Suricata

"The pattern matching swiss knife for malware researchers (and everyone else)" http://virustotal.github.io/yara/

License recently changed to BSD: https://github.com/VirusTotal/yara/commit/3a53f063c6ccd4849c6b8c58979bf3b609f881e6

It would be nice to support YARA rules to be applied to the file tracking/extraction in Suricata.

We decided over several discussions that we consider this out of scope for Suricata. I realize this may be disappointing especially to people of have already spent time on this. Our own views on this have shifted over time.

Some of the reasons are:

1. yara's concept of what a reasonable time to inspect is not in line with how Suricata works. Suricata threads can't block for long which is very different from yara which can take a much larger time budget

2. we got feedback that the libyara was too fragile to be used safely. I have no further details on this. In general we'd like to move to using Rust only for untrusted input.

3. file analysis frameworks that are in the post-processing pipeline running on data that suricata produces are a better location for yara or other expensive file analysis methods.