What this endpoint does

This operation retrieves the current status, configuration, and results of a specific Auto YARA job. Use this endpoint to poll for job completion after creating a job via the Create Auto YARA Job endpoint — the status field progresses through CREATED, RUNNING, and FINISHED (or FAILED) states. Once the job reaches FINISHED status, the response includes the generated YARA rule, discovered hexadecimal byte patterns, and a coverage analysis showing which submitted hashes were successfully matched to patterns. If no common patterns were found across the submitted hashes, the yara_rule_str will be empty and all hashes will appear in the uncovered_hashes list.

Response data

The response contains a job object with the job's identity fields (job_id, name, status, created), the original query metadata, and result data. The yara_rule_str field contains the generated YARA rule (or an edited version if modified via the Edit YARA Job endpoint). The patterns array lists each discovered hexadecimal pattern with its matching_hashes and ascii interpretations. The coverage object provides covered_hashes (hashes that matched at least one pattern) and uncovered_hashes (hashes where no common patterns were found), which helps assess how effectively the generated rule covers the target sample set.