Yara is a powerful engine that helps to identify malware (mostly).
Below is the short description of the engine by its developers taken from their github:

YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression which determine its logic.

In the Screener, Yara is used to analyze *.eml files.
In case if the received report is *.msg, it'll be automatically converted into *.eml.

In the Settings → Yara Rules there is a list of predefined Rules that can be Modified.

Let us review the very first Yara rule as an example.

• Link and text not equal - The name of the Rule.
• Enabled\Disabled - Status of the rule. Whether it is active\inactive.
• Name - New name of the Rule. Applied after a save.
• Target (Body\Attachement) - What to scan, the body of an *.eml file or attachment in it.
• Rule Constructor - In the example, it can not display too complex Yara rule.
• Yara Rule Text - Text of the rule itself.
• Description - Description that helps a user to understand the purpose of the rule.
• Score - Amount of score that is going to be assigned to an incident.
• Category - To what category the rule is applied.

To add a new rule, please use the +Add button.

The New Yara Rule page allows building a new rule upon user's requirements.

The most interesting part of the page is the Rule Constructor. It is separated into Condition Bloks. Each block has:

In case if multiple expressions are set in the same block. a "Rule Operator" option will appear.
The created Conditional Block will assign some spam score to an incident only if any of the conditions matched\all of the conditions matched.

Let us review an example below.

The rule will work only if both Conditional Blocks are triggered, since it is set to "All".
Conditional Block #1 will be triggered if any of the conditions are triggered, which are Subject equals to "Ipad" and the email is not from "apple@apple.com".
Conditional Block #2 will be triggered if the only condition is true, the email is purposed to a guy with email "trusty@victim.com".

As the result, the constucture has generated the following Yara rule:

 ( eml.subject == "Ipad" or eml.from != "apple@apple.com") and ( eml.to == "trusty@victim.com") 

Let us add a Yara rule that would be pretty useful.
In this example, we will create a dictionary of trusted domain names, then we will use the dictionary to give a negative spam score to an incident.

Go to Settings → Yara Dictionaries → +Add.

Set the name and add a domain name of your company.
In my case it is MyCompany.dict and the domain name is lucysecurity.com Set it to be "Enabled" and press the "Save" button.

Go to Settings → Yara Rules → +Add.

Set it to be Enabled, Set the name, and input the Yara Rule below.

 for any i in (0..fr.lines["MyCompany.dict"].lines_count) : (fr.lines["MyCompany.dict"].data[i] == eml.get_domain_from_email(eml.actual_sender_email)) 

This means that for (cycle) any line from 0 to maximum of existing lines in the dictionary (lines_count) there should be a comparison, if a line matches with the domain name in the sender email domain (eml.get_domain_from_email(eml.actual_sender_email)))
Where MyCompany.dict is the name of the dictionary.

The important trick, set the score to be a negative value, for example -20.
With this configuration set all of the emails from domains that are in the dictionary will be considered as safe and the negative value will cover the false positives. The category is up to you. It'll be assigned to the incident in the overview section.

It can be seen that the category is assigned according to the internal rules, including the "safe" one.
Preconfigured Yara rule in step 2 gave the incident -20 scores.

So from now on it is enough to add a domain name into the dictionary we created for it automatically considered as safe.

We use the "eml" module for the Yara engine. It is designed to process eml files. It can be found in the Yara rule example below:

 eml.get_domain_from_email(eml.headers["message-id"]) != eml.get_domain_from_email(eml.headers["from"]) 

It is possible to build your own complex Yara rules with its models and endpoints available in the table below:

We also use fr (file-read) module that is designed to process dictionaries in the Screener.