Question

A detection engineer is building a new YARA-L 2.0 multi-event rule in Google SecOps. The rule must be attributed to a specific analyst team, must automatically deprecate older rule iterations when a newer version is promoted, and must allow the SOC lead to filter all rules owned by the 'threat-detection' team in the rule dashboard. Which YARA-L rule construct should the engineer use to satisfy the ownership and filtering requirement without affecting detection logic?

Accepted Answer

Add custom key-value pairs such as owner = "threat-detection" under the meta section of the rule

Answer

Encode the team name inside the rule name string using an underscore-delimited prefix

Answer

Add an owner field to the events section and reference it as a match variable

Answer

Set the team name as an outcome variable so it appears on every generated detection