create_triage_rule
Create custom YARA rules to detect forensic artifacts in digital investigations, specifying search locations and target organizations for automated triage.
Instructions
Create a new triage rule
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| description | Yes | A descriptive name for the triage rule | |
| rule | Yes | The YARA rule content | |
| searchIn | Yes | Where to search, e.g., "filesystem" | |
| engine | Yes | Rule engine to use, e.g., "yara" | |
| organizationIds | No | Organization IDs to associate with this rule. Defaults to [0] |