What is YARA-L?

YARA-L is the detection rule language used by Google SecOps's detection engine, derived from the syntax of classic YARA (originally created by VirusTotal for malware pattern matching) but purpose-built for searching, correlating, and alerting on UDM-normalized log events rather than matching patterns in binary files.

rule suspicious_login_after_hours {
  meta:
    author = "security-team"
    severity = "Medium"
  events:
    $login.metadata.event_type = "USER_LOGIN"
    $login.metadata.event_timestamp.asUnixTimestamp = $ts
  condition:
    $login
}

Every YARA-L rule is written inside a named rule { ... } block, and unlike classic YARA (where only condition is strictly required), YARA-L requires at minimum a meta section and an events section alongside condition, with additional optional sections — match, outcome, and options — available for more advanced correlation and output logic.

Because YARA-L rules operate on already-normalized UDM fields, the same rule logic works consistently regardless of which underlying log source actually generated a matching event, which is what lets a single rule detect a pattern across many differently-formatted data sources at once.