YARA-L

YARA-L is the rule language of Google Security Operations. A rule is a structured text with sections for metadata, events, an optional match over a time window, outcome values and a condition. It runs over the Unified Data Model, so rules are portable across log sources that map to it.

What YARA-L means here

The match section is what separates YARA-L from a single-event filter: it groups events over a window by a shared value, such as a user or host. The outcome section can compute values, like a risk score, that travel with the detection.

YARA-L is not the same as YARA, the file-scanning rule format. The names are close and the formats are unrelated.

Example of YARA-L in Google Security Operations documentation

Google's YARA-L 2.0 overview says a rule has meta, events, match, outcome and condition sections, and that single-event rules can omit the match section. docs.cloud.google.com read 2026-11-03

Terms related to YARA-L

• Detection rule: A detection rule is a stored query or logic that runs over security data and raises an alert when it matches.
• Rule versioning: Rule versioning keeps every revision of a rule so you can see what changed, who changed it and when.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.