MetaDefender Core Linux - Advanced Threat Protection

My main use case for MetaDefender is to scan files from chats on a day-to-day basis, because sometimes most of the people are sending something possibly malicious via web chats, and I need to be sure that everything that comes in and comes out of that chat is legitimate and won't affect our company's computer servers.

MetaDefender fits into my workflow for scanning files automatically. We have two MetaDefender Cores working together, and the scanning is working automatically, fast, and smoothly, while we can manually take some files from the quarantine if needed. Everything is automated with the API, so that is how we actually use it.

During my studies, I don't really trust files from the outside, even from my professors or the internet, so I constantly scan them in MetaDefender Core and I appreciate the results. I appreciate how fast it works, and it is easy to manage, implement, and work with.

MetaDefender has impacted my organization positively because we hear from our customers that everything works fine. I don't have a lot of support tickets about things being broken or working poorly and don't need to upgrade the whole system every week, so everything is great.

The outcomes from using MetaDefender Core include scanning metrics reaching a few milliseconds if you know how to configure it right. This year, I received a few tickets about configuration requests, but none regarding something being broken. Everything worked well and smoothly.

The best features MetaDefender offers in my experience include how easily it installs and the great GUI that I find excellent, even though I feel quite confused with the new version. I appreciate how everything connects smoothly, which allows my workflow to cover more directions in my company.

I find the new GUI confusing only because I am used to the previous one. While it is common to need time to adjust to a refreshed GUI, overall, the GUI is still one of the best I have ever seen. Connecting different modules is easy to do, just as installing on your Linux or Windows system and configuring it to work out of the box is straightforward.

I have a great impression of the detection rates provided by MetaScan multi-scanning. It is one of the best I have ever seen.

I assess the effectiveness of Deep CDR in reconstructing files safely and without signatures as a ten out of ten, as I really appreciate how it is done.

The file-based vulnerability assessment feature is useful for identifying potential security risks before deployment, as it helps to detect vulnerabilities at an early stage and reduces the risk of introducing vulnerable components into production environments.

We use the adaptive sandbox analysis, and I appreciate it because it operates on a separate server, MetaDefender IFR. I appreciate the GUI, the design, and the overall reports it generates.

We are using the enhanced reporting and audit visibility features because the reports are very colorful and everything we need is beautifully presented.

I assess the effectiveness of the solution in blocking or sanitizing content based on policy as a ten out of ten.

MetaDefender could be improved by enhancing the Central Management feature because sometimes when I need to make configurations inside MetaDefender Core, it is blocