OPSWAT-Metadefender V2

Details

ID	`OPSWAT-Metadefender V2`
Provider	OPSWAT Inc
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

multi-scanning engine uses 30+ anti-malware engines to scan files for threats, significantly increasing malware detection.
This integration was integrated and tested with version 5.0.0 of OPSWAT-Metadefender V2.

Configure OPSWAT-Metadefender v2 in Cortex

Parameter	Required
Server URL (e.g. http://localhost:8008/metascan_rest/)	True
API Key - Needed in cloud based solutions	False
API Key - Needed in cloud based solutions	False
Cloud based	False
Trust any certificate (not secure)	False
Use system proxy settings	False
The high threshold	False
The low threshold	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

opswat-scan-file

Scan file in OPSWAT

Base Command

opswat-scan-file fileId=1191@302

Input

Argument Name	Description	Required
fileId	Entry id of a file in XSOAR.	Required
scanRule	Name of the Rule to use for scanning (Optional).	Optional

Context Output

Path	Type	Description
OPSWAT.FileName	string	OPSWAT file name to scan
OPSWAT.ScanId	string	OPSWAT scan id of the scan

opswat-hash

Check file hash on OPSWAT

Base Command

opswat-hash hash=cc273fe9d442850fa18c31c88c823e07

Input

Argument Name	Description	Required
hash	File hash (Can be any hash type).	Required

Context Output

There is no context output for this command.

opswat-scan-result

Get OPSWAT result

Base Command

opswat-scan-result id=123

Input

Argument Name	Description	Required
id	OPSWAT scan id.	Required

Context Output

There is no context output for this command.

opswat-sanitization-result

Get OPSWAT sanitization result (Requires CDR feature).
In order to have sanitized versions of the file, the DeepCDR feature needs to be enabled in the Workflow rule used for scanning the file.

Base Command

opswat-sanitization-result

Input

Argument Name	Description	Required
id	OPSWAT scan id.	Required

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (e.g. http://localhost:8008/metascan_rest/) (required)
api_key — API Key - Needed in cloud based solutions
api_key_creds —
cloud — Cloud based
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
highPercnt — The high threshold
lowPercnt — The low threshold

Commands (4)

opswat-hash
Check file hash on OPSWAT.
opswat-sanitization-result
Get OPSWAT sanitization result (Requires CDR feature).
opswat-scan-file
Scan file in OPSWAT.
opswat-scan-result
Get OPSWAT result.

Source

OPSWATMetadefenderV2.py OPSWATMetadefenderV2_test.py OPSWATMetadefenderV2.yml OPSWATMetadefenderV2_description.md

Download History Raw

commonfields:
  id: OPSWAT-Metadefender V2
  version: -1
  sortvalues: []
sectionorder:
- Connect
- Collect
name: OPSWAT-Metadefender V2
display: OPSWAT-Metadefender v2
category: Data Enrichment & Threat Intelligence
provider: OPSWAT Inc
description: multi-scanning engine uses 30+ anti-malware engines to scan files for threats, significantly increasing malware detection.
configuration:
- display: Server URL (e.g. http://localhost:8008/metascan_rest/)
  name: url
  type: 0
  required: true
  section: Connect
- display: API Key - Needed in cloud based solutions
  name: api_key
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
  section: Connect
- name: api_key_creds
  type: 9
  displaypassword: API Key - Needed in cloud based solutions
  hiddenusername: true
  required: false
  section: Connect
- display: Cloud based
  name: cloud
  type: 8
  defaultvalue: 'false'
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: The high threshold
  name: highPercnt
  defaultvalue: '66'
  type: 0
  required: false
  section: Connect
- defaultvalue: '34'
  display: The low threshold
  name: lowPercnt
  type: 0
  required: false
  section: Connect
script:
  script: ''
  type: python
  commands:
  - name: opswat-scan-file
    arguments:
    - name: fileId
      required: true
      description: Entry id of a file in Demisto.
    - name: scanRule
      description: Name of the Rule to use for scanning.
    outputs:
    - contextPath: OPSWAT.FileName
      description: OPSWAT file name to scan.
      type: string
    - contextPath: OPSWAT.ScanId
      description: OPSWAT scan id of the scan.
      type: string
    description: Scan file in OPSWAT.
  - name: opswat-hash
    arguments:
    - name: hash
      required: true
      default: true
      description: File hash (Can be any hash type).
    description: Check file hash on OPSWAT.
  - name: opswat-scan-result
    arguments:
    - name: id
      required: true
      default: true
      description: OPSWAT scan id.
    description: Get OPSWAT result.
  - name: opswat-sanitization-result
    arguments:
    - name: id
      required: true
      default: true
      description: OPSWAT scan id.
    description: Get OPSWAT sanitization result (Requires CDR feature).
  dockerimage: demisto/python3:3.12.13.10116658
  subtype: python3
tests:
- No tests - no instance
fromversion: 5.0.0