MetaDefender Cloud API v4 4.0Terms of ServiceApache 2.0

File Scanning

Scanning a file starts with uploading the file to MetaDefender Cloud to initiate the scan process. Although we are trying to keep scanning very fast, scanning with more than 30 engines might take from a few seconds to many minutes depending on file type, file size, and current traffic. Also, archives usually take longer when scanning all the files inside. Due to these variables, we are not able to guarantee scanning times.

Free API users are sent to different queues with a lower priority, and MetaDefender Cloud customers' scan requests are prioritized.

Scanning a file consists of the following steps:

1. Initiate scan request by uploading a file
2. Retrieve scan report using unique data_id returned from Scan File API

Notes:

• When both the multiscan and sandbox functionalities are concurrently operational, and specific rate limits have been established for the sandbox, while none exist for multiscan, rather than generating an error, the sandbox process will be executed. Consequently, the associated data_id will return a status code of 253, denoting 'Not Scanned. Rate Limit Exceeded,' within the scan results.

Hash Lookups

MetaDefender provides two basic ways of looking up scan results using data hashes, MD5, SHA1, and SHA256:

1. Single hash lookup

2. Multiple hash lookup

   While single hash lookup provides full scan results related to the hash, if found, multiple hash lookup will return a list of condensed results with links (data_ids) to the full scan results.

Reputation Service

MetaDefender Cloud allows users to check IP addresses, domains, and URLs for malicious behavior using multiple IP & URL reputation sources. This functionality makes it possible to identify threats like botnets that would not be found through scanning files when accessing content. By providing a standardized interface for leading IP & URL reputation sources, MetaDefender Cloud makes it possible to obtain aggregated data on whether an IP address, domain or URL should be trusted, enabling you to monitor your network for possible threats.

MetaDefender Cloud provides two basic ways of verifying reputation for each type:

1. Single scan (Scanning IP / Domain / URL)
2. Bulk scans (Scanning list of IPs / Domains / URLs)

Application Information

MetaDefender Cloud allows users to leverage our threat intelligence platform by providing an extensive REST API. The unique data set shared through our platform is collected from millions of live machines. This data set offers you tremendous insights on the behavior of potential malware, in order of weeks, from endpoints used in live environments by real users. This real-time information is more valuable than information from a sandbox solution, where everything is running in a controlled and simulated environment for approximately 3 minutes.

Through our API, you will be able to retrieve all the applications that the searched hash belongs to, all the network connections made by those applications, and the other loaded components that are used by those applications. You will be able to identify, restrict, or grant access based on the correlations provided.

Data Sanitization Cdr

MetaDefender Cloud allows users to leverage our Deep CDR (Content Disarm and Reconstruction) technology by providing an extensive REST API.

Through our API, you will be able to use data sanitization (CDR) to strip out embedded objects in document files. Some targeted attacks may not be detected by traditional anti-malware engines, which is why data sanitization should be performed on document files. The CDR process provides an extra level of insurance against zero-day attacks without affecting the usability of the files. MetaDefender Cloud leverages the MetaDefender Core Deep CDR engine.

Malware Sample Sharing

The endpoints part of malware sharing program are designed to expose the latest malware identified by OPSWAT, both infected files, and possible false positives.

These endpoints are only available to OPSWAT partners participating in the malware exchange program. If you are an antivirus vendor, or have a malware feed and want to participate in the program, please contact us at malware-sharing@opswat.com.

The lists expose information like the hashes of the files, the engines which detected the file and the download link, so it is easy to parse the feed and identify interesting hashes before starting the download.

MetaDefender Cloud does not store the files in archives separate. So it might be the case that a downloaded file has a different hash than specified in the URL. In this case, the hash can be found inside the archive.

The feed is generated once per day. At the moment, only the current day can be accessed.

Threat Intelligence Feed

OPSWAT's threat intelligence feed enables developers to leverage data collected from thousands of MetaDefender Cloud community users and customers. Developers, IT administrators and organizations can easily integrate our up-to-date malware threat intelligence data into their existing tools or solutions to effectively protect their organization against threats.

Use cases for the feed include:

• Organizations that want to be on the lookout for the hottest malware
• IT specialists that implement file denylist based on hashes
• Researchers analyzing trending malware on the market
• Security products that leverage threat intelligence capabilities to harden security measures

Status Endpoints

Various endpoints for querying MetaDefender Cloud.

Dynamic Analysis

API calls for dynamic analysis. General information can be found here: Dynamic analysis