Question

Your threat intel team publishes a weekly CSV that maps known malicious infrastructure to attributes: an IP address, the associated threat actor group, and a confidence tier (high/medium/low). You are writing a YARA-L single-event rule that must (a) match outbound connections to any listed IP and (b) populate the resulting detection's outcome with the specific threat actor name and confidence tier for that IP so analysts can triage without a separate lookup. Which SecOps construct should back this rule to satisfy both requirements most maintainably?

Accepted Answer

Load the CSV into a data table keyed on IP, then reference the columns in the rule to both match the IP and pull the actor name and confidence tier into outcome variables.

Answer

Load the IPs into a reference list of type STRING and use the `in` operator, hardcoding the actor name and confidence tier as static outcome strings in the rule.

Answer

Create three separate reference lists (IPs, actor names, tiers) and join them positionally inside the rule condition using array index alignment.

Answer

Embed the full IP-to-actor-to-tier mapping directly in the rule as a series of `or` conditions, updating the rule text each week when the CSV changes.