What this endpoint does

Retrieves the full source code and compilation status of a YARA rule by filename. Use Sandbox: List YARA Rules to discover available rule filenames. After creating a rule with Sandbox: Create YARA Rule, call this endpoint to verify compilation succeeded and check for warnings. To modify a rule, use Sandbox: Update YARA Rule.

Response data

Returns the rule filename, complete YARA source code, and an array of compilation warnings. Warnings typically flag missing metadata fields (triage_score, description, triage_description) that affect how rule matches appear in analysis reports — these aren't errors, but rules without this metadata provide less context in results. An empty warnings array means the rule compiled cleanly with all recommended metadata present.