About This Guide
Welcome to the MetaDefender Cloud guide. This guide is intended to provide the information you need to:
Start analyzing files with 20+ anti-malware engines
How to use MetaDefender Cloud Public APIs
Learn about new features, updated features, and bug fixes Learn about frequently asked questions and additional concepts through our library of knowledge base articles
Key Features of MetaDefender Cloud
File Analysis - Analyzing binaries with 20+ anti-malware engines
Deep CDR (aka Content Disarm and Reconstruction) with support for 100+ file types
Sandbox dynamic analysis to detect more unknown and targeted attacks
Binary vulnerability data assessment
IP-Domain reputation
Threat Intelligence Feeds
Apikey
The apikey and related limits can be found in the account page. It is generated automatically when the account is created.
The apikey is used for all API requests to MetaDefender Cloud service.
Apikey info
Retrieve information about your apikey such as (but not limited to): max file size, API limits, created date, expiration date, and account nickname.
The request has succeeded
The requested page was not found
Apikey limits
Retrieve information about the consumed limits for an apikey. Every time a request is made to an endpoint that consumes a specific limit, it will be reflected in this endpoint. It is the equivalent of the X-RateLimit-Used from the response headers. Depending on your license, your rate limit will reset daily or monthly.
The request has succeeded
The requested page was not found
Apikey scan history
Retrieve a paginated list of files uploaded by the user in reverse chronological order (newest to oldest). The pagination is controlled by the user (how many items per page and which page) by specifying the limit and offset query parameters in the request. The response only contains a summary of the files, with minimum information.
The request has succeeded
The requested page was not found
Apikey remaining limits
Retrieve information about the remaining limits for an apikey.
The request has succeeded
The requested page was not found
File Scanning
Scanning a file starts with uploading the file to MetaDefender Cloud to initiate the scan process. Although we are trying to keep scanning very fast, scanning with more than 30 engines might take from a few seconds to many minutes depending on file type, file size, and current traffic. Also, archives usually take longer when scanning all the files inside. Due to these variables, we are not able to guarantee scanning times.
Free API users are sent to different queues with a lower priority, and MetaDefender Cloud customers' scan requests are prioritized.
Scanning a file consists of the following steps:
- Initiate scan request by uploading a file
- Retrieve scan report using unique data_id returned from Scan File API
Notes:
- When both the multiscan and sandbox functionalities are concurrently operational, and specific rate limits have been established for the sandbox, while none exist for multiscan, rather than generating an error, the sandbox process will be executed. Consequently, the associated data_id will return a status code of 253, denoting 'Not Scanned. Rate Limit Exceeded,' within the scan results.
Hash Lookups
MetaDefender provides two basic ways of looking up scan results using data hashes, MD5, SHA1, and SHA256:
Single hash lookup
Multiple hash lookup
While single hash lookup provides full scan results related to the hash, if found, multiple hash lookup will return a list of condensed results with links (data_ids) to the full scan results.
Reputation Service
MetaDefender Cloud allows users to check IP addresses, domains, and URLs for malicious behavior using multiple IP & URL reputation sources. This functionality makes it possible to identify threats like botnets that would not be found through scanning files when accessing content. By providing a standardized interface for leading IP & URL reputation sources, MetaDefender Cloud makes it possible to obtain aggregated data on whether an IP address, domain or URL should be trusted, enabling you to monitor your network for possible threats.
MetaDefender Cloud provides two basic ways of verifying reputation for each type:
- Single scan (Scanning IP / Domain / URL)
- Bulk scans (Scanning list of IPs / Domains / URLs)
Application Information
MetaDefender Cloud allows users to leverage our threat intelligence platform by providing an extensive REST API. The unique data set shared through our platform is collected from millions of live machines. This data set offers you tremendous insights on the behavior of potential malware, in order of weeks, from endpoints used in live environments by real users. This real-time information is more valuable than information from a sandbox solution, where everything is running in a controlled and simulated environment for approximately 3 minutes.
Through our API, you will be able to retrieve all the applications that the searched hash belongs to, all the network connections made by those applications, and the other loaded components that are used by those applications. You will be able to identify, restrict, or grant access based on the correlations provided.
Data Sanitization Cdr
MetaDefender Cloud allows users to leverage our Deep CDR (Content Disarm and Reconstruction) technology by providing an extensive REST API.
Through our API, you will be able to use data sanitization (CDR) to strip out embedded objects in document files. Some targeted attacks may not be detected by traditional anti-malware engines, which is why data sanitization should be performed on document files. The CDR process provides an extra level of insurance against zero-day attacks without affecting the usability of the files. MetaDefender Cloud leverages the MetaDefender Core Deep CDR engine.
Malware Sample Sharing
The endpoints part of malware sharing program are designed to expose the latest malware identified by OPSWAT, both infected files, and possible false positives.
These endpoints are only available to OPSWAT partners participating in the malware exchange program. If you are an antivirus vendor, or have a malware feed and want to participate in the program, please contact us at malware-sharing@opswat.com.
The lists expose information like the hashes of the files, the engines which detected the file and the download link, so it is easy to parse the feed and identify interesting hashes before starting the download.
MetaDefender Cloud does not store the files in archives separate. So it might be the case that a downloaded file has a different hash than specified in the URL. In this case, the hash can be found inside the archive.
The feed is generated once per day. At the moment, only the current day can be accessed.
Threat Intelligence Feed
OPSWAT's threat intelligence feed enables developers to leverage data collected from thousands of MetaDefender Cloud community users and customers. Developers, IT administrators and organizations can easily integrate our up-to-date malware threat intelligence data into their existing tools or solutions to effectively protect their organization against threats.
Use cases for the feed include:
- Organizations that want to be on the lookout for the hottest malware
- IT specialists that implement file denylist based on hashes
- Researchers analyzing trending malware on the market
- Security products that leverage threat intelligence capabilities to harden security measures
Status Endpoints
Various endpoints for querying MetaDefender Cloud.
Dynamic Analysis
API calls for dynamic analysis. General information can be found here: Dynamic analysis