July 28, 2026
YARA-L Rule Structure
Every YARA-L rule follows five sections: meta (author, severity, MITRE mapping), events (UDM field conditions), match (grouping variable and time window), outcome (alert payload), and condition (firing threshold). YARA-L uses standard UDM fields and evaluates them continuously.
Your First Rule: Brute Force Login Detection
rule detect_brute_force_login {
meta:
author = "SecOps Team"
description = "Detects multiple failed login attempts from a single source"
severity = "MEDIUM"
mitre_attack = "T1110"
events:
$login.metadata.event_type = "USER_LOGIN"
$login.security_result.action = "BLOCK"
$login.principal.ip = $source_ip
$login.target.user.userid = $target_user
match:
$source_ip over 15m
outcome:
$failed_count = count($login)
$targeted_users = count_distinct($target_user)
$user_list = array_distinct($target_user)
condition:
$login and $failed_count >= 10
}
Section-by-Section Breakdown
meta: Descriptive fields for alerts. severity controls prioritization; mitre_attack maps to ATT&CK.
events: UDM conditions using $variable.field = value syntax. Placeholders like $source_ip extract values for match and outcome. Every line is an AND condition.
match: Groups events by $source_ip over 15 minutes, evaluating how many failed logins came from each IP.
outcome: Data payload for each detection. count($login) totals events, count_distinct($target_user) counts unique targets, array_distinct($target_user) lists them.
condition: Both $login and $failed_count >= 10 must be true for the rule to fire.
How to Deploy
Open the Rules Editor (Detection > Rules > Editor), paste the rule, and click Run Test to validate. Then Save and Enable. Test against historical data before production to avoid alert fatigue.
