fleetdm
How to deploy Yara rules on fleet using API isn't documented
Problem
I want to deploy my YARA rules on fleet. In Remote deployment of YARA rules guide it is indicated that this can be done using API. However how to do it is not documented.
What have you tried?
I finally found that you need to use the /api/v1/fleet/config endpoint and provide "yara_rules" parameter.
In body of the PATCH request we have something like that :
{ "yara_rules": [ { "name": "rule_X", "contents": "rule X { ... }" }, { "name": "rule_Y", "contents": "rule Y { ... }" } ] }
Potential solutions
At the very least, the missing parameter yara_rules should be added to the table describing parameters of the endpoint who allow to modify fleet config.
@antoine-enalean thanks! What do you think? https://github.com/fleetdm/fleet/pull/27800
Thanks for the PR 🙂
Mmmhhhh i think we should also add the missing parameter yara_rules to the table describing parameters of the endpoint.
@antoine-enalean PR is merged and docs are updated!
Closing this issue but please let me know if we're missing anything.
API path unveils, YARA rules take flight in code, Secured, peace instilled.
