{"resources":{"parse":{"id":"parse","fields":{"yara":{"name":"yara","type":"\u001bparse.yara","title":"Parsed YARA rule sets from a directory","desc":"Rule sets parsed from .yar and .yara files found recursively under a directory on disk, without loading them into the scanner's store. The path field selects the directory, for example `parse.yara(path: \"/etc/yara\").rulesets`. Use it to inspect rule content and metadata straight from source files, separate from what the scanner would run.","provider":"go.mondoo.com/cnquery/providers/yara","is_implicit_resource":true}},"is_extension":true},"parse.yara":{"id":"parse.yara","name":"parse.yara","fields":{"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path to the directory to search for .yar and .yara rule set files","provider":"go.mondoo.com/cnquery/providers/yara"},"rulesets":{"name":"rulesets","type":"\u0019\u001byara.ruleset","title":"Rule sets parsed from the .yar and .yara files found under the path","provider":"go.mondoo.com/cnquery/providers/yara"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"Parsed YARA rule sets from a directory","desc":"Rule sets parsed from .yar and .yara files found recursively under a directory on disk, without loading them into the scanner's store. The path field selects the directory, for example `parse.yara(path: \"/etc/yara\").rulesets`. Use it to inspect rule content and metadata straight from source files, separate from what the scanner would run.","defaults":"path","provider":"go.mondoo.com/cnquery/providers/yara"},"yara":{"id":"yara","fields":{"matchRule":{"name":"matchRule","type":"\u001byara.matchRule","title":"YARA rule match","desc":"Rule that matched during a scan, one entry per rule that fired against the scanned file. Exposes the matching rule's namespace and name, its tags, its meta annotations, and the individual pattern matches with their locations. Iterate result to review every detection, for example `yara.scan(path: \"/tmp/x\").result { rule tags strings.length }`.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/yara","is_implicit_resource":true},"matchString":{"name":"matchString","type":"\u001byara.matchString","title":"YARA matched string","desc":"One occurrence of a string pattern from a rule that matched the scanned file. Pinpoints the match by byte offset, line number, and length, and returns the matched bytes through data so you can see exactly what triggered the detection.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/yara","is_implicit_resource":true},"rule":{"name":"rule","type":"\u001byara.rule","title":"YARA rule","desc":"Single rule declared within a rule set, with the metadata annotations its author attached. The identifier names the rule, tags carry the labels from the rule header (for example `rule x : malware apt`), and the remaining fields surface well-known keys from the rule's meta block. Every meta value is read as text here, so numeric keys are exposed as strings except score and quality, which are parsed to integers.","is_private":true,"provider":"go.mondoo.com/cnquery/providers/yara","is_implicit_resource":true},"ruleset":{"name":"ruleset","type":"\u001byara.ruleset","title":"YARA rule set","desc":"Parsed contents of a single YARA rule set, the compiled form of one .yar or .yara file. The name field selects a rule set by its file base name (extension stripped), for example `yara.ruleset(name: \"malware_index\")`. Exposes the originating file name, a SHA-512 checksum field, the individual rules through rules, the raw rule text through source, and whether the content is built in or locally loaded through origin.","provider":"go.mondoo.com/cnquery/providers/yara","is_implicit_resource":true},"rulesets":{"name":"rulesets","type":"\u001byara.rulesets","title":"YARA rule sets available to the scanner","desc":"Collection of every YARA rule set loaded into the scanner's store, combining the malware and threat-detection rules built into the provider and any rule sets found under the local rules directory (~/.config/mondoo/yara/rules). Iterate the collection to inventory the detection content that a scan would run, or use builtIn to restrict it to the shipped rules. For example `yara.rulesets.where(origin == \"builtin\")` or `yara.rulesets { name rules.length }`.","provider":"go.mondoo.com/cnquery/providers/yara","is_implicit_resource":true},"scan":{"name":"scan","type":"\u001byara.scan","title":"YARA scan of a single file","desc":"Scan of one file on the target against a set of YARA rules. The path field selects the file to scan, for example `yara.scan(path: \"/tmp/suspicious.bin\").result`. By default the scan runs every