Question

A detection engineer is authoring a YARA-L rule based on a published APT threat report. Leadership requires that every deployed rule be auditable, so analysts triaging an alert can immediately trace the rule back to the intelligence source, the analytic assumption, and any reference material used during authoring. Which approach in the rule's metadata section best satisfies this traceability requirement without affecting detection logic?

Accepted Answer

Populate the meta section with descriptive key-value fields such as author, description, reference (the report URL/ID), and rule_version so the provenance is embedded in and versioned with the rule.

Answer

Add the report URL as an inline comment above the events section, since comments are preserved through rule versioning and surface in alert context.

Answer

Encode the intelligence source into the rule name itself so it appears in every generated alert and is guaranteed to be searchable.

Answer

Store the report reference in a separate reference list and join it into the events section so the provenance is enriched onto each detection.