What is the purpose of the outcome section in a YARA-L rule?

The outcome section computes and returns derived values from a rule's matched events, letting a detection surface useful, calculated context in its alert output — like a count, a list of distinct values, or a risk score — rather than the alert only indicating that a match occurred with no further computed detail.

match:
  $user over 10m

outcome:
  $failed_attempt_count = count($fail.metadata.id)
  $source_ips = array_distinct($fail.principal.ip)

condition:
  #fail > 5

Outcome variables commonly use aggregate functions — count(), sum(), array_distinct(), and similar — computed over the matched, grouped events, and the resulting values appear as part of the resulting alert or search result, giving an analyst immediately useful context (like exactly how many failed attempts occurred, or the distinct set of source IPs involved) without needing to separately query for that same information after the fact.

This same outcome-computation capability, originally built for detection rules, has also become available directly within UDM search statistical queries, letting an analyst use the same aggregate-function-based computation for ad hoc investigative queries, not just for pre-authored, deployed detection rules.