Assess YARA coverage across malware families and check whether your scan throughput can keep up with daily file volume.
Family coverage counts families, not rules, because ten rules for one family is depth rather than breadth. Throughput is the constraint that decides whether the rule set is deployable at all: YARA cost scales with rule count and condition complexity, so a large unoptimised set can easily fail to finish a day's files in a day. YARA is the workhorse for hunting in file collections and memory, but an untested rule set produces false positives on legitimate software, and a set too slow to complete a daily pass silently stops covering the newest files.
YARA Rule Coverage
Family coverage = families with at least one rule ÷ families in scope. Scan time = files × average size ÷ (throughput per core × cores).
Noise from signatures
False positives per day = files scanned ÷ 100,000 × false positives per 100,000 files.
Family coverage = families with at least one rule ÷ families in scope. Scan time = files × average size ÷ (throughput per core × cores). Family coverage counts families, not rules, because ten rules for one family is depth rather than breadth. Throughput is the constraint that decides whether the rule set is deployable at all: YARA cost scales with rule count and condition complexity, so a large unoptimised set can easily fail to finish a day's files in a day.
YARA is the workhorse for hunting in file collections and memory, but an untested rule set produces false positives on legitimate software, and a set too slow to complete a daily pass silently stops covering the newest files.
This calculator takes 9 inputs: Malware families relevant to your threat model, Families with at least one YARA rule, YARA rules in the deployed set, Rules tested against known samples, Files scanned per day, Average file size, Scan throughput per core, Cores dedicated to scanning, False positives per 100,000 files. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Anchor rules with cheap conditions first — file magic, size ranges, a rare string — so expensive regular expressions only run on candidates. Ordering conditions cheapest-first routinely buys an order of magnitude.
No. Public rule sets carry unmaintained rules with generic strings that fire on packers, installers and legitimate developer tooling. Test each rule against a clean corpus before it reaches production, and measure the false-positive density you are accepting.