rule set loaded into the store, but source can supply inline rule text to scan with instead, and rulesets and rules narrow the run to named rule sets or specific rule identifiers. The result field holds the rules that matched. Only a single file is allowed per scan, not a directory.","provider":"go.mondoo.com/cnquery/providers/yara","is_implicit_resource":true}},"is_extension":true},"yara.matchRule":{"id":"yara.matchRule","name":"yara.matchRule","fields":{"meta":{"name":"meta","type":"\u001a\u0007\n","is_mandatory":true,"title":"Metadata annotations of the matching rule","desc":"Map of the rule's meta block keyed by metadata name. Values keep their native YARA type (string, integer, or boolean) rather than being coerced to strings, so a numeric key such as \"score\" stays an integer. This differs from yara.rule, which reads every meta value as text.","provider":"go.mondoo.com/cnquery/providers/yara"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Namespace the matching rule was compiled under","desc":"YARA namespace assigned when the rule set was loaded, used to group rules and keep identifiers from colliding across sets.","provider":"go.mondoo.com/cnquery/providers/yara"},"rule":{"name":"rule","type":"\u0007","is_mandatory":true,"title":"Name of the rule that matched, its identifier from the rule declaration","provider":"go.mondoo.com/cnquery/providers/yara"},"strings":{"name":"strings","type":"\u0019\u001byara.matchString","is_mandatory":true,"title":"Pattern strings from the rule that matched, with their locations in the file","desc":"One entry per matching occurrence of a string pattern declared in the rule. Empty when the rule matched purely through its condition without any string pattern hits.","provider":"go.mondoo.com/cnquery/providers/yara"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags from the header of the matching rule","provider":"go.mondoo.com/cnquery/providers/yara"}},"title":"YARA rule match","desc":"Rule that matched during a scan, one entry per rule that fired against the scanned file. Exposes the matching rule's namespace and name, its tags, its meta annotations, and the individual pattern matches with their locations. Iterate result to review every detection, for example `yara.scan(path: \"/tmp/x\").result { rule tags strings.length }`.","private":true,"defaults":"rule","provider":"go.mondoo.com/cnquery/providers/yara"},"yara.matchString":{"id":"yara.matchString","name":"yara.matchString","fields":{"data":{"name":"data","type":"\u0007","is_mandatory":true,"title":"Raw bytes of the file that matched the pattern","desc":"Exact byte sequence at the match location, of length bytes starting at offset. May be empty when the match extends to the very end of the file.","provider":"go.mondoo.com/cnquery/providers/yara"},"length":{"name":"length","type":"\u0005","is_mandatory":true,"title":"Length in bytes of the matched data","provider":"go.mondoo.com/cnquery/providers/yara"},"lineNumber":{"name":"lineNumber","type":"\u0005","is_mandatory":true,"title":"Line number in the scanned file where the match begins, counting from 1","provider":"go.mondoo.com/cnquery/providers/yara"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"String identifier from the rule (for example \"$a\" or \"$mz\")","desc":"Pattern name as declared in the rule's strings section, a dollar sign followed by alphanumeric characters and underscores.","provider":"go.mondoo.com/cnquery/providers/yara"},"offset":{"name":"offset","type":"\u0005","is_mandatory":true,"title":"Byte offset from the start of the file where the match begins, counting from 0","provider":"go.mondoo.com/cnquery/providers/yara"}},"title":"YARA matched string","desc":"One occurrence of a string pattern from a rule that matched the scanned file. Pinpoints the match by byte offset, line number, and length, and returns the matched bytes through data so you can see exactly what triggered the detection.","private":true,"defaults":"lineNumber data","provider":"go.mondoo.com/cnquery/providers/yara"},"yara.rule":{"id":"yara.rule","name":"yara.rule","fields":{"author":{"name":"author","type":"\u0007","is_mandatory":true,"title":"Rule author, from the \"author\" meta key (empty when absent)","provider":"go.mondoo.com/cnquery/providers/yara"},"date":{"name":"date","type":"\u0007","is_mandatory":true,"title":"Creation date, from the \"date\" meta key (empty when absent)","desc":"Free-form date string exactly as written in the rule, commonly ISO 8601 (for example \"2023-05-14\"), with no enforced format.","provider":"go.mondoo.com/cnquery/providers/yara"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Human-readable