Add yara linting example

Velocidex · Jan 1, 2025 · 1a5e020 · 1a5e020
1 parent 1c34d04
commit 1a5e020
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/docs/references/vql.yaml b/docs/references/vql.yaml
@@ -11180,7 +11180,8 @@
     SELECT * FROM rules
 
     -- Combine the rules and write to a single yar file.
-    -- We run yara_lint a 2nd time to get the imports at the beginning of the combined file.
+    -- We run yara_lint a 2nd time to get the imports at the beginning of the
+    -- combined file, although you could combine the rules first and then lint them.
     SELECT copy(
             accessor="data",
             filename=yara_lint(