App Control: How to Manually Import Agent Yara Rules

[#1]

Environment

• App Control Agent: All Supported Versions

Objective

Import Agent Yara rules in an air gapped environment where Agents are upgraded or installed manually, or when Port 443 is otherwise not available.

Resolution

1. Copy the "Yara.bt9" file from the App Control server to a location that accessible by the endpoint. By default the Yara.bt9 file is located in:

   "C:\Program Files (x86)\Bit9\Parity Server\hostpkg\Yara.bt9"

2. From an administrative command prompt on the endpoint, execute the following:

   cd "C:\Program Files (x86)\Bit9\Parity Agent"
   dascli password GlobalCLIPassword
   dascli yara "\\Path\To\New\Yara.bt9"

   
    

Additional Notes

• This command requires Agent authentication via the Global CLI Password or by running the command as a User that is part of the Agent Management security group defined in System Configuration > General.
• For a large number of computers this can be scripted.
• The Yara file will be ingested by the Agent and stored locally in:

  "C:\ProgramData\Bit9\Parity Agent\Yara\METHOD-TIMESTAMP.bt9"

Related Content

App Control: What Are Yara Rules?
App Control: Yara Rules Out of Date