---
title: "Create an Auto YARA job"
method: POST
path: "/v1/auto-yara/jobs"
tags: ["Auto Yara"]
---

# Create an Auto YARA job

`POST /v1/auto-yara/jobs`

## Request

- Base URL: `https://api.recordedfuture.com/malware-intelligence`
- URL: `https://api.recordedfuture.com/malware-intelligence/v1/auto-yara/jobs`
- Auth: one of:
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`
  - API key in header `X-RFToken`

Generate YARA detection rules by analyzing common byte patterns across malware samples.

## Request body

- CreateYaraJobRequest: Request to create an Auto YARA rule generation job from malware sample hashes.
  - `hashes` string[], required: A list of up to 100 SHA-256 hash values used to identify common hexadecimal patterns for YARA rules.
  - `name` string, required: The name of the Auto YARA job.
  - `query` string: The query that was used to find the initial hashes.

## Response `200`

Successful Response

- CreateJobResponse: Response confirming creation of a rule generation job with its assigned ID.
  - `job_id` string, required

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Page not found

---

[API](https://skmtc.dev/recordedfuture/apis/recorded-future-malware-intelligence.md) - [All operations](https://skmtc.dev/recordedfuture/apis/recorded-future-malware-intelligence/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/recorded-future-malware-intelligence/revisions/190a3d1d0680?raw)