What this endpoint does

Lists all custom YARA rules accessible by your account. Returns rule filenames only — use Sandbox: Get YARA Rule to retrieve the full source code and compilation warnings for a specific rule. YARA rules run automatically during sandbox analysis; when a submitted sample matches a rule, the match appears in the signatures array of Sandbox: Get Sample Overview and Sandbox: Get Dynamic Report with is_custom: true. Add new rules with Sandbox: Create YARA Rule.

Response data

Returns the filenames of all YARA rules in your organization's rule set — these are the custom detection rules that will be matched against every sample the sandbox analyzes. The response contains names only, not rule content. Use these names as the {ruleName} path parameter in the get, update, and delete endpoints. Note the response uses a rules key (not data), which differs from most other sandbox list endpoints.