Steve, Thanks for the pointers. We'll look in to adding a yara suffix, although it is not done for other sig types and it is also easy to grep the sig name within the database directory to identify the sig type/origin. As for whitelisting yara, that code should be already in place. I'll double check that it is working correctly. Steve