description, from the \"description\" meta key (empty when absent)","provider":"go.mondoo.com/cnquery/providers/yara"},"identifier":{"name":"identifier","type":"\u0007","is_mandatory":true,"title":"Rule identifier, the name given to the rule in its declaration","provider":"go.mondoo.com/cnquery/providers/yara"},"licenseUrl":{"name":"licenseUrl","type":"\u0007","is_mandatory":true,"title":"License URL, from the \"license_url\" meta key (empty when absent)","provider":"go.mondoo.com/cnquery/providers/yara"},"modified":{"name":"modified","type":"\u0007","is_mandatory":true,"title":"Last-modified date, from the \"modified\" meta key (empty when absent)","provider":"go.mondoo.com/cnquery/providers/yara"},"quality":{"name":"quality","type":"\u0005","is_mandatory":true,"title":"Rule quality indicator, from the \"quality\" meta key","desc":"Integer quality rating parsed from the rule's \"quality\" meta key. Used by YARA-Forge, whose yaraQA tooling starts each rule at a base score and deducts points for logic and performance issues, so lower values flag noisier or lower-confidence rules. Defaults to 0 when the key is absent or not a valid integer.","provider":"go.mondoo.com/cnquery/providers/yara"},"reference":{"name":"reference","type":"\u0007","is_mandatory":true,"title":"Reference link for the detection, from the \"reference\" meta key (empty when absent)","desc":"URL or citation pointing at the threat report or analysis the rule is based on. Empty when the rule declares no reference.","provider":"go.mondoo.com/cnquery/providers/yara"},"score":{"name":"score","type":"\u0005","is_mandatory":true,"title":"Detection score, from the \"score\" meta key","desc":"Integer severity or confidence score parsed from the rule's \"score\" meta key, a convention used by collections such as signature-base and YARA-Forge where higher values indicate higher-confidence malware detections. Defaults to 0 when the key is absent or not a valid integer, so 0 does not by itself mean the rule is benign or low severity.","provider":"go.mondoo.com/cnquery/providers/yara"},"sourceUrl":{"name":"sourceUrl","type":"\u0007","is_mandatory":true,"title":"Source URL, from the \"source_url\" meta key (empty when absent)","desc":"Link to where the rule originated, set by aggregators such as YARA-Forge that record each rule's upstream repository.","provider":"go.mondoo.com/cnquery/providers/yara"},"tags":{"name":"tags","type":"\u0019\u0007","is_mandatory":true,"title":"Tags from the rule header, used to classify it (for example malware, apt, exploit)","desc":"Labels declared after the colon in the rule header, not values from the meta block. Tags follow YARA identifier rules (alphanumeric characters and underscores) and are commonly used to filter rules by threat class.","provider":"go.mondoo.com/cnquery/providers/yara"}},"title":"YARA rule","desc":"Single rule declared within a rule set, with the metadata annotations its author attached. The identifier names the rule, tags carry the labels from the rule header (for example `rule x : malware apt`), and the remaining fields surface well-known keys from the rule's meta block. Every meta value is read as text here, so numeric keys are exposed as strings except score and quality, which are parsed to integers.","private":true,"defaults":"identifier","provider":"go.mondoo.com/cnquery/providers/yara"},"yara.ruleset":{"id":"yara.ruleset","name":"yara.ruleset","fields":{"filename":{"name":"filename","type":"\u0007","is_mandatory":true,"title":"Path or name of the file the rule set was loaded from","desc":"For built-in rule sets this is the embedded file name; for locally loaded rule sets it is the path walked under the local rules directory.","provider":"go.mondoo.com/cnquery/providers/yara"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule set name, the file base name with the .yar or .yara extension removed","provider":"go.mondoo.com/cnquery/providers/yara"},"origin":{"name":"origin","type":"\u0007","is_mandatory":true,"title":"Where the rule set came from","desc":"Origin of the rule set: \"builtin\" for the detection content embedded in the provider, or \"local\" for rule sets read from the local rules directory. Filter on this to separate vendor-supplied rules from ones added on the host.","provider":"go.mondoo.com/cnquery/providers/yara"},"rules":{"name":"rules","type":"\u0019\u001byara.rule","title":"Individual rules declared in the rule set","desc":"List of every rule parsed from the file, each carrying its identifier, tags, and metadata annotations. Iterate to inventory detection logic, for example `yara.ruleset(name: \"x\").rules { identifier author score }`.","provider":"go.mondoo.com/cnquery/providers/yara"},"sha512":{"name":"sha512","type":"\u0007","is_mandatory":true,"title":"SHA-512 checksum of the rule set file","desc":"Hex-encoded SHA-512 digest of the rule set file content, intended for integrity checks and drift detection against a known-good baseline. Populated only when a rule set carries a precomputed digest; empty for the built-in and locally loaded rule sets this provider serves.","provider":"go.mondoo.com/cnquery/providers/yara"},"source":{"name":"source","type":"\u0007","title":"Raw rule text of the rule set, the full .yar source","provider":"go.mondoo.com/cnquery/providers/yara"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"YARA rule set","desc":"Parsed contents of a single YARA rule set, the compiled form of one .yar or .yara file. The name field selects a rule set by its file base name (extension stripped), for example `yara.ruleset(name: \"malware_index\")`. Exposes the originating file name, a SHA-512 checksum field, the individual rules through rules, the raw rule text through source, and whether the content is built in or locally loaded through origin.","defaults":"name","provider":"go.mondoo.com/cnquery/providers/yara"},"yara.rulesets":{"id":"yara.rulesets","name":"yara.rulesets","fields":{"builtIn":{"name":"builtIn","type":"\u0019\u001byara.ruleset","title":"Rule sets shipped with the provider","desc":"Subset of the full collection limited to rule sets whose origin is \"builtin\", the malware and threat-detection rules embedded in the provider binary. Use it to audit only the vendor-supplied content and exclude rule sets loaded from the local rules directory.","provider":"go.mondoo.com/cnquery/providers/yara"},"list":{"name":"list","type":"\u0019\u001byara.ruleset","provider":"go.mondoo.com/cnquery/providers/yara"}},"list_type":"\u001byara.ruleset","title":"YARA rule sets available to the scanner","desc":"Collection of every YARA rule set loaded into the scanner's store, combining the malware and threat-detection rules built into the provider and any rule sets found under the local rules directory (~/.config/mondoo/yara/rules). Iterate the collection to inventory the detection content that a scan would run, or use builtIn to restrict it to the shipped rules. For example `yara.rulesets.where(origin == \"builtin\")` or `yara.rulesets { name rules.length }`.","provider":"go.mondoo.com/cnquery/providers/yara"},"yara.scan":{"id":"yara.scan","name":"yara.scan","fields":{"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Path of the file to scan on the target","provider":"go.mondoo.com/cnquery/providers/yara"},"result":{"name":"result","type":"\u0019\u001byara.matchRule","title":"Rules that matched the scanned file, one entry per rule that fired","provider":"go.mondoo.com/cnquery/providers/yara"},"rules":{"name":"rules","type":"\u0019\u0007","title":"Rule identifiers to restrict the scan to","desc":"Filter that limits evaluation to rules whose identifier appears in this list; other rules in the selected rule sets are stripped before compilation. An empty list evaluates every rule in the selected rule sets.","provider":"go.mondoo.com/cnquery/providers/yara"},"rulesets":{"name":"rulesets","type":"\u0019\u0007","title":"Names of the rule sets to restrict the scan to","desc":"Filter that limits the scan to loaded rule sets whose name appears in this list. An empty list scans against all loaded rule sets. Ignored when source supplies inline rules.","provider":"go.mondoo.com/cnquery/providers/yara"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Inline rule text to scan with instead of the loaded rule sets","desc":"Complete YARA rule source supplied directly to the scan. When set, the scan compiles and runs only these rules and ignores the loaded rule sets. Carriage returns are normalized to newlines before compilation. Leave empty to scan against the loaded rule sets.","provider":"go.mondoo.com/cnquery/providers/yara"}},"init":{"args":[{"name":"path","type":"\u0007"}]},"title":"YARA scan of a single file","desc":"Scan of one file on the target against a set of YARA rules. The path field selects the file to scan, for example `yara.scan(path: \"/tmp/suspicious.bin\").result`. By default the scan runs every rule set loaded into the store, but source can supply inline rule text to scan with instead, and rulesets and rules narrow the run to named rule sets or specific rule identifiers. The result field holds the rules that matched. Only a single file is allowed per scan, not a directory.","defaults":"path","provider":"go.mondoo.com/cnquery/providers/yara"}}}