FIX: Pre-compile YARA rules

[weslambert]

Consider using something like yara.compile() to pre-compile YARA rules before providing them to Strelka to prevent issues with bad rules.

target/strelka#410 (comment)

[derfel1989]

@weslambert will you deploy this on Security Onion? I'm thinking about moving to SOS due to the complete stack offered.

[weslambert]

I'm not sure if you are asking if Strelka is currently integrated with Security Onion or if the compilation will happen on the Security Onion machine. Just in case, the answer is yes to both questions. 😄

https://docs.securityonion.net/en/2.4/strelka.html#strelka

[derfel1989]

I'm not sure if you are asking if Strelka is currently integrated with Security Onion or if the compilation will happen on the Security Onion machine. Just in case, the answer is yes to both questions. 😄

https://docs.securityonion.net/en/2.4/strelka.html#strelka

Good to know! 😀
So, the Python code mentioned was already deployed.

[weslambert]

The pre-compilation is not included yet, but it will be included in a future release.

[weslambert]

This is implemented in Detections.