What this endpoint does

Retrieves the full result of a specific Auto YARA job, including the generated YARA rule text and pattern analysis. After creating a job with Create Auto YARA Job, poll this endpoint until status reaches FINISHED or FAILED. If the job fails, use Retry YARA Job to resubmit it. Once finished, you can refine the generated rule using Edit YARA Job. The job ID comes from the create response or from List YARA Jobs.

Response data

Returns the complete output of a YARA rule generation job — the auto-generated YARA rule ready for deployment to your detection infrastructure, plus the hex byte patterns the system identified as common across your submitted malware samples. Coverage analysis tells you which samples shared enough code to contribute to the rule versus which were too distinct to cluster — if all hashes land in uncovered, the samples don't share detectable patterns and you may need to refine your sample set. When a job is still running, the rule and pattern fields will be empty; poll until status reaches a terminal state. Note: the response is wrapped in a job envelope object.