# Use Yara custom rules with Osquery-Manager

**URL:** <https://discuss.elastic.co/t/use-yara-custom-rules-with-osquery-manager/302789>\
**Category:** Beats\
**Tags:** fleet, elastic-agent, osquery-manager\
**Created:** [April 20, 2022, 10:02am UTC](https://discuss.elastic.co/t/use-yara-custom-rules-with-osquery-manager/302789 "2022-04-20T10:02:10Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![A\_Abdellah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_abdellah/32/100734_2.png) [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\
**Post date:** [April 20, 2022, 10:02am UTC](https://discuss.elastic.co/t/use-yara-custom-rules-with-osquery-manager/302789/1 "2022-04-20T10:02:10Z")

</div>

Hello Team,

Is It possible to use yara custom rules with osquery manager integration ??  
I'm using version 7.17.1

Many thanks.

---

<div class="post-metadata">

**Author:** ![jamesspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesspi/32/24479_2.png) [@jamesspi](https://discuss.elastic.co/u/jamesspi)\
**Post date:** [April 20, 2022, 10:06am UTC](https://discuss.elastic.co/t/use-yara-custom-rules-with-osquery-manager/302789/2 "2022-04-20T10:06:17Z")

</div>

Hey, yes. This is totally possible.

---

<div class="post-metadata">

**Author:** ![jamesspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesspi/32/24479_2.png) [@jamesspi](https://discuss.elastic.co/u/jamesspi)\
**Post date:** [April 20, 2022, 11:51am UTC](https://discuss.elastic.co/t/use-yara-custom-rules-with-osquery-manager/302789/3 "2022-04-20T11:51:31Z")

</div>

Sorry, meant to reply with some additional detail. Here's an example:

```auto
SELECT * FROM yara WHERE path LIKE '/var/www/html/images/%' AND count > 0 AND sigrule IN ( 'rule Mozi { strings: $a = { 55 50 58 21 [4] 00 00 00 00 00 00 00 00 00 00 00 00 } condition: all of them and $a in (0 .. 255) }');

```

 ![Screenshot 2022-04-20 at 13.49.53](https://us1.discourse-cdn.com/elastic/original/3X/a/0/a0fae11fcd8f13629bf2db57f6b170bfb209d634.png)

If you want to include the strings in the tabular output, you'll need to add the following to the osquery manager integration config:

```auto
{
  "options": {
    "enable_yara_string": true
  },
  "packs": {}
}

```

 ![Screenshot 2022-04-20 at 13.50.25](https://us1.discourse-cdn.com/elastic/original/3X/f/6/f6afa9d27946a58fcffa5326fb770807e08b7f0e.png)

---

<div class="post-metadata">

**Author:** ![A\_Abdellah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_abdellah/32/100734_2.png) [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\
**Post date:** [April 20, 2022, 3:03pm UTC](https://discuss.elastic.co/t/use-yara-custom-rules-with-osquery-manager/302789/4 "2022-04-20T15:03:16Z")

</div>

Thank you very much, I'm going to try it.

---

<div class="post-metadata">

**Author:** ![A\_Abdellah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_abdellah/32/100734_2.png) [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\
**Post date:** [April 21, 2022, 6:22pm UTC](https://discuss.elastic.co/t/use-yara-custom-rules-with-osquery-manager/302789/5 "2022-04-21T18:22:52Z")

</div>

thank you very much.  
It's working great but noticed that `path LIKE 'dir1/%'` is not recursive, can I do anything about this ?

---

<div class="post-metadata">

**Author:** ![jamesspi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesspi/32/24479_2.png) [@jamesspi](https://discuss.elastic.co/u/jamesspi)\
**Post date:** [April 25, 2022, 11:45am UTC](https://discuss.elastic.co/t/use-yara-custom-rules-with-osquery-manager/302789/6 "2022-04-25T11:45:06Z")

</div>

You would need something like `path LIKE 'dir1/%/%'` I believe.

---

<div class="post-metadata">

**Author:** ![A\_Abdellah](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_abdellah/32/100734_2.png) [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\
**Post date:** [May 9, 2022, 11:23am UTC](https://discuss.elastic.co/t/use-yara-custom-rules-with-osquery-manager/302789/7 "2022-05-09T11:23:00Z")

</div>

Thank you very much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2022, 1:23pm UTC](https://discuss.elastic.co/t/use-yara-custom-rules-with-osquery-manager/302789/8 "2022-06-06T13:23:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.