Firepower YARA rules

ahmed_saleh — Mon, 01 Jun 2020 05:47:17 GMT

How i can deploy YARA rules by firepower

Re: Firepower YARA rules

kyoshiik — Mon, 01 Jun 2020 09:52:51 GMT

Please repost this question to Network Security thread.

(https://community.cisco.com/t5/network-security/bd-p/discussions-network-security)

Firepower uses AMP engine so if AMP itself supports Yara signature, maybe Firepower can have the same function. As far as I research AMP function, it has no function to implement Yara. AMP uses SHA-256, MD5 hash and ClamAV signature to detect malware. We can't convert from Yara to ClamAV signature(https://www.clamav.net/documents/using-yara-rules-in-clamav). So I think it's a quite low probability to have it in AMP and Firepower but not sure. So please post your question to Network Security thread.

topic Firepower YARA rules in Security Analytics

Firepower YARA rules

Re: Firepower YARA rules