Timestamp.now

Hi @Omskirt.   You may want to bookmark the SecOps Release Notes page to browse the high level release notes for each release.  In here, you can get more information about Parser updates, changes to UDM fields (like deprecation of existing fields) and more.

timestamp.now is a YARA-L 2.0 function that you can leverage in both Rules and Search.

Aside from that, Is there any demo or example on how to use the new features in YARA-L? I am very much looking forward to any references on that, as I sometimes find it confusing when applying the queries

Here is an example using this function. The function is the same as timestamp.curent_seconds()

metadata.event_type = "NETWORK_CONNECTION"
principal.ip = $pip
target.ip = $tip
net.ip_in_range_cidr(principal.ip, "10.128.0.0/24") and net.ip_in_range_cidr(target.ip, "10.128.0.0/24") and network.sent_bytes > 0
match:
  $pip, $tip
outcome:
  $event_count = count_distinct(metadata.id)
  $current_seconds = timestamp.current_seconds()
  $now = timestamp.now()
  $max_minutes_since_event = max(timestamp.diff($now, metadata.event_timestamp.seconds, "MINUTE"))
order:
  $event_count desc

metadata.event_type = "NETWORK_CONNECTION"
principal.ip = $pip
target.ip = $tip
net.ip_in_range_cidr(principal.ip, "10.128.0.0/24") and net.ip_in_range_cidr(target.ip, "10.128.0.0/24") and network.sent_bytes > 0
match:
  $pip, $tip
outcome:
  $event_count = count_distinct(metadata.id)
  $current_seconds = timestamp.current_seconds()
  $now = timestamp.now()
  $max_minutes_since_event = max(timestamp.diff($now, metadata.event_timestamp.seconds, "MINUTE"))
order:
  $event_count desc

Ow got it, But what’s the value of this timestamp.now compare to current seconds? Or there are just the same only? Nothing more? Thanks

I see, thanks for letting me know this. Much clearer now. 

@Omskirt - The functions with examples are documented here - https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-syntax#functions_2