service_manifest.yml

# Name of the service
name: MetaDefender_Sandbox
# Version of the service
version: $SERVICE_TAG

description: This Assemblyline service interfaces with the MetaDefender Sandbox -previously known as OPSWAT Filescan Sandbox-, detonating files and URLs. This integration was developed by OPSWAT. (C) OPSWAT, Inc.

accepts: .*
rejects: empty

stage: CORE
category: Dynamic Analysis

file_required: true
timeout: 600

# is the service enabled by default
enabled: true

uses_metadata: true

# -1000: safe
# 0 - 299: no_threat/informational
# 300 - 699: suspicious
# 700 - 999: highly suspicious
# >= 1000: malicious

heuristics:
  - description: MetaDefender Sandbox determined that the file is benign.
    filetype: "*"
    heur_id: 1
    name: MetaDefender Sandbox verdict is benign.
    score: -1000
  - description: MetaDefender Sandbox signal group is benign.
    filetype: "*"
    heur_id: 2
    name: Benign threat indicators
    score: -1000
  - description: MetaDefender Sandbox determined that the file is no threat/informational.
    filetype: "*"
    heur_id: 3
    name: MetaDefender Sandbox verdict is no threat.
    score: 0
  - description: MetaDefender Sandbox signal group is no threat/informational.
    filetype: "*"
    heur_id: 4
    name: No threat indicators
    score: 0
  - description: MetaDefender Sandbox determined that the file is unknown.
    filetype: "*"
    heur_id: 5
    name: MetaDefender Sandbox verdict is unknown
    score: 299
  - description: MetaDefender Sandbox signal group is unknown.
    filetype: "*"
    heur_id: 6
    name: Unknown threat indicators
    score: 299
  - description: MetaDefender Sandbox determined that the file is suspicious.
    filetype: "*"
    heur_id: 7
    name: MetaDefender Sandbox verdict is suspicious
    score: 500
  - description: MetaDefender Sandbox signal group is suspicious.
    filetype: "*"
    heur_id: 8
    name: Suspicious threat indicators
    score: 500
  - description: MetaDefender Sandbox determined that the file is likely malicious.
    filetype: "*"
    heur_id: 9
    name: MetaDefender Sandbox verdict is likely malicious
    score: 850
  - description: MetaDefender Sandbox signal group is likely malicious.
    filetype: "*"
    heur_id: 10
    name: Likely malicious threat indicators
    score: 850
  - description: MetaDefender Sandbox determined that the file is malicious.
    filetype: "*"
    heur_id: 11
    name: MetaDefender Sandbox verdict is malicious
    score: 1000
  - description: MetaDefender Sandbox signal group is malicious.
    filetype: "*"
    heur_id: 12
    name: Malicious threat indicators
    score: 1000

# Docker configuration block which defines:
#  - the name of the docker container that will be created
#  - CPU and ram allocation by the container
docker_config:
  image: ${REGISTRY}opswat/assemblyline-service-metadefender-sandbox:$SERVICE_TAG
  cpu_cores: 1.0
  ram_mb: 1024
  allow_internet_access: true

config:
  api_key: ""
  host:  "https://www.filescan.io"
  poll_interval: 2
  timeout: 60

submission_params:
  - default: ""
    name: api_key
    type: str
    value: ""
  - default: 2
    name: poll_interval
    type: int
    value: 2
  - default: 60
    name: timeout
    type: int
    value: 60
  - default: ""
    name: description
    type: str
    value: ""
  - default: ""
    name: password
    type: str
    value: ""
  - default: ""
    name: is_private
    type: bool
    value: ""