Environment
- EDR Server: 7.x
- Yara-connector: 2.2.0-1 +
Objective
Configure cb-yara-connector to use a custom directory (not /var/cb/data).
Resolution
1. Modify
/etc/cb/integrations/cb-yara-connector/yaraconnector.conf
Modify line:
feed_database_dir=/var/cb/data/cb-yara-connector/feed_db
feed_database_dir=<custom directory>/feed_db
2. Modify
/etc/systemd/system/cb-yara-connector.service.
Change the line:
ExecStart=/usr/share/cb/integrations/cb-yara-connector/yaraconnector --pid-file /run/cb/integrations/cb-yara-connector/cb-yara-connector.pid --config-file /etc/cb/integrations/cb-yara-connector/yaraconnector.conf --daemon --log-file /var/log/cb/integrations/cb-yara-connector/yaraconnector.log --output-file /var/cb/data/cb-yara-connector/feed.json
To:
ExecStart=/usr/share/cb/integrations/cb-yara-connector/yaraconnector --pid-file /run/cb/integrations/cb-yara-connector/cb-yara-connector.pid --config-file /etc/cb/integrations/cb-yara-connector/yaraconnector.conf --daemon --log-file /var/log/cb/integrations/cb-yara-connector/yaraconnector.log --output-file <custom directory>/feed.json
3. Restart the daemon and the service.
Run:
systemctl stop cb-yara-connector
systemctl daemon-reload
systemctl start cb-yara-connector
Related Content
