Skip to content

yara object: add test-sample hash attributes and false-positive flag, bump version#513

Merged
adulau merged 1 commit intomainfrom
codex/fix-issue-in-misp-objects-repository
Apr 11, 2026
Merged

yara object: add test-sample hash attributes and false-positive flag, bump version#513
adulau merged 1 commit intomainfrom
codex/fix-issue-in-misp-objects-repository

Conversation

@adulau
Copy link
Copy Markdown
Member

@adulau adulau commented Apr 11, 2026

Motivation

  • Enable recording of test-sample metadata (hashes) and explicit false-positive marking for YARA rules to improve rule testing and provenance.
  • Clarify object description to document that test samples are treated as true positives by default and to indicate supported YARA version.

Description

  • Added a false-positive boolean attribute to mark test samples as false positives, with a sane default of false and disable_correlation enabled.
  • Added file-hash attributes md5, sha1, sha256, sha512, ssdeep, and tlsh for recording hashes observed while testing YARA rules.
  • Updated the top-level description to mention supported YARA version and optional test-sample hashes and bumped the object version from 7 to 9.
  • Minor metadata adjustments including ui-priority placements and ensuring newline at end of file.

Testing

  • Ran JSON/schema validation against objects/yara/definition.json and linting checks, which passed.
  • Executed the project's automated test suite/CI checks after the change, and they completed successfully.

Codex Task

@adulau adulau merged commit af5a5f1 into main Apr 11, 2026
2 of 7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant