Chronicle YARA-L

rule outbound_dns { events: ... }

Write YARA-L rules in Google Chronicle that correlate UDM events (here, outbound DNS) to detect C2 and DNS exfiltration.

Use it when you want continuous detection over Chronicle's normalized data: YARA-L is Chronicle's rule language, and the rule defines the UDM events (metadata and entities) that match, with variables, aggregations, and time windows. The example outbound DNS rule detects the DNS C2 pattern: a host querying many distinct domains or rare domains in a short time. Chronicle runs the rules over the real-time stream and alerts feed the SOAR. It's the evolution from manual queries to operational detection on Google's platform.

Don't write it without knowing the UDM mapping of your sources: the rule depends on events arriving with the correct fields (metadata.event_type, principal.hostname, network.dns.questions.name) — if the connector doesn't map, the rule never matches. The performance of rules with many variables or heavy aggregations impacts cost: simplify and use windows judiciously. And watch out: YARA-L is not YARA — the syntax is Chronicle's own and errors are easy when starting out; validate each rule in the editor with real data before activating it. Overly broad rules (any rare domain) generate noise that ends up silenced: calibrate with the environment's baseline.