Skip to main content

Test a YARA source against a report

POST 
/detection/yara/test

Compiles content and scans one report you can read with it, without saving anything. Each script and stored response body is scanned on its own, as during analysis. Response bodies that aren't stored (such as images), files inside archives, anything past 200 resources or 32 MiB, and scans that time out are counted in skipped. A source that does not compile is a successful call with valid: false, and nothing is scanned. A report that doesn't exist or that you can't read returns 404, once the source compiles. Quota class yara_write.

Request​

Responses​

The compile result and the matches.

Response Headers
    RateLimit-Policy

    The minute, hour, and day limits of the governing quota, for example 50;w=60, 500;w=3600, 500;w=86400.

    RateLimit-Limit

    Limit of the governing window.

    RateLimit-Remaining

    Requests remaining in the governing window.

    RateLimit-Reset

    Seconds until capacity is available in the governing window.