What this endpoint does

Creates a custom YARA rule for your sandbox organization. The rule source code is compiled and validated server-side on creation — a 400 means compilation failed, and the error message will contain the compiler output. Rule names must be unique (use a .yar extension by convention). For best integration with sandbox analysis results, include triage_score, description, and triage_description in your YARA rule's meta: section. After creation, verify the rule with Sandbox: Get YARA Rule to check for compilation warnings. Browse existing rules with Sandbox: List YARA Rules and modify them with Sandbox: Update YARA Rule.

Response data

Returns an empty JSON object {} on success — there is no confirmation payload with the created rule's details. To verify the rule was compiled cleanly (no warnings), follow up with a GET to the rule's endpoint. A 400 response indicates the YARA source failed compilation; the error message contains compiler diagnostics.

200Rule created successfully.

400Compilation error or duplicate name.