Options section syntax

The options section of a YARA-L query is only available for Rules.

You can specify options using the syntax key = value , where key must be a predefined option name and value must be a valid value for the option:

 rule RuleOptionsExample {
  // Other rule sections

  options:
    allow_zero_values = true
} 

Options values

The following values for options are available:

• allow_zero_values

• suppression_window

allow_zero_values option

The valid values for allow_zero_values option are true and false (default), which determine if the option is enabled or not. The allow_zero_values option is disabled if it's not specified in the query.

To enable the allow_zero_values setting, add the following to the options section of your query: allow_zero_values = true

This action prevents the query from implicitly filtering out the zero values of placeholders that are used in the match section, as described in Zero values in match section .

suppression_window option

The suppression_window option lets you control how often a rule triggers a detection. It prevents the same rule from generating multiple detections within a specified time window, even if the query's conditions are met multiple times.

Suppression windowing uses a tumbling window approach, which suppresses duplicates over a fixed-size, non-overlapping window.

You can optionally provide a suppression_key to further refine which instances of the query are suppressed within the suppression window. If not specified, all instances of the query are suppressed. This key is defined as an outcome variable and is only considered for single event queries .

Multiple event queries will use the match variables from the match section to determine what should be suppressed. The suppression_window value must also be greater than the match window.

The default value of suppression_window is 0 ; that is, the suppression window is disabled by default.

rule SingleEventSuppressionWindowExample {
  // Other rule sections

  outcome:
    $suppression_key = $hostname

  options:
    suppression_window = 5m
}

rule MultipleEventSuppressionWindowExample {
  // Other rule sections

  match:
    $hostname, $ip over 10m

  options:
    suppression_window = 1h
}

Additional information

• Expressions, operators, and constructs used in YARA-L 2.0
• Functions in YARA-L 2.0
• Build composite detection rules
• Examples: YARA-L 2.0 queries

Need more help? Get answers from Community members and Google SecOps professionals.