Follow include index files to load all YARA rulesets ? about plyara

[utkonos]

This is doable. I am including this as a feature for the 3.0.0 release that I'm working on currently. I think the best way to implement this is actually to have a utility. I'm building the new version nearly from scratch. The idea is to follow closely the best practices for building a compiler. Therefore, there will be a data model object at the end of a parsing session.

To implement this enhancement properly, there will be a utility that is given the path to a YARA file. From the path, it will walk the file system and replace all includes failing if something is missing.

Does this sound like it would work for your use case?

[utkonos]

This may fit best as a flag on the CLI which then uses said utility.

[wesinator]

sweet. I was thinking exactly the same thing following a compiler logic for parsing and resolution.