Metadefender Core V4.15.2
Total Page:16
File Type:pdf, Size:1020Kb
MetaDefender Core v4.15.2 © 2018 OPSWAT, Inc. All rights reserved. OPSWAT®, MetadefenderTM and the OPSWAT logo are trademarks of OPSWAT, Inc. All other trademarks, trade names, service marks, service names, and images mentioned and/or used herein belong to their respective owners. Table of Contents About This Guide 11 Key Features of MetaDefender Core 12 1. Quick Start with MetaDefender Core 13 1.1. Installation 13 Operating system invariant initial steps 13 Basic setup 14 1.1.1. Configuration wizard 14 1.2. License Activation 19 1.3. Process Files with MetaDefender Core 19 2. Installing or Upgrading MetaDefender Core 20 2.1. Recommended System Requirements 20 System Requirements For Server 20 Browser Requirements for the Metadefender Core Management Console 24 2.2. Installing MetaDefender 24 Installation 24 Installation notes 24 2.2.1. Installing Metadefender Core using command line 25 2.2.2. Installing Metadefender Core using the Install Wizard 27 2.3. Upgrading MetaDefender Core 27 Upgrading from MetaDefender Core 3.x 27 Upgrading from MetaDefender Core 4.x 27 2.4. MetaDefender Core Licensing 28 2.4.1. Activating Metadefender Licenses 28 2.4.2. Checking Your Metadefender Core License 34 2.5. Performance and Load Estimation 35 What to know before reading the results: Some factors that affect performance 35 How test results are calculated 36 Test Reports 36 Performance Report - Multi-Scanning On Linux 36 Performance Report - Multi-Scanning On Windows 40 2.6. Special installation options 43 Use RAMDISK for the tempdirectory 43 3. Configuring MetaDefender Core 47 3.1. Management Console 47 3.1.1. Password Recovery 48 3.2. MetaDefender Configuration 55 3.2.1. Startup Core Configuration 56 3.2.2. Startup Node Configuration 60 3.2.3 Nginx related configuration (for API Rate Limiting) 63 3.3. User management 65 3.3.1. Users and groups 65 3.3.2. Roles 70 3.3.3. User directories 72 3.3.4. Active Directory attributes 80 3.3.5. Change user password 83 3.4. Update settings 84 Internet 85 Folder 86 Manual 86 3.5. Clean up scan database 87 Technology Note: 87 3.6. Policy configuration 87 3.6.1. How MetaDefender Core policies work 88 3.6.2. Workflow template configuration 88 3.6.3. Security zone configuration 103 3.6.4. Workflow rule configuration 103 3.6.5. Quarantine 108 3.7. Logging 116 3.7.1. Configuration 116 3.7.2. Debug logging 117 3.8 Security settings on web console 117 3.8.1 Enabling HTTPS 118 3.8.2 Session timeout 121 3.9. Configuring proxy settings 122 How can I set proxy server for the product 122 3.10. External Scanners And Post Actions 123 External Scanners 123 Post Actions 126 3.11. Yara rule sources 128 3.12. Configuring mail settings 129 Server configuration 130 User authentication 131 4. Process files with MetaDefender Core 132 Process Files via REST API 132 Process Files via Web Interface 133 Choose what to process and how 133 Start processing 134 Progress of scanning 134 5. Data Sanitization 135 6. Operating MetaDefender Core 137 6.1. Dashboard 137 Overview page 137 Scan history 138 Quarantine 138 Update history 138 6.2. Inventory Management 139 Certificates 139 Nodes 142 Skip by hash 144 Technologies 146 6.3. Regular Maintenance 154 Checking for Upgrades 154 Checking Engines / Databases Health 154 6.4 Import/Export configuration 154 Export 155 Import 155 Note 155 7. MetaDefender Core Developer Guide 156 How to Interact with MetaDefender Core using REST 156 File scan process 156 7.1. MetaDefender API 156 7.1.1. Sessions 157 7.1.2. Licensing 160 7.1.3. Processing files 164 7.1.4. Processing files in batch 186 7.1.5. Download Sanitized Files 194 7.1.6. Vulnerability Info In Processing Result 196 7.1.7. Skip by hash 199 7.1.8. Get version of components 205 7.1.9. Configuration related APIs 208 7.1.10. Yara 330 7.2. MetaDefender API Code Samples 337 7.3. Deployment automation support 338 Installation 339 Initialization 340 Configuration 344 8. Advanced MetaDefender Deployment 345 8.1. Scripted license management 345 Requirements 345 Activation steps 345 Deactivation steps 347 Important notes 348 8.2. Multi-node deployment 348 Setting up several Metadefender Core nodes 348 8.3. Using external load-balancer 351 8.3.1. HTTP(S) - Layer 7 load balancing 352 8.3.2. DNS load balancing 354 8.4. Cloud Deployment 357 8.4.1. AWS Deployment 357 9. Troubleshooting MetaDefender Core 378 Installation issues 378 Issues with nodes 378 Where are the Metadefender Core logs located? 378 How can I create a support package? 378 Issues under high load 378 How to Create Support Package? 