I want to create a data table with users and IP subnet that has to be whitelisted from a detection rule. How can i do that. I have tried it this way as attached but it is not working. Can someone help me.
how to use data tables in YARA L Rules
+2
+22To perform a row match, at least one of the values in that row match must equal a value in the list. So user id would need to align to something in the list but then the cidr does not.
I could see a row match being something like this
principal.user.userid = %data_table.user
NOT net.ip_in_range_cidr($dns.principal.ip,%data_table.ip_subnet)
+12- Bronze 5
It looks like you're referencing it correctly. On the bottom left of the screen, does the table show as active in the detection? It should populate with the data table that is currently in use:
Alternatively, you can go to the data tables and view the "REFERENCED BY" tab.
If it is being referenced correctly, then the troubleshooting can be limited to syntax. I have also used the "not" expression for the data tables and it seems almost identical:
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.