How should a composite YARA-L rule access outcome variables from a child rule now that detection.detection.outcomes is deprecated?

Question

According to the Google SecOps documentation, an outcome variable from a child detection rule can be accessed in a composite rule using a path such as:

e.g. detection.detection.outcomes["dest_domain"]

Link :- https://docs.cloud.google.com/chronicle/docs/yara-l/composite-detection-rules#reference_detection_content_with_variables_or_meta_labels

However, when I use this field in a YARA-L composite rule, I receive the following warning:
outcomes field is deprecated and might not populate as expected.

I have not been able to find an alternative field or updated syntax in the documentation.
My requirement is to pass a variable that is calculated only in the child rule’s outcome section and use it in the parent composite rule.

AymanC · Answer

Hi ​@Mufa_shah,A very interesting finding, especially since this field is being referenced in fairly recent community posts, i,.e:I’d be inclined to say this is probably not a deprecated field, and works fine in our environment.Kind Regards,Ayman

Sign up

Login with SSO

Login to the community

Login with SSO