Metadefender Core V4.15.0
Total Page:16
File Type:pdf, Size:1020Kb
MetaDefender Core v4.15.0 © 2018 OPSWAT, Inc. All rights reserved. OPSWAT®, MetadefenderTM and the OPSWAT logo are trademarks of OPSWAT, Inc. All other trademarks, trade names, service marks, service names, and images mentioned and/or used herein belong to their respective owners. Table of Contents About This Guide 11 Key Features of MetaDefender Core 12 1. Quick Start with MetaDefender Core 13 1.1. Installation 13 Operating system invariant initial steps 13 Basic setup 14 1.1.1. Configuration wizard 14 1.2. License Activation 19 1.3. Process Files with MetaDefender Core 19 2. Installing or Upgrading MetaDefender Core 20 2.1. Recommended System Requirements 20 System Requirements For Server 20 Browser Requirements for the Metadefender Core Management Console 22 2.2. Installing MetaDefender 22 Installation 22 Installation notes 23 2.2.1. Installing Metadefender Core using command line 23 2.2.2. Installing Metadefender Core using the Install Wizard 25 2.3. Upgrading MetaDefender Core 25 Upgrading from MetaDefender Core 3.x 25 Upgrading from MetaDefender Core 4.x 26 2.4. MetaDefender Core Licensing 26 2.4.1. Activating Metadefender Licenses 26 2.4.2. Checking Your Metadefender Core License 33 2.5. Performance and Load Estimation 34 What to know before reading the results: Some factors that affect performance 34 How test results are calculated 35 Test Reports 35 Performance Report - Multi-Scanning On Linux 35 Performance Report - Multi-Scanning On Windows 39 2.6. Special installation options 42 Use RAMDISK for the tempdirectory 42 3. Configuring MetaDefender Core 46 3.1. Management Console 46 3.1.1. Password Recovery 47 3.2. MetaDefender Configuration 54 3.2.1. Startup Core Configuration 55 3.2.2. Startup Node Configuration 59 3.2.3 Nginx related configuration (for API Rate Limiting) 62 3.3. User management 64 3.3.1. Users and groups 64 3.3.2. Roles 69 3.3.3. User directories 71 3.3.4. Active Directory attributes 79 3.3.5. Change user password 82 3.4. Update settings 83 Internet 84 Folder 85 Manual 85 3.5. Clean up scan database 86 Technology Note: 86 3.6. Policy configuration 86 3.6.1. How MetaDefender Core policies work 87 3.6.2. Workflow template configuration 87 3.6.3. Security zone configuration 102 3.6.4. Workflow rule configuration 102 3.6.5. Quarantine 107 3.7. Logging 115 3.7.1. Configuration 115 3.7.2. Debug logging 116 3.8 Security settings on web console 116 3.8.1 Enabling HTTPS 117 3.8.2 Session timeout 120 3.9. Configuring proxy settings 121 How can I set proxy server for the product 121 3.10. External Scanners And Post Actions 122 External Scanners 122 Post Actions 125 3.11. Yara rule sources 127 3.12. Configuring mail settings 128 Server configuration 129 User authentication 130 4. Process files with MetaDefender Core 131 Process Files via REST API 131 Process Files via Web Interface 132 Choose what to process and how 132 Start processing 133 Progress of scanning 133 5. Data Sanitization 134 6. Operating MetaDefender Core 136 6.1. Dashboard 136 Overview page 136 Scan history 137 Quarantine 137 Update history 137 6.2. Inventory Management 138 Certificates 138 Nodes 141 Skip by hash 143 Technologies 145 6.3. Regular Maintenance 153 Checking for Upgrades 153 Checking Engines / Databases Health 153 6.4 Import/Export configuration 153 Export 154 Import 154 Note 154 7. MetaDefender Core Developer Guide 155 How to Interact with MetaDefender Core using REST 155 File scan process 155 7.1. MetaDefender API 155 7.1.1. Sessions 156 7.1.2. Licensing 159 7.1.3. Processing files 163 7.1.4. Processing files in batch 185 7.1.5. Download Sanitized Files 194 7.1.6. Vulnerability Info In Processing Result 195 7.1.7. Skip by hash 199 7.1.8. Get version of components 204 7.1.9. Configuration related APIs 207 7.1.10. Yara 330 7.2. MetaDefender API Code Samples 336 7.3. Deployment automation support 338 Installation 339 Initialization 339 Configuration 343 8. Advanced MetaDefender Deployment 344 8.1. Scripted license management 344 Requirements 344 Activation steps 344 Deactivation steps 346 Important notes 347 8.2. Multi-node deployment 347 Setting up several Metadefender Core nodes 347 8.3. Using external load-balancer 350 8.3.1. HTTP(S) - Layer 7 load balancing 351 8.3.2. DNS load balancing 353 8.4. Cloud Deployment 356 8.4.1. AWS Deployment 356 9. Troubleshooting MetaDefender Core 377 Installation issues 377 Issues with nodes 377 Where are the Metadefender Core logs located? 377 How can I create a support package? 377 Issues under high load 377 How to Create Support Package? 378 Creating the package on Linux 378 Creating the package on Windows 378 Content of the created package 379 How to Read the Metadefender Core Log? 379 Files 379 Format 379 Severity levels of log entries 380 Inaccessible Management Console 380 How to detect 380 Solution 380 Possible Issues on Nodes 381 Q. Node detected 3rd party product on system 381 Q. There is no scan node connected 381 Too Many Sockets or Files Open 382 How to detect 382 Solution 382 Too Many TIME_WAIT Socket 383 How to detect 383 Solution 383 Technical Insights 384 10. Release notes 386 10.1. Archived release notes 387 Version v4.14.3 387 Version v4.14.2 388 Version v4.14.1 388 Version v4.14.0 389 Version v4.13.2 389 Version v4.13.1 389 Version v4.13.0 390 Version v4.12.2 390 Version v4.12.1 390 Version v4.12.0 391 Version v4.11.3 391 Version v4.11.2 391 Version v4.11.1 392 Version v4.11.0 392 Version v4.10.2 393 Version v4.10.1 393 Version v4.10.0 393 Version 4.9.1 394 Version 4.9.0 395 Version 4.8.2 395 Version 4.8.1 395 Version 4.7.2 397 Version 4.7.1 397 Version 4.6.3 398 Version 4.6.2 398 Version 4.6.1 398 Version 4.6.0 399 Version 4.5.1 400 Version 4.5.0 400 Version 4.4.1 400 Version 4.3.0 401 Version 4.2.0 402 Version 4.1.0 403 Version 4.0.1 403 Version 4.0.0 404 11. Legal 405 Copyright 405 DISCLAIMER OF WARRANTY 405 COPYRIGHT NOTICE 405 Export Classification EAR99 405 12. Knowledge Base Articles 406 Are MetaDefender Core v4 upgrades free? 407 Are there any dependencies that need to be fulfilled for MetaDefender Core v4 engines ? 408 Does Metadefender Core v4 offer real-time antivirus protection on the system where it is installed? 408 Does MetaDefender Core v4 Detect the NotPetya Ransomware? 409 Does the fixing updates for Meltdown and Spectre vulnerabilities affect any engines in MetaDefender Core v4? 411 External scanners in MetaDefender core v4.8.0 and above 412 How can I configure the maximum queue size in Metadefender Core v4 ? 414 How can I find a sanitized file scanned with MetaDefender Core v4? 415 How can I increase the scaling up performance? 416 How can I upgrade from Core v4.7.0/v4.7.1 to a newer Core v4.7 release 418 How can the TEMP folder be changed? 419 How do I collect verbose debug packages on MetaDefender Core v4 for Linux? 420 How do I deploy MetaDefender Core v4 to an offline Linux environment? 421 Installing MetaDefender Core 421 Activate your license 422 Installing the MetaDefender Update Downloader utility 423 Applying offline updates 425 Contacting OPSWAT Support 426 How do I deploy MetaDefender Core v4 to an offline Windows environment? 426 Installing MetaDefender Core 427 Activate your license 427 Installing the MetaDefender Update Downloader utility 428 Applying offline updates 430 Contacting OPSWAT Support 431 How do I disable real-time protection of my anti-malware software if it is not allowed by corporate policy for use with MetaDefender Core v4? 431 How do I remove an engine from my MetaDefender v4 instance? 433 How do I use MetaDefender Core v4 Workflows ? 433 Defining and administering Workflow Templates in MetaDefender Core v4 434 How long is the support life cycle for a specific version/release of MetaDefender Core v4? 435 How to install MSE on Windows Server 2012 R2 and Windows Server 2016 437 MSE on Windows Server 2012 R2 437 MSE on Windows Server 2016 441 How to transfer your Metadefender Core v4 scan history database 448 Is action needed because Metadefender v4's AVG license is expiring on 2018-06-15? 448 What do I need to do? 449 What if I don't take action by June 15, 2018? 449 Why is the license for AVG expiring? 449 What if I need more assistance from OPSWAT on this topic? 449 Is Metadefender Core compromised while scanning files? 450 Is there a virus test I could use to test MetaDefender Core v4? 450 MetaDefender Core v4 shows a large number of files that failed to scan. What can I do? 450 Post actions in MetaDefender core V4.8.0 and above 452 Queue mechanism on Metadefender Core v4 454 Queue mechanism in general 454 Queue size for requests 454 Limit of concurrent connections 454 Max file size allowed 455 Using MetaDefender core V4 BLACKLIST/WHITELIST feature 455 Using filetype groups VS. MIME-types VS file extensions 455 Using Regular Expressions 455 Advanced usage 456 What are Security Policies and how do I use them? 456 Understanding Security Policies 456 What features of MetaDefender Core version 3 are available in version 4 ? 458 What file types are supported by DLP engine? 461 What is Data Loss Prevention (DLP)? 461 Meta Data Check (Only): 462 File Conversion and Parse: 462 What file types can be verified by MetaDefender v4? 463 What links, target-services or target host-IP's need to be allowed for MetaDefender Core v4? 711 What operating system patches should be applied to the system hosting MetaDefender Core? 712 What should I do if an engine is in "failed" or "permanently_failed" status? 712 What temporary folder do Custom Engines use ? 713 Where can I submit false positives detected by MetaDefender Core v4? 713 Which are the supported archive formats for MetaDefender Core v4? 716 Why don't I see the Data Sanitization engine in MetaDefender Core v4? 717 Why should I upgrade my MetaDefender Core v4? 717 About This Guide Welcome to the Metadefender v4 guide.