Question

A detection engineer is finalizing a multi-event YARA-L rule that correlates process-creation events with subsequent outbound network events over a 10-minute match window. During validation the rule compiles but the test run against 30 days of historical data times out repeatedly. Investigation shows the events section applies a `re.regex()` function with the `nocase` flag against the full `principal.process.command_line` field on every event before the join key is evaluated. Which change most directly reduces the rule's evaluation cost while preserving detection intent?

Accepted Answer

Add equality-based UDM field predicates (e.g., metadata.event_type and a specific principal.hostname condition) earlier in each event variable so the join key set is narrowed before the regex is applied

Answer

Increase the match window from 10 minutes to 60 minutes so more events are batched together and evaluated in a single pass

Answer

Move the regex evaluation into the outcome section as an aggregation so it runs only after events are grouped

Answer

Remove the nocase flag and rely on the join key alone, dropping the command_line inspection entirely