Remote Engine

ClamAV uses high system resources

By default, ClamAV is enabled as an OSINT provider and consumes significant system resources.

Disable ClamAV by updating Sandbox standalone configuration.

• Add the following line to fsTransform custom configuration file: <install_dir>/fsTransform/conf/transform.properties.custom enableClamscanLookup=false
• Restart the fsio service.

Note: MultiScanning will be executed by MetaDefender Core.

Archive scanning might take longer resulting in scan timeouts

Archive scanning may take longer due to the Sandbox engine scanning both the original archive and its extracted contents separately.

Additionally, applying timeout settings effectively to large archives is challenging since each extracted file undergoes individual scanning, potentially prolonging the process, particularly with archives containing numerous or complex files.

Disable archive file types in Sandbox engine workflow.

MetaDefender Core will extract the archives with the Archive engine and Sandbox will receive the extracted files separately. This approach helps the Sandbox engine to effectively schedule scan tasks and apply timeout settings.

• Improved error reporting
• Added HTTP redirection support

• Improved engine performance and stability

• New IOC types for Crypto wallets

• Crypto Wallet IOCs will not be displayed on the UI until a new Filescan Standalone version is released

• Fixed global config “reset to defaults” feature

• Updated logging for MetaDefender Core support package

• Fixed global config reset to default values feature
• Fixed report generation for files including Email IOCs

• YARA matches displayed on MDCore UI

• Scan results are extended with the list of IOCs
• Private scanning option added, enabled by default
• Reputation lookup support added and enabled by default
• Reputation lookup verdict improvements

• Improved Microsoft Office file handling
• Security and performance improvements

• First versions of Embedded and Remote engines for MetaDefender Core customers