The false positives check sometimes produces results that are not actually false
positives, and you want to explicitly ignore them. This is usually the case with
very general rules that are expected to match innocuous files found in the
collection used by YARA-CI. In order to ignore certain rules by name you can
add the following to your
.yara-ci.yml configuration file:
false_positives: ignore: - rule: "my_noisy_rule"
With the configuration above any match for
my_noisy_rule will be excluded
from the false positives report. Additionally, you can also ignore all the rules
contained in certain files, for example, with this configuration any file in
noisy_rules directory won’t be taken into account:
false_positives: ignore: - file: "noisy_rules/**"
Filters by rule name and file path can be used in conjunction:
false_positives: ignore: - file: "experimental/**" rule: "my_noisy_rule"
In the example above any rule named
my_noisy_rule contained in some file in
experimental directory will be ignored. If the rule appears in some other
file that doesn’t match the pattern it will be reported.