Data Table Auto Update

Question

Hi,How can I update datatable values from an external source, one of the uses that we want to implement is keep a updated JA3 list, we can update this list from an external resource, via http, It is possible to autoupdate a datatable from an external .csv downloadable resource?The main idea is check with the https source if there’s any row addition/deletion/update and automatically perform the changes in the datatable. Best regards.

ar3diu · Answer

Interested in this as well. Other query languages, like KQL, have the option to load an external CSV within the search query.

The only way I have managed to solve this so far in YARA-L is through either an external job or one in SOAR that replaces the Data Table rows based on a computed hash.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded