From 4b2f65ad114a617cc89ca4cc6c9cafc0d11b19a7 Mon Sep 17 00:00:00 2001
From: tomchop <tomchop@gmail.com>
Date: Fri, 27 Dec 2024 14:09:56 +0000
Subject: [PATCH] Parse private bit

---
 core/schemas/indicators/yara.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/core/schemas/indicators/yara.py b/core/schemas/indicators/yara.py
index 85ece18ec..0f48a7286 100644
--- a/core/schemas/indicators/yara.py
+++ b/core/schemas/indicators/yara.py
@@ -118,6 +118,7 @@ class Yara(indicator.Indicator):
     name: str = ""  # gets overridden during validation
     type: Literal["yara"] = "yara"
     dependencies: list[str] = []
+    private: bool = False
 
     @model_validator(mode="before")
     @classmethod
@@ -137,6 +138,7 @@ def validate_yara(cls, data: Any):
         rule_deps = set(plyara.utils.detect_dependencies(parsed_rule))
         data["dependencies"] = rule_deps - ALLOWED_EXTERNALS.keys()
         data["name"] = parsed_rule["rule_name"]
+        data["private"] = "private" in parsed_rule.get("scopes", [])
 
         return data