Engine Options
The following table outlines the most important configuration options:
| Option Name | Default Value | Description |
|---|---|---|
| listenServerPort | 22001 | This is the HTTP port on which the webservice will listen, if the transformer is launched in the listen mode (see "—listen") |
| storeResultsPath | /tmp/fsResults | This is where the reporting dataand samples are stored. It should have the longest retention period. The storage size can be reduced by enabling "discStorageCompression" and disabling "transformServerSaveJsonToDisc". Note: if the transform server is used in conjunction with the broker and the broker has the transform server configured with the "callbackDeleteTaskAfterProcessing" attribute, the underlying results will be deleted after "runFileSystemCleanupRequiredAgeInSeconds" seconds automatically |
| tempStoragePath | /tmp/fsTemp | This is where temporary data is stored (e.g. when unpacking OOXML files). It should have a short retention period. |
| taskStoragePath | /tmp/fsTasks | This is where temporary data is stored (e.g. when unpacking OOXML files). It should have a short retention period. |
| resourceStoragePath | /tmp/fsResources | Stores resource data (e.g. the result of a file visualization) |
| deleteArchivedTasksAndResources IfOlderThanXDays | 7 | This is the default retention period (in days) for archived tasks and resources. Note: this does not apply to reporting data and samples stored in "storeResultsPath" |
| ipStackAccessKey | <empty> | If "runIPStackLookupOnExectractedHosts" is enabled and a valid API access key is provided, the transform server will perform IP geolocation and meta-data lookup (LAT/LON, etc.) for extracted IP addresses. |
| opswatReputationAPIKey | <empty> | Provide your OPSWAT MetaDefender Cloud API key here. You can only use OPSWAT reputation lookup until your daily quota has not been exceeded. Note: If you don't have an OPSWAT account yet, please register a free account here |
| opswatReputationAPIURL | https://api.metadefender.com/v4/ | OPSWAT MetaDefender Cloud API url |
| metaDefenderAPIKey | Provide your OPSWAT MetaDefender Core API key here. | |
| metaDefenderAPIURL | https://api.metadefender.com/v4/ | Replace with the IP address of your OPSWAT MetaDefender Core instance. Make sure that the provided IP address can be reached from your subnet. |
| proxyHost, proxyPort, proxyType, proxyScheme | Configure your proxy server / port, if you want the transform server to perform outbound connections using a proxy server. | |
| runOSINTLookups | true | If enabled, OSINT lookups (currently: VirusTotal andClamAV, OPSWAT) will be performed in general (it is a global flag). |
| runOSINTLookupsOnExtractedFiles | false | If enabled, OSINT lookups will be performed on extracted files. In order to reduce the total number of queries, it is recommended to disable this option. However, if an unlimited API key is available, it should be enabled for improved detection. |
| virusTotalAPIKey | <empty> | Provide your VirusTotal API key here. If the transform server is running in the listener, the "virusTotalQueriesPerMinute" limit will be applied automatically in order to ensure even during peak processing underlying quota is not exceeded. This option needs to be adjusted based on the actual usage quota (or set to "0" to disable any limiting). |
| virusTotalQueriesPerMinute | 32 | This option specifies how many transform tasks will be executed in parallel. The value will be capped to the total number of CPUs based on the "transformServerLimitByAvailableProcessors" option. If the server receives a large amount of files and performance is an issue, it is recommended to increase the total number of available CPUs (e.g. by upgrading hardware) as well as adjust the pool size. |
Was this page helpful?