From e9e1bdd56cd1fba09a525b1c27434d6ec2b3b9fd Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Tue, 1 May 2018 11:21:05 +0200
Subject: [PATCH] add: Context where the YARA rule can be applied

---
 objects/yara/definition.json | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/objects/yara/definition.json b/objects/yara/definition.json
index 4b4724d..370bfdb 100644
--- a/objects/yara/definition.json
+++ b/objects/yara/definition.json
@@ -20,9 +20,20 @@
       "description": "Version of the YARA rule depending where the yara rule is known to work as expected.",
       "ui-priority": 0,
       "misp-attribute": "text"
+    },
+    "context": {
+      "description": "Context where the YARA rule can be applied",
+      "sane_default": [
+        "all",
+        "disk",
+        "memory",
+        "network"
+      ],
+      "misp-attribute": "text",
+      "ui-priority": 0
     }
   },
-  "version": 2,
+  "version": 3,
   "description": "An object describing a YARA rule along with its version.",
   "meta-category": "misc",
   "uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3",