Updated YARA rules do not re-alert
Open
analyzer
YARA
- Dominant language
- Python
- Stars
- 1.5k
- Forks
- 179
- PR merge metrics
- No merged PRs in 30d
Description
All YARA matches are saved to DynamoDB, but alerts are only sent to SNS if the YARA rule name has not matched before on the given binary. There are two problems with this:
1. Rules which are renamed or reorganized will re-trigger alerts
2. Rules whose content changes (e.g. a different rule condition) will *not* re-trigger an alert
Instead of looking up based on the rule name, there should be a comparison against some kind of hash of the YARA rule contents
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.