Attention
Zercurity has been acquired by JumpCloud.
This documentation will no longer be maintained or updated. You can read more about the acquisition, or signup to JumpCloud today.
yara_events¶
Track YARA matches for files specified in configuration data.
Platform support¶
Please be aware that some queries can only be run against certain platforms. Below is a list of the supported platforms that this query supports. Zercurity will automatically pause queries from running if errors are detected. Running a query against an unsupported platform will result in the following error: no such table: yara_events
- Linux
- Mac OSX
Table schema¶
Name | Type | Description |
---|---|---|
target_path | TEXT | The path scanned |
category | TEXT | The category of the file |
action | TEXT | Change action (UPDATE, REMOVE, etc) |
transaction_id | BIGINT | ID used during bulk update |
matches | TEXT | List of YARA matches |
count | INTEGER | Number of YARA matches |
strings | TEXT | Matching strings |
tags | TEXT | Matching tags |
time | BIGINT | Time of the scan |
eid | TEXT | Event ID |