VirusTotal has released the official YARA-X Language Server, built on the LSP standard so any compatible editor can gain intelligent YARA rule authoring support. Key features include real-time diagnostics as you type, autocompletion for module identifiers and keywords, go-to-definition for rules and patterns across files, and automatic formatting. It's available now for Visual Studio Code via the marketplace, currently in beta, with plans to expand to other editors based on community integration.
Questions this post answers
Is there an official language server for writing YARA rules in VS Code?
Yes, the YARA-X Language Server is now available for Visual Studio Code, currently in beta, installable from the Visual Studio Marketplace. It is built on the Language Server Protocol on top of the YARA-X engine and provides real-time diagnostics, autocompletion for module identifiers and keywords, go-to-definition across rule files, and automatic code formatting. Malware analysts adopting new tooling can track YARA-X language server updates on daily.dev.
What features does the YARA-X language server provide for writing detection rules?
It offers real-time diagnostics that flag syntax errors as you type, advanced autocompletion for module identifiers like pe. and cuckoo. and keywords, go-to-definition for jumping between rules and patterns across multiple files, and automatic formatting to keep rule sets consistent and readable. Developers building malware detection workflows can follow tooling changes like this on daily.dev.