379 Creating the package on Linux 379 Creating the package on Windows 379 Content of the created package 380 How to Read the Metadefender Core Log? 380 Files 380 Format 380 Severity levels of log entries 381 Inaccessible Management Console 381 How to detect 381 Solution 381 Possible Issues on Nodes 382 Q. Node detected 3rd party product on system 382 Q. There is no scan node connected 382 Too Many Sockets or Files Open 383 How to detect 383 Solution 383 Too Many TIME_WAIT Socket 384 How to detect 384 Solution 384 Technical Insights 385 10. Release notes 386 10.1. Archived release notes 386 Version v4.15.1 386 Version v4.15.0 387 Version v4.14.3 388 Version v4.14.2 389 Version v4.14.1 389 Version v4.14.0 389 Version v4.13.2 390 Version v4.13.1 390 Version v4.13.0 390 Version v4.12.2 391 Version v4.12.1 391 Version v4.12.0 391 Version v4.11.3 392 Version v4.11.2 392 Version v4.11.1 392 Version v4.11.0 393 Version v4.10.2 393 Version v4.10.1 393 Version v4.10.0 394 Version 4.9.1 395 Version 4.9.0 395 Version 4.8.2 396 Version 4.8.1 396 Version 4.7.2 397 Version 4.7.1 397 Version 4.6.3 398 Version 4.6.2 398 Version 4.6.1 399 Version 4.6.0 399 Version 4.5.1 400 Version 4.5.0 400 Version 4.4.1 401 Version 4.3.0 402 Version 4.2.0 402 Version 4.1.0 403 Version 4.0.1 404 Version 4.0.0 404 11. Legal 405 Copyright 405 DISCLAIMER OF WARRANTY 405 COPYRIGHT NOTICE 405 Export Classification EAR99 405 12. Knowledge Base Articles 406 Are MetaDefender Core v4 upgrades free? 407 Are there any dependencies that need to be fulfilled for MetaDefender Core v4 engines ? 408 Does Metadefender Core v4 offer real-time antivirus protection on the system where it is installed? 408 Does MetaDefender Core v4 Detect the NotPetya Ransomware? 409 Does the fixing updates for Meltdown and Spectre vulnerabilities affect any engines in MetaDefender Core v4? 411 External scanners in MetaDefender core v4.8.0 and above 412 How can I configure the maximum queue size in Metadefender Core v4 ? 414 How can I find a sanitized file scanned with MetaDefender Core v4? 415 How can I increase the scaling up performance? 416 How can I upgrade from Core v4.7.0/v4.7.1 to a newer Core v4.7 release 418 How can the TEMP folder be changed? 419 How do I collect verbose debug packages on MetaDefender Core v4 for Linux? 420 How do I deploy MetaDefender Core v4 to an offline Linux environment? 421 Installing MetaDefender Core 422 Activate your license 422 Installing the MetaDefender Update Downloader utility 423 Applying offline updates 425 Contacting OPSWAT Support 426 How do I deploy MetaDefender Core v4 to an offline Windows environment? 426 Installing MetaDefender Core 427 Activate your license 427 Installing the MetaDefender Update Downloader utility 428 Applying offline updates 430 Contacting OPSWAT Support 431 How do I remove an engine from my MetaDefender v4 instance? 431 How do I use MetaDefender Core v4 Workflows ? 432 Defining and administering Workflow Templates in MetaDefender Core v4 432 How long is the support life cycle for a specific version/release of MetaDefender Core v4? 433 How to install MSE on Windows Server 2012 R2 and Windows Server 2016 436 MSE on Windows Server 2012 R2 436 MSE on Windows Server 2016 440 How to transfer your Metadefender Core v4 scan history database 447 Is action needed because Metadefender v4's AVG license is expiring on 2018-06-15? 447 What do I need to do? 448 What if I don't take action by June 15, 2018? 448 Why is the license for AVG expiring? 448 What if I need more assistance from OPSWAT on this topic? 448 Is Metadefender Core compromised while scanning files? 449 Is there a virus test I could use to test MetaDefender Core v4? 449 MetaDefender Core v4 shows a large number of files that failed to scan. What can I do? 449 Post actions in MetaDefender core V4.8.0 and above 451 Queue mechanism on Metadefender Core v4 453 Queue mechanism in general 453 Queue size for requests 453 Limit of concurrent connections 453 Max file size allowed 454 Using MetaDefender core V4 BLACKLIST/WHITELIST feature 454 Using filetype groups VS. MIME-types VS file extensions 454 Using Regular Expressions 454 Advanced usage 455 What are Security Policies and how do I use them? 455 Understanding Security Policies 455 What features of MetaDefender Core version 3 are available in version 4 ? 457 What file types are supported by DLP engine? 460 What is Data Loss Prevention (DLP)? 460 Meta Data Check (Only): 461 File Conversion and Parse: 461 What file types can be verified by MetaDefender v4? 462 What links, target-services or target host-IP's need to be allowed for MetaDefender Core v4? 710 What operating system patches should be applied to the system hosting MetaDefender Core? 711 What should I do if an engine is in "failed" or "permanently_failed" status? 711 What temporary folder do Custom Engines use ? 712 Where can I submit false positives detected by MetaDefender Core v4? 712 Which are the supported archive formats for MetaDefender Core v4? 715 Why don't I see the Data Sanitization engine in MetaDefender Core v4? 716 Why should I upgrade my MetaDefender Core v4? 716 About This Guide Welcome to the Metadefender v4 guide.