Enable/Disable a YARA rule

Enabling/Disabling certain Yara rules can have a significant impact on detection capabilities but also can reduce alert noise for more broader rules that cast a wide net.

To enable or disable a rule, navigate to the Yara rules tab and select the rule you wish to make changes to:

The toggle switch at the top right of the lower (rule body) pane is how we enable or disable a single rule. Conversely, multiple rules can have their status changed by selecting the rules you want and then clicking the three dots at the top right corner of the rule listing pane:

🚧

Warning

Do note that by default, inactive rules are hidden in the rules list and you must uncheck "Hide inactive rules" in order to see them.