YARA rules should be managed via API and/or command line:
Add new rules
Save to disk
Enable rule in scanner
List enabled rules
Name, tags, metadata
Remove rule
I can create a YARA "index" class that handles loading the rules, compiling rules and saving to disk, and pass the compiled rules to the yara scanner as needed. that way users can still add rules, etc via API without the scanner also needing to be enabled. right now yara rules are only loading when the scanner is enabled and loads, and theres no good way to reload if new rules are added.
YARA rules should be managed via API and/or command line:
I can create a YARA "index" class that handles loading the rules, compiling rules and saving to disk, and pass the compiled rules to the yara scanner as needed. that way users can still add rules, etc via API without the scanner also needing to be enabled. right now yara rules are only loading when the scanner is enabled and loads, and theres no good way to reload if new rules are added.