associated rules with that hash.
- Site Search: When drilling into the details of the Yara Finder integration analysts can re-run searches on different sites if they wanted to narrow their search results down.
- Results: Analysts can quickly go through the different results that have associated information about their search and get a synopsis of it and then pivot to the result for further analysis.
