Run custom YARA rules on the specified endpoints to support threat investigation and incident response.
This task is supported by the following services:
-
Trend Vision One
-
Windows agent
-
Linux agent
-
After creating a workspace and add endpoints to the workspace in the Forensics app, you can collect detailed evidence from potentially compromised endpoints for
internal investigations into critical incidents that occurred on your network and
may require further attention.
Procedure
- In the Trend Vision One console, go to .
- Click the name of the workspace that contains the endpoints from which you want to
collect evidence.
Note
This task automatically adds all collected evidence to the workspace. - Execute your YARA rules.
- Click Run YARA Rules.
- Specify a task name.
- Specify the target to be scanned.
Important
If you do not specify any process name, all processes are scanned.Scanning all processes may take several minutes to complete. - Upload your YARA rules to the Forensics app.
-
Upload a text file that contains your YARA rules.
-
Paste your YARA rules to the text area.
- (Optional) Validate your YARA rules by clicking Validate Rules.
- (Optional) Specify a Description for the response or event.
- Click Create.Trend Vision One creates the task and displays the current task status in Response Management.
- Monitor the task status.
- Open Response Management.
- (Optional) Locate the task using the Search field or by selecting Run YARA Rules from the Action drop-down menu.
- View the task status.
-
In progress (
): Trend Vision One sent the command and is waiting for a response.
-
Queued (
): The managing server queued the command because the agent was offline.
-
Successful (
): The command was successfully executed.
-
Unsuccessful (
): An error or time-out occurred when attempting to send the command to the managing server, the agent is offline for more than 24 hours, or the command execution timed out.
-