chronicle/detection-rules

YARA-L shares a name with YARA and has nothing to do with it. YARA matches byte patterns in files; YARA-L 2.0 is Google SecOps' log detection language, matching against normalized events in Chronicle. If you arrived here expecting file-scanning signatures, this is the wrong source — try signature-base or the other YARA rulesets.

Rules run against Chronicle's UDM (Unified Data Model), a normalized event schema. Field paths like principal.ip, target.user.userid and metadata.event_type are UDM, not raw vendor fields, so a rule is portable across log sources in a way a vendor-specific query is not — provided the telemetry is mapped into UDM first.

A rule is a braced block with named sections:

rule geoip_user_login_from_multiple_states_or_countries {
  meta:
    author = "Google Cloud Security"
    severity = "Low"
  events:
    $login.metadata.event_type = "USER_LOGIN"
    $login.principal.ip_geo_artifact.location.country_or_region = $country
    $login.target.user.userid = $user
  match:
    $user, $product over 1h
  outcome:
    $risk_score = 35
    $dc_country = count_distinct(...)
  condition:
    $login and $dc_country > 1
}

• events declares event variables ($login) and binds placeholder variables ($user, $country) that later sections group on.
• match is the correlation window: grouping keys plus a duration. A rule with no match section is single-event.
• outcome computes aggregates and risk scores over the matched window.
• condition decides whether the whole thing fires.

The condition section, evaluated over whatever match grouped. Severity is a meta string, not a computed value, and outcome variables like $risk_score are additional signal Chronicle surfaces alongside the alert rather than a threshold that gates it.

ATT&CK mapping is thinner here than the rule count implies — it comes from meta fields, and many rules simply do not carry them.

Most of this repository is retired content. Google splits rules into rules/community/ and rules/_deprecated/, and the split is lopsided: 538 of the 917 rules are deprecated against 379 current. Nothing in a rule's body records this, so we derive the status from its path — which means the site-wide "hide deprecated" default works here, and the headline count on this page is current rules only. Use the include link beside it to see the rest.

• Searching the site for "YARA" returns both these log rules and genuine file-scanning YARA rules from three other sources. Filter by source or format to keep them apart.
• A deprecated Chronicle rule is not necessarily a bad rule — Google retires content when the underlying UDM mapping or product changes, not only when a detection stops working. Read it before discarding it.