From 1a5e02044e4ba43d012c511e4d791550638aa5a6 Mon Sep 17 00:00:00 2001 From: predictiple Date: Wed, 1 Jan 2025 12:44:11 +0200 Subject: [PATCH] Add yara linting example --- docs/references/vql.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/references/vql.yaml b/docs/references/vql.yaml index c74f9fd288..585ad043a3 100644 --- a/docs/references/vql.yaml +++ b/docs/references/vql.yaml @@ -11180,7 +11180,8 @@ SELECT * FROM rules -- Combine the rules and write to a single yar file. - -- We run yara_lint a 2nd time to get the imports at the beginning of the combined file. + -- We run yara_lint a 2nd time to get the imports at the beginning of the + -- combined file, although you could combine the rules first and then lint them. SELECT copy( accessor="data", filename=yara_lint(