You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Defines expectations for a specific metadata field.
252
+
253
+
When rules are compiled, the compiler will check if the metadata fields match the specified expectations. If not, it will trigger a warning (or an error if `error` is `True`).
254
+
255
+
-`identifier`: The metadata name (e.g., `"author"`).
256
+
-`value_type`: The expected type, which must be one of the `yara_x.MetaType` constants:
257
+
-`MetaType.STRING`
258
+
-`MetaType.INTEGER`
259
+
-`MetaType.FLOAT`
260
+
-`MetaType.BOOL`
261
+
-`MetaType.SHA256`
262
+
-`MetaType.SHA1`
263
+
-`MetaType.MD5`
264
+
-`MetaType.HASH`
265
+
-`required`: If `True`, the metadata field must be present in every rule. Defaults to `False`.
266
+
-`error`: If `True`, failure to meet the expectation triggers an error instead of a warning. Defaults to `False`.
267
+
-`regexp`: An optional regular expression that the metadata value must match. Only applicable if `value_type` is `MetaType.STRING`.
0 commit comments