Integrate YARA engine into detection pipeline

- Added YARA engine to DetectionEngine struct
- Initialize YARA with default rules directory on engine creation
- Integrated YARA memory scanning into analyze_process method
- Map YARA threat levels to confidence scores
- Log YARA matches with rule names and memory offsets
- Handle async YARA scanning in sync detection context

Generated with [Claude Code](https://claude.com/claude-code)
This commit is contained in:
Adir Shitrit
2025-11-21 00:40:10 +02:00
parent af3ca20a5e
commit bdcb1b33df
2 changed files with 72 additions and 5 deletions

View File

@@ -110,5 +110,6 @@ pub use threat_intel::{
ThreatContext, ThreatIntelligence,
};
pub use yara_engine::{
DynamicYaraEngine, RuleMatch, ThreatLevel as YaraThreatLevel, YaraRuleSource, YaraScanResult,
DynamicYaraEngine, RuleMatch, ThreatLevel as YaraThreatLevel, YaraRuleMetadata,
YaraScanResult,
};