+2Hi,
How can I update datatable values from an external source, one of the uses that we want to implement is keep a updated JA3 list, we can update this list from an external resource, via http, It is possible to autoupdate a datatable from an external .csv downloadable resource?
The main idea is check with the https source if there’s any row addition/deletion/update and automatically perform the changes in the datatable.
Best regards.
+11Interested in this as well. Other query languages, like KQL, have the option to load an external CSV within the search query.
The only way I have managed to solve this so far in YARA-L is through either an external job or one in SOAR that replaces the Data Table rows based on a computed hash.
+6I’m not aware of any command in YARA-L to natively make a curl to external sources.
This post from
another option could be ingest recurrently the list as events or entities, and through a scheduled rule consolidate them into the data table using the yara export %table.write_row()
https://docs.cloud.google.com/chronicle/docs/investigation/data-tables#write-yara-l
+2Appreciate your answers; they're very interesting, but I'm looking for something self-contained in the SIEM or SOAR.
Can anybody know if it is possible?
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
