YARA

In the Ultra Transcenders books

VBR-13

Each book explains YARA in context, with comparison tables and the common traps.

Terms in this definition

• Pattern

  A reusable answer to a recurring problem that places building blocks in context, explaining when, how and why to apply them and what compromises are involved.

• APPLY

  Evaluates a table-valued expression for every row on its left, inside FROM. Think of OUTER APPLY as a left outer join and CROSS APPLY as an inner join.

• RESTORE

  Puts a Delta table back to how it was at an older point, picked by TO VERSION AS OF or TO TIMESTAMP AS OF. You need MODIFY, and once VACUUM has cleared the old files it can't succeed.

• Scan Backup

  Searches restore points that already exist for signs of malware, with Veeam Threat Hunter, an antivirus product or YARA rules doing the work. It helps identify the most recent clean point or look through what a backup contains, and no data is written back, which is where it differs from Secure Restore.

• Secure Restore

  Before any data reaches the target, the chosen restore point is mounted on the mount server and checked with Veeam Threat Hunter, antivirus software or YARA rules. Infected files therefore stay out of production.

• SureBackup

  Veeam's recoverability check: machines are started from their backups inside an isolated virtual lab and their applications are tested to confirm they work. The check itself is carried out by a SureBackup job.

Related terms

• malware detection

  Veeam and third-party checks that look for infected workloads or suspicious activity and raise events. They examine backups, the data stream and indexing data; Scan Backup with Threat Hunter, YARA or antivirus belongs here.

• SuppressMalware​Detection​Notification

  Putting this tag in a YARA rule's name means a match will not raise a malware detection event, though scanning still runs to the end.