Purpose
This guide explains how to configure the OPSWAT MetaDefender Response integration in Logsign USO, so that an analyst (or an action rule) can look up IP/URL/domain reputation, retrieve multi-engine scan reports by file hash or data ID, submit a previously-scanned file to sandbox detonation, and upload a file for scanning directly from a Logsign Incident. This is primarily a query/scan integration; the sandbox submission methods are the closest thing to an active action, but nothing here performs network-level containment.
Prerequisites
- An OPSWAT MetaDefender Cloud account (or an on-premises MetaDefender Core instance exposing the same API surface) with an API key.
Step 1: Obtain Your MetaDefender API Key
- Log in to your OPSWAT MetaDefender account (or console, for an on-premises deployment).
- Open your account/API settings and copy your API key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for MetaDefender, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this MetaDefender device in Logsign. |
| Api Key | Yes | Your MetaDefender API key from Step 1. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- ip_reputation — IP reputation lookup. Arg: ip (required).
- url_reputation — URL reputation lookup. Arg: url (required).
- domain_reputation — domain reputation lookup. Arg: domain (required).
- scan_reports_by_data_hash — gets a multi-engine scan report by file hash. Arg: data_hash (required). Polls asynchronously until the report is ready.
- scan_reports_by_data_id — gets a scan report by MetaDefender data ID. Arg: data_id (required).
- scan_with_sandbox — submits a previously-scanned file (by data ID) for sandbox detonation. Args: data_id, sandbox (one of: windows7, windows10) — both required.
- sandbox_lookup — retrieves a sandbox analysis result. Arg: sandbox_id (required).
- scan_file — uploads and scans a file. Arg: file_path (required).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong or revoked Api Key. | Re-enter the Api Key exactly as issued in your MetaDefender account. |
| 429 Too Many Requests | MetaDefender enforces rate limits based on your subscription tier. | Reduce the frequency of automated lookups/scans, or check your plan's rate limit. |
| scan_reports_by_data_hash returns "not found" | The file has never been scanned by MetaDefender before (hash lookups only find pre-existing scans). | Use scan_file to upload and scan the file directly if you need a fresh result. |
Notes and Limits
- None of these methods perform network- or endpoint-level containment; they scan/query files and reputation data only. Pair with a separate containment-capable response integration if you need to act on the results.