how to use data tables in YARA L Rules

Khushboo14

I want to create a data table with users and IP subnet that has to be whitelisted from a detection rule. How can i do that. I have tried it this way as attached but it is not working. Can someone help me.

jstoner

To perform a row match, at least one of the values in that row match must equal a value in the list. So user id would need to align to something in the list but then the cidr does not.

I could see a row match being something like this

principal.user.userid = %data_table.user
NOT net.ip_in_range_cidr($dns.principal.ip,%data_table.ip_subnet)

_K_O

It looks like you're referencing it correctly. On the bottom left of the screen, does the table show as active in the detection? It should populate with the data table that is currently in use:

Alternatively, you can go to the data tables and view the "REFERENCED BY" tab.

If it is being referenced correctly, then the troubleshooting can be limited to syntax. I have also used the "not" expression for the data tables and it seems almost identical: