service_manifest.yml

name: MetaDefender
version: $SERVICE_TAG
description: This Assemblyline service interfaces with the [MetaDefender Core](https://www.opswat.com/metadefender-core) multi-scanning AV engine.

# Regex defining the types of files the service accepts and rejects
accepts: .*
rejects: empty|metadata/.*

# At which stage the service should run (one of FILTER, EXTRACT, CORE, SECONDARY, POST, REVIEW)
# NOTE: Stages are executed in the order defined in the list
stage: CORE
# Which category the service is part of (one of Antivirus, Dynamic Analysis, External, Extraction, Filtering, Internet Connected, Networking, Static Analysis)
category: Antivirus

# Does the service require access to the file to perform its task
# If set to false, the service will only have access to the file metadata (e.g. Hashes, size, type, ...)
file_required: true
# Maximum execution time the service has before it's considered to be timed out
timeout: 60

# is the service enabled by default
enabled: false

config:
  api_key: ""
  base_url: 'http://localhost:8008/'
  verify_certificate: true
  md_version: 4
  md_timeout: 40
  min_node_time: 60
  max_node_time: 300
  max_md_scan_time: 5
  av_config:
    # AV Blocklist (ignore results)
    blocklist:
      - "Antiy-AVL"
      - "APEX"
      - "Jiangmin"
    # Specific keywords found in a signature name
    kw_score_revision_map:
      adware: 100
    # Signature names are not valid YAML keys according to the Assemblyline
    # ODM so we cannot use them in the heuristic signature_score_map. Hence why we're putting this here.
    sig_score_revision_map:
      TACHYON.Suspicious/XOX.Obfus.Gen.2: 100
      # Note the following should be added to the system-level safelist since their revised scores are 0
#      Ikarus.Trojan-Downloader.MSWord.Agent: 0
#      Ikarus.Trojan-Downloader.VBA.Agent: 0
#      NANOAV.Exploit.Xml.CVE-2017-0199.equmby: 0
#      TACHYON.Suspicious/XOX.Obfus.Gen.3: 0
#      Vir.IT eXplorer.Office.VBA_Macro_Heur: 0
#      Vir.IT eXplorer.W97M/Downloader.AB: 0

heuristics:
  - heur_id: 1
    name: File is infected
    score: 1000
    filetype: '*'
    description: MetaDefender Antivirus hit.

  - heur_id: 2
    name: File is suspicious
    score: 500
    filetype: '*'
    description: MetaDefender Antivirus hit.

docker_config:
  allow_internet_access: true
  image: ${REGISTRY}cccs/assemblyline-service-metadefender:$SERVICE_TAG
  cpu_cores: 0.25