Engine Options

listenServerPort

22001

This is the HTTP port on which the webservice will listen, if the transformer is launched in the listen mode (see "—listen")

storeResultsPath

/tmp/fsResults

This is where the reporting dataand samples are stored. It should have the longest retention period. The storage size can be reduced by enabling "discStorageCompression" and disabling "transformServerSaveJsonToDisc". Note: if the transform server is used in conjunction with the broker and the broker has the transform server configured with the "callbackDeleteTaskAfterProcessing" attribute, the underlying results will be deleted after "runFileSystemCleanupRequiredAgeInSeconds" seconds automatically

tempStoragePath

/tmp/fsTemp

This is where temporary data is stored (e.g. when unpacking OOXML files). It should have a short retention period.

taskStoragePath

/tmp/fsTasks

This is where temporary data is stored (e.g. when unpacking OOXML files). It should have a short retention period.

resourceStoragePath

/tmp/fsResources

Stores resource data (e.g. the result of a file visualization)

deleteArchivedTasksAndResources IfOlderThanXDays

7

This is the default retention period (in days) for archived tasks and resources. Note: this does not apply to reporting data and samples stored in "storeResultsPath"

ipStackAccessKey

<empty>

If "runIPStackLookupOnExectractedHosts" is enabled and a valid API access key is provided, the transform server will perform IP geolocation and meta-data lookup (LAT/LON, etc.) for extracted IP addresses.

opswatReputationAPIKey

<empty>

Provide your OPSWAT MetaDefender Cloud API key here. You can only use OPSWAT reputation lookup until your daily quota has not been exceeded. Note: If you don't have an OPSWAT account yet, please register a free account here

opswatReputationAPIURL

https://api.metadefender.com/v4/

OPSWAT MetaDefender Cloud API url

metaDefenderAPIKey

Provide your OPSWAT MetaDefender Core API key here.

metaDefenderAPIURL

https://api.metadefender.com/v4/

Replace with the IP address of your OPSWAT MetaDefender Core instance. Make sure that the provided IP address can be reached from your subnet.

proxyHost, proxyPort, proxyType, proxyScheme

Configure your proxy server / port, if you want the transform server to perform outbound connections using a proxy server.

runOSINTLookups

true

If enabled, OSINT lookups (currently: VirusTotal andClamAV, OPSWAT) will be performed in general (it is a global flag).

runOSINTLookupsOnExtractedFiles

false

If enabled, OSINT lookups will be performed on extracted files. In order to reduce the total number of queries, it is recommended to disable this option. However, if an unlimited API key is available, it should be enabled for improved detection.

virusTotalAPIKey

<empty>

Provide your VirusTotal API key here. If the transform server is running in the listener, the "virusTotalQueriesPerMinute" limit will be applied automatically in order to ensure even during peak processing underlying quota is not exceeded. This option needs to be adjusted based on the actual usage quota (or set to "0" to disable any limiting).

virusTotalQueriesPerMinute

32

This option specifies how many transform tasks will be executed in parallel. The value will be capped to the total number of CPUs based on the "transformServerLimitByAvailableProcessors" option. If the server receives a large amount of files and performance is an issue, it is recommended to increase the total number of available CPUs (e.g. by upgrading hardware) as well as adjust the pool size.