Sandbox Engine Options

The following table outlines the most important configuration options:

Option NameDefault ValueDescription
listenServerPort22001This is the HTTP port on which the webservice will listen, if the transformer is launched in the listen mode (see "—listen")
storeResultsPath/tmp/fsResultsThis is where the reporting dataand samples are stored. It should have the longest retention period. The storage size can be reduced by enabling "discStorageCompression" and disabling "transformServerSaveJsonToDisc". Note: if the transform server is used in conjunction with the broker and the broker has the transform server configured with the "callbackDeleteTaskAfterProcessing" attribute, the underlying results will be deleted after "runFileSystemCleanupRequiredAgeInSeconds" seconds automatically
tempStoragePath/tmp/fsTempThis is where temporary data is stored (e.g. when unpacking OOXML files). It should have a short retention period.
taskStoragePath/tmp/fsTasksThis is where temporary data is stored (e.g. when unpacking OOXML files). It should have a short retention period.
resourceStoragePath/tmp/fsResourcesStores resource data (e.g. the result of a file visualization)
deleteArchivedTasksAndResources IfOlderThanXDays7This is the default retention period (in days) for archived tasks and resources. Note: this does not apply to reporting data and samples stored in "storeResultsPath"
ipStackAccessKey<empty>If "runIPStackLookupOnExectractedHosts" is enabled and a valid API access key is provided, the transform server will perform IP geolocation and meta-data lookup (LAT/LON, etc.) for extracted IP addresses.
opswatReputationAPIKey<empty>Provide your OPSWAT MetaDefender Cloud API key here. You can only use OPSWAT reputation lookup until your daily quota has not been exceeded. Note: If you don't have an OPSWAT account yet, please register a free account here
opswatReputationAPIURLhttps://api.metadefender.com/v4/OPSWAT MetaDefender Cloud API url
metaDefenderAPIKeyProvide your OPSWAT MetaDefender Core API key here.
metaDefenderAPIURLhttps://api.metadefender.com/v4/Replace with the IP address of your OPSWAT MetaDefender Core instance. Make sure that the provided IP address can be reached from your subnet.
proxyHost, proxyPort, proxyType, proxySchemeConfigure your proxy server / port, if you want the transform server to perform outbound connections using a proxy server.
runOSINTLookupstrueIf enabled, OSINT lookups (currently: OPSWAT Reputation API, VirusTotal API and ClamAV) will be performed in general (it is a global flag).
runOSINTLookupsOnExtractedFilesfalseIf enabled, OSINT lookups will be performed on extracted files. If it is desired to reduce the total number of queries, this option can be disabled. However, if a high-volume API key is available, it should be enabled for improved detection.
virusTotalAPIKey<empty>Provide your VirusTotal API key here. If the transform server is running in the listener, the "virusTotalQueriesPerMinute" limit will be applied automatically in order to ensure even during peak processing underlying quota is not exceeded. This option needs to be adjusted based on the actual usage quota (or set to "0" to disable any limiting).
virusTotalQueriesPerMinute32This option specifies how many transform tasks will be executed in parallel. The value will be capped to the total number of CPUs based on the "transformServerLimitByAvailableProcessors" option. If the server receives a large amount of files and performance is an issue, it is recommended to increase the total number of available CPUs (e.g. by upgrading hardware) as well as adjust the pool size.
Type to search, ESC to discard
Type to search, ESC to discard
Type to search, ESC to discard
Next to read:
Whitelist Configuration

See the "Technical Datasheet" for a complete list of features: https://docs.opswat.com/filescan/datasheet/technical-datasheet

On This Page
Sandbox Engine Options