Assemblyline 4

# Name of the service name: MetaDefender_Sandbox # Version of the service version: 4.5.1.dev0 description: This Assemblyline service interfaces with the MetaDefender Sandbox -previously known as OPSWAT Filescan Sandbox-, detonating files and URLs. This integration was developed by OPSWAT. (C) OPSWAT, Inc. accepts: .* rejects: empty stage: CORE category: Dynamic Analysis file_required: true timeout: 600 # is the service enabled by default enabled: true uses_metadata: true # -1000: safe # 0 - 299: informational # 300 - 699: suspicious # 700 - 999: highly suspicious # >= 1000: malicious heuristics: - description: MetaDefender Sandbox determined that the file is benign. filetype: "*" heur_id: 1 name: MetaDefender Sandbox verdict is benign. score: -1000 - description: MetaDefender Sandbox signal group is benign. filetype: "*" heur_id: 2 name: Benign threat indicators score: -1000 - description: MetaDefender Sandbox determined that the file is informational/no threat. filetype: "*" heur_id: 3 name: MetaDefender Sandbox verdict is no threat. score: 150 - description: MetaDefender Sandbox signal group is informational/no threat. filetype: "*" heur_id: 4 name: Informational threat indicators score: 150 - description: MetaDefender Sandbox determined that the file is unknown. filetype: "*" heur_id: 5 name: MetaDefender Sandbox verdict is unknown score: 299 - description: MetaDefender Sandbox signal group is unknown. filetype: "*" heur_id: 6 name: Unknown threat indicators score: 299 - description: MetaDefender Sandbox determined that the file is suspicious. filetype: "*" heur_id: 7 name: MetaDefender Sandbox verdict is suspicious score: 500 - description: MetaDefender Sandbox signal group is suspicious. filetype: "*" heur_id: 8 name: Suspicious threat indicators score: 500 - description: MetaDefender Sandbox determined that the file is likely malicious. filetype: "*" heur_id: 9 name: MetaDefender Sandbox verdict is likely malicious score: 850 - description: MetaDefender Sandbox signal group is likely malicious. filetype: "*" heur_id: 10 name: Likely malicious threat indicators score: 850 - description: MetaDefender Sandbox determined that the file is malicious. filetype: "*" heur_id: 11 name: MetaDefender Sandbox verdict is malicious score: 1000 - description: MetaDefender Sandbox signal group is malicious. filetype: "*" heur_id: 12 name: Malicious threat indicators score: 1000 # Docker configuration block which defines: # - the name of the docker container that will be created # - CPU and ram allocation by the container docker_config: image: ${REGISTRY}opswat/assemblyline-service-metadefender-sandbox:4.5.1.dev0 cpu_cores: 1.0 ram_mb: 1024 allow_internet_access: true config: api_key: "" host: "https://www.filescan.io" poll_interval: 2 timeout: 60 submission_params: - default: "" name: api_key type: str value: "" - default: 2 name: poll_interval type: int value: 2 - default: 60 name: timeout type: int value: 60 - default: "" name: description type: str value: "" - default: "" name: password type: str value: "" - default: "" name: is_private type: bool value: ""