What this endpoint does

This operation creates an asynchronous Auto YARA job that analyzes a set of malware samples (identified by SHA-256 hashes) to discover common hexadecimal byte patterns and generate YARA detection rules. Unlike Auto Sigma jobs which use a query to discover samples, Auto YARA requires you to provide specific SHA-256 hashes of the samples to analyze (up to 100 per job). The optional query field records the query used to find those hashes for reference but does not affect sample selection. After creating a job, use the Get YARA Job endpoint with the returned job ID to poll for completion and retrieve the generated YARA rules. Use the Get YARA Jobs endpoint to list all your Auto YARA jobs.

Response data

The response contains a job_id (UUID) that uniquely identifies the created YARA rule generation job. This ID is required to check job status and retrieve generated YARA rules via the Get YARA Job endpoint, edit the job via the Edit YARA Job endpoint, retry a failed job via the Retry YARA Job endpoint, or delete the job via the Delete YARA Job endpoint. Jobs process asynchronously, so poll the Get YARA Job endpoint to monitor progress.