Opswat Metadefender

The OPSWAT MetaDefender Connector integrates with Swimlane to retrieve information from OPSWAT.

Prerequisites

The OPSWAT MetaDefender asset requires an API Key.

Capabilities

The OPSWAT MetaDefender Connector has the following capabilities:

Get EXIF Lookup

Get PE Info Lookup

Get APK Manifest Lookup

Download Sanitize File

Get IP Lookup

Analyze File

Retrieving Webhook Status

Retrieving Scan Reports using Data Hash

Fetch Analysis Result

Additional information about the API's endpoints can be found here.

This Connector was last tested against product version: API V4.

Configurations

API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
apikey	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Analyze File

In this action scan is done asynchronously and each scan request is tracked by data id of which result can be retrieved by API Fetch Scan Result.

Endpoint

URL: v4/file

Method: POST

Input

Argument Name	Type	Required	Description
headers	object	Required	HTTP headers for the request
headers.Content-Type	string	Required	Specify the http content type, it can be multipart/form-data (when doing multipart upload) or application/octet-stream (when doing binary upload). When using multipart/form-data the file key in Body section must have a name.
headers.filename	string	Optional	File name is mainly for the descriptive purpose. File name does not affect the analysis. However, it is recommended to provide this info in order for you to associate the result with the actual file from the UI.
headers.archivepwd	string	Optional	If the submitted file is a password-protected archive, the value provided will be used to unlock the file. This information is removed once analysis is done.
headers.filepassword	string	Optional	If the submitted file is a password-protected document file, the value provided will be used to unlock the file. This information is removed once analysis is done.
headers.samplesharing	string	Optional	By default, it is enabled (1). If enabled, opt in to share the file with the malware research community or internal malware research team to investigate further, especially when the file is considered either false positive or potential outbreak malware. Only paid customers can exclude this file from our sample sharing algorithm. If disabled (0), the file will be deleted immediately once the analysis is done. Allowed values are 0 (disable), 1 (enable)
headers.privateprocessing	string	Optional	By default, it is disabled (0). If enabled (1), the file will be immediately removed after analysis is done, and analysis results are only available to the owner, who submits the file for analysis. If disabled, the analysis results will be viewable to the public, and the samplesharing parameter will determine the malware sharing. Allowed values are 0 (disable) , 1 (enable)
headers.downloadfrom	string	Optional	Link to download file, allow the user to scan file by link before actually downloading it. Allowed values - Only direct downloads, no redirects
headers.rule	string	Optional	Multiscanning will be performed by default if no value is set for the rule header. You can combine multiple workflows but listing them and separating them with a ",". However, multiscanning will not be performed by default if you elect to do a sandbox scan (see sandbox header below). If you want to perform multiscanning in addition to a sandbox scan, you will need to enable the multiscan rule. Allowed values are multiscan (performs multiscanning), sanitize (performs both multiscanning and file sanitization), cdr (file sanitization without multiscan), unarchive (performs both unarchiving and multiscanning)
headers.sandbox	string	Optional	Also request a sandbox scan for the uploaded file. Allowed values are windows7, windows10
headers.sandbox_timeout	string	Optional	Specifies for how long the file should be analyzed on the sandbox. Short=150s, long=300s. Allowed values are short,long
headers.sandbox_browser	string	Optional	What browser to use when uploading html/JavaScript files or analyzing URLs. Allowed values are os_default, chrome, firefox
headers.callbackurl	string	Optional	Specify a valid, publicly accessible URL where we can send the scan results when finished (asynchronous scanning, similar to webhooks). Allowed values - valid URLs
headers.rescan_count	string	Optional	Defines how many times the file should be rescanned. Allowed values - 1-720 (the full schedule should fit into 720 hours)
headers.rescan_interval	string	Optional	Defines how many hours should pass between two consecutive scans. Allowed values - 1-720 (the full schedule should fit into 720 hours)
data_body	string	Optional	Response data

Input Example

{"data_body":"@/path/to/data.file"}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data_id	string	Response data
status	string	Status value
in_queue	number	Output field: in_queue
queue_priority	string	Output field: queue_priority

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 21 Sep 2023 06:27:30 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Strict-Transport-Security":"max-age=63072000; includeSubDomains; preload","Vary":"Accept-Encoding","X-Content-Type-Options":"nosniff","ETag":"\"440-/zSwC/NZucC+1KgadoNhhwXYJjY\"","X-Response-Time":"115ms","Content-Encoding":"gzip","X-RateLimit-For":"reputation_api","X-RateLimit-Limit":"4000","X-RateLimit-Used":"1",...

APK Manifest Lookup

This action looks up the APK manifest analysis of a hash by MD5, SHA1 or SHA256.

Endpoint

URL: v4/hash/{{apk_hash}}/apk-manifest

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.apk_hash	string	Required	The MD5, SHA1 or SHA256 hash containing the Android Manifest information

Input Example

{"path_parameters":{"apk_hash":"9D4C04C49EB66AEAB21EA688BA3B979616E6CD22B43E8208E5C29142910BAE44"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
application	object	Output field: application
application.usesLibraries	array	Output field: application.usesLibraries
application.usesLibraries.required	boolean	Output field: application.usesLibraries.required
application.usesLibraries.name	string	Name of the resource
application.providers	array	Unique identifier
application.providers.pathPermissions	array	Unique identifier
application.providers.pathPermissions.file_name	string	Unique identifier
application.providers.pathPermissions.file	string	Unique identifier
application.providers.metaData	array	Response data
application.providers.metaData.file_name	string	Response data
application.providers.metaData.file	string	Response data
application.providers.grantUriPermissions	array	Unique identifier
application.providers.grantUriPermissions.file_name	string	Unique identifier
application.providers.grantUriPermissions.file	string	Unique identifier
application.providers.initOrder	number	Unique identifier
application.providers.authorities	string	Unique identifier
application.providers.exported	boolean	Unique identifier
application.providers.name	string	Unique identifier
application.receivers	array	Output field: application.receivers
application.receivers.metaData	array	Response data
application.receivers.metaData.file_name	string	Response data
application.receivers.metaData.file	string	Response data
application.receivers.intentFilters	array	Output field: application.receivers.intentFilters

Output Example

{"application":{"usesLibraries":[{}],"providers":[{}],"receivers":[{}],"services":[{}],"launcherActivities":[{}],"activityAliases":[{}],"activities":[{}],"supportsRtl":true,"largeHeap":true,"hardwareAccelerated":true,"allowBackup":true,"name":"Example Name","icon":"string","label":"string","theme":"string"},"supportsGlTextures":[{"file_name":"Example Name","file":"string"}],"compatibleScreens":[{"file_name":"Example Name","file":"string"}],"supportsScreens":{"xlargeScreens":true,"resizeable":tru...

Download Sanitized Files

Download sanitized files

Endpoint

URL: v4/file/converted/{{dataId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.dataId	string	Required	The data ID assigned to the file that underwent data sanitization

Input Example

{"path_parameters":{"dataId":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
sanitizedFilePath	string	Output field: sanitizedFilePath

Output Example

{"sanitizedFilePath":"https://s3.us-west-2.amazonaws.com/p.files.metadefender.com/dt%3D190122/rkss9asN..."}

EXIF Lookup

This action looks up the EXIF of a hash by md5, sha1 or sha256.

Endpoint

URL: v4/hash/{{exif_hash}}/exif

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.exif_hash	string	Required	The MD5, SHA1 or SHA256 hash that you need exif info for

Input Example

{"path_parameters":{"exif_hash":"6E078FC7D85ADFFF1DE55EEBB5A79645D5998ADD"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
ExifToolVersion	number	Output field: ExifToolVersion
FileName	string	Name of the resource
FileSize	string	Output field: FileSize
FileType	string	Type of the resource
FileTypeExtension	string	Type of the resource
MIMEType	string	Type of the resource
JFIFVersion	number	Output field: JFIFVersion
ResolutionUnit	string	Output field: ResolutionUnit
XResolution	number	Output field: XResolution
YResolution	number	Output field: YResolution
ImageWidth	number	Unique identifier
ImageHeight	number	Output field: ImageHeight
EncodingProcess	string	Output field: EncodingProcess
BitsPerSample	number	Output field: BitsPerSample
ColorComponents	number	Output field: ColorComponents
YCbCrSubSampling	string	Output field: YCbCrSubSampling
ImageSize	string	Output field: ImageSize
Megapixels	number	Output field: Megapixels

Output Example

{"status_code":200,"response_headers":{"Date":"Wed, 20 Sep 2023 17:23:12 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Strict-Transport-Security":"max-age=63072000; includeSubDomains; preload","Vary":"Accept-Encoding","X-Content-Type-Options":"nosniff","ETag":"\"439-qGVeUfpXu5Mu/wxegRGHzQbKo4w\"","X-Response-Time":"4ms","Content-Encoding":"gzip","X-Authenticated":"by apikey","X-Account-Type":"registered","Cache-Control":"no-cache, ...

Fetch Analysis Result

This action retrieves scan results. Scan is done asynchronously and each scan request is tracked by a dataID.

Endpoint

URL: v4/file/{{dataId}}

Method: GET

Input

Argument Name	Type	Required	Description
headers	object	Required	HTTP headers for the request
headers.x-file-metadata	number	Required	Retrieves file metadata and hash_results
path_parameters.dataId	string	Required	The dataId that the file you uploaded was assigned

Input Example

{"path_parameters":{"dataId":"ZTE2MTIyNkhKeGs5WElSNHhIMVFGLVlUYk85LQ"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
scan_result_history_length	number	Result of the operation
sandbox	boolean	Output field: sandbox
malware_family	string	Output field: malware_family
malware_type	array	Type of the resource
threat_name	string	Name of the resource
file_id	string	Unique identifier
data_id	string	Response data
scan_results	object	Result of the operation
scan_results.scan_details	object	Result of the operation
scan_results.scan_details.Lavasoft	object	Result of the operation
scan_results.scan_details.Lavasoft.scan_time	number	Result of the operation
scan_results.scan_details.Lavasoft.def_time	string	Result of the operation
scan_results.scan_details.Lavasoft.scan_result_i	number	Result of the operation
scan_results.scan_details.Lavasoft.threat_found	string	Result of the operation
scan_results.scan_details.STOPzilla	object	Result of the operation
scan_results.scan_details.STOPzilla.scan_time	number	Result of the operation
scan_results.scan_details.STOPzilla.def_time	string	Result of the operation
scan_results.scan_details.STOPzilla.scan_result_i	number	Result of the operation
scan_results.scan_details.STOPzilla.threat_found	string	Result of the operation
scan_results.scan_all_result_i	number	Result of the operation
scan_results.start_time	string	Result of the operation
scan_results.total_time	number	Result of the operation
scan_results.total_avs	number	Result of the operation

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 21 Sep 2023 15:36:58 GMT","Content-Type":"application/json; charset=utf-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Strict-Transport-Security":"max-age=63072000; includeSubDomains; preload","Vary":"Accept-Encoding","X-Content-Type-Options":"nosniff","ETag":"\"1577-/rwl3jWfe150yYeoTmPyuE4gTDU\"","X-Response-Time":"14ms","Content-Encoding":"gzip","X-Authenticated":"by apikey","X-Account-Type":"registered","Cache-Control":"no-cache...

IP Lookup

This action retrieves information about given IP (IPv4 + IPv6) from a CIF server

Endpoint

URL: v4/ip/{{observable_ip}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.observable_ip	string	Required	IP address that you want to scan

Input Example

{"path_parameters":{"observable_ip":"109.229.210.250"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
address	string	Output field: address
lookup_results	object	Result of the operation
lookup_results.start_time	string	Result of the operation
lookup_results.detected_by	number	Result of the operation
lookup_results.sources	array	Result of the operation
lookup_results.sources.provider	string	Unique identifier
lookup_results.sources.assessment	string	Result of the operation
lookup_results.sources.detect_time	string	Result of the operation
lookup_results.sources.update_time	string	Result of the operation
lookup_results.sources.status	number	Status value
geo_info	object	Output field: geo_info
geo_info.country	object	Output field: geo_info.country
geo_info.country.name	string	Name of the resource
geo_info.city	object	Output field: geo_info.city
geo_info.city.name	string	Name of the resource
geo_info.location	object	Output field: geo_info.location
geo_info.location.latitude	number	Output field: geo_info.location.latitude
geo_info.location.longitude	number	Output field: geo_info.location.longitude
geo_info.subdivisions	array	Output field: geo_info.subdivisions
geo_info.subdivisions.name	string	Name of the resource

Output Example

PE Info Lookup

This action looks up the PE (portable executable file format) info of a hash by MD5, SHA1 or SHA256.

Endpoint

URL: v4/hash/{{peinfo_hash}}/peinfo

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.peinfo_hash	string	Required	The MD5, SHA1 or SHA256 hash that you need PE info for

Input Example

{"path_parameters":{"peinfo_hash":"8952089536C5489C5B38EE426450ADFC"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
signature	object	Output field: signature
signature.invalid	boolean	Unique identifier
signature.countersigner	object	Output field: signature.countersigner
signature.countersigner.signing_time	string	Time value
signature.countersigner.serial	string	Output field: signature.countersigner.serial
signature.countersigner.issuer	string	Output field: signature.countersigner.issuer
signature.signer	object	Output field: signature.signer
signature.signer.more_info	string	Output field: signature.signer.more_info
signature.signer.program_name	string	Name of the resource
signature.signer.serial	string	Output field: signature.signer.serial
signature.signer.issuer	string	Output field: signature.signer.issuer
signature.certificates	array	Output field: signature.certificates
signature.certificates.Valid_to	string	Unique identifier
signature.certificates.valid_from	string	Unique identifier
signature.certificates.serial	string	Output field: signature.certificates.serial
signature.certificates.issuer	string	Output field: signature.certificates.issuer
signature.certificates.subject	string	Output field: signature.certificates.subject
signature.authenticode_sections	object	Output field: signature.authenticode_sections
signature.authenticode_sections.certtable	array	Output field: signature.authenticode_sections.certtable
signature.authenticode_sections.datadir_certtable	array	Response data
signature.authenticode_sections.checksum	array	Output field: signature.authenticode_sections.checksum
resource_info	array	Output field: resource_info
resource_info.resource_ids	array	Unique identifier

Output Example

{"signature":{"invalid":true,"countersigner":{"signing_time":"string","serial":"string","issuer":"string"},"signer":{"more_info":"string","program_name":"Example Name","serial":"string","issuer":"string"},"certificates":[{}],"authenticode_sections":{"certtable":[],"datadir_certtable":[],"checksum":[]}},"resource_info":[{"resource_ids":[],"name":"Example Name"}],"exported_functions":["string"],"imported_dlls":[{"functions":[],"name":"Example Name"}],"section_headers":[{"characteristics":[],"point...

Retrieving Scan Reports Using Datahash

This action retrieves scan reports by looking up a hash using MD5, SHA1 or SHA256

Endpoint

URL: v4/hash/{{hash}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.hash	string	Required	Retrieve scan reports by looking up a hash using MD5, SHA1 or SHA256

Input Example

{"path_parameters":{"hash":"A5C19D9FFE8804586E8F4C0DFCC66DE"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
scan_result_history_length	number	Result of the operation
file_id	string	Unique identifier
data_id	string	Response data
sanitized	object	Output field: sanitized
sanitized.reason	string	Response reason phrase
sanitized.result	string	Result of the operation
process_info	object	Output field: process_info
process_info.result	string	Result of the operation
process_info.profile	string	Output field: process_info.profile
process_info.post_processing	object	Output field: process_info.post_processing
process_info.post_processing.copy_move_destination	string	Output field: process_info.post_processing.copy_move_destination
process_info.post_processing.converted_to	string	Output field: process_info.post_processing.converted_to
process_info.post_processing.converted_destination	string	Output field: process_info.post_processing.converted_destination
process_info.post_processing.actions_ran	string	Output field: process_info.post_processing.actions_ran
process_info.post_processing.actions_failed	string	Output field: process_info.post_processing.actions_failed
process_info.file_type_skipped_scan	boolean	Type of the resource
process_info.blocked_reason	string	Response reason phrase
scan_results	object	Result of the operation
scan_results.scan_details	object	Result of the operation
scan_results.scan_details.Zillya!	object	Result of the operation
scan_results.scan_details.Zillya!.threat_found	string	Result of the operation
scan_results.scan_details.Zillya!.scan_time	number	Result of the operation
scan_results.scan_details.Zillya!.scan_result_i	number	Result of the operation

Output Example

{"scan_result_history_length":123,"file_id":"string","data_id":"string","sanitized":{"result":"string"},"process_info":{"result":"string","profile":"string","post_processing":{"copy_move_destination":"string","converted_to":"string","converted_destination":"string","actions_ran":"string","actions_failed":"string"},"file_type_skipped_scan":true,"blocked_reason":"string"},"scan_results":{"scan_details":{"Zillya!":{},"Xvirus Personal Guard":{},"VirusBlokAda":{},"TrendMicro House Call":{},"TrendMicr...

Retrieving Webhook Status

Using this endpoint, after uploading a file with the 'callbackurl' header, the status of the webhook callback can be checked.

Endpoint

URL: v4/file/webhooks/{{dataId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.dataId	string	Required	The dataId received on upload (Optional). If omitted, returns all the latest webhook calls in the last 12 hours.

Input Example

{"path_parameters":{"dataId":"ZTE2MTIyNkhKeGs5WElSNHhIMVFGLVlUYk85LQ"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 21 Sep 2023 15:15:14 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"61","Connection":"keep-alive","Strict-Transport-Security":"max-age=63072000; includeSubDomains; preload","Vary":"Accept-Encoding","X-Response-Time":"2ms","X-Authenticated":"by apikey","X-Account-Type":"registered","Cache-Control":"no-cache, no-store, must-revalidate","Pragma":"no-cache","X-Content-Type-Options":"nosniff"}}

Response Headers

Header	Description	Example
Cache-Control	Directives for caching mechanisms	no-cache, no-store, must-revalidate
Connection	HTTP response header: Connection	keep-alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Length	The length of the response body in bytes	68
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Wed, 20 Sep 2023 17:28:54 GMT
ETag	An identifier for a specific version of a resource	"439-qGVeUfpXu5Mu/wxegRGHzQbKo4w"
Pragma	HTTP response header: Pragma	no-cache
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
Vary	HTTP response header: Vary	Accept-Encoding
X-Account-Type	HTTP response header: X-Account-Type	registered
X-Authenticated	HTTP response header: X-Authenticated	by apikey
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
X-RateLimit-For	HTTP response header: X-RateLimit-For	reputation_api
X-RateLimit-Interval	HTTP response header: X-RateLimit-Interval	86400
X-RateLimit-Limit	The number of requests allowed in the current rate limit window	4000
X-RateLimit-Remaining	The number of requests remaining in the current rate limit window	4000
X-RateLimit-Reset-In	HTTP response header: X-RateLimit-Reset-In	86400s
X-RateLimit-Used	HTTP response header: X-RateLimit-Used	1
X-Redis-Partial-Cache	HTTP response header: X-Redis-Partial-Cache	true
X-Response-Time	HTTP response header: X-Response-Time	2ms