Writing the Rules That Catch an Attacker

Every SIEM eventually reaches the same wall. The logs are collected, the dashboard is full, and somewhere inside that flood is the pattern that matters: a failed login, then another, then a success from an address nobody recognizes. Individually each line is meaningless. Together they are an incident. Correlation is the work of connecting them, and JARY exists to make writing that logic feel less like fighting a platform and more like expressing an idea.

JARY is a runtime for writing .jary rules that search and correlate log data from external sources. Its syntax is deliberately borrowed from YARA, the malware pattern-matching language developed by VirusTotal, on the reasoning that security practitioners already read YARA fluently and a familiar shape lowers the cost of picking up a new tool. A rule declares the data it expects, the conditions it matches, and what to output when those conditions hold, including time windows such as matching events that occurred within the last ten seconds. It is expressive enough to describe a brute force pattern in a handful of readable lines.

What makes the design interesting is what it refuses to do. JARY is a library, not a platform. It weighs under 150 KB, is written in C with SQLite as its only dependency, and links directly into your program, so there is no separate correlation service to host and no network hop shipping raw logs to an engine somewhere else. It also does not collect data for you or parse syslog or JSON on your behalf. Feeding it data is your responsibility, and it only evaluates rules when you explicitly call execute. That restraint is a deliberate philosophy, articulated at length in its documentation: provide the building blocks, stay out of the way, and never grow into something that forces users to carry features they never asked for. The author’s stated ambition is to be the Lua of embedded correlation engines, extended through hot-swappable modules loaded from shared objects rather than baked into the language.

Under the hood it is a real language implementation. Rules pass through parsing and compilation into bytecode, which runs on a stack-based virtual machine, with an in-memory SQLite database backing the correlation logic and a callback listener firing when rules trigger. JARY was featured at Black Hat Asia Arsenal in 2025 and is released under the BSD-3-Clause license. It is also honest about its stage, describing itself as under development, currently supporting GNU/Linux on AMD64, with a C interface today and Python bindings planned.

Where This Meets the Curriculum

This is the machinery behind detection engineering, the discipline that sits directly beneath the SOC analyst role. Server and Network Administration covers collecting logs, analyzing them, and detecting intrusions; JARY is what that detection layer looks like when you build it yourself instead of buying it. Reading its source is also an unusually accessible way into language implementation, since parsers, bytecode, and virtual machines are rarely encountered in a security curriculum yet quietly underpin much of the tooling the field depends on. And because the project is early, small, and openly asking for feedback on its standard library, it is exactly the kind of repository where a determined student can make a contribution that actually lands.

Explore JARY

Repository: github.com/CTRLRLTY/JARY
Get Started: JARY Wiki
Rule Reference: doc/rule_reference.md
C API Reference: doc/c_api_reference.md