How do you write a basic YARA-L detection rule?

Writing a basic rule means defining the required meta, events, and condition sections inside a named rule block, using UDM field references to specify exactly what pattern of activity should trigger a detection.

rule admin_login_from_new_country {
  meta:
    author = "detection-team"
    description = "Flags an admin account logging in from a country not seen before for that user"
    severity = "High"

  events:
    $login.metadata.event_type = "USER_LOGIN"
    $login.target.user.userid = $user
    $login.principal.ip_geo_artifact.location.country_or_region = $country
    $login.target.user.attribute.roles = "ADMIN"

  condition:
    $login
}

The events section uses a variable ($login) to anchor a set of field constraints that must all hold true for a single matching UDM event — here, the event must be a login, belong to a user with an admin role, and provide values for the user ID and country fields, which are captured into $user and $country for potential later use in an outcome section or the alert's presentation.

The condition section, in this simple single-event example, just references the event variable directly ($login), meaning any single event matching all the constraints in the events section is sufficient to trigger a detection; more advanced rules build on this same foundation with additional logic, correlation across multiple event variables, and computed outcome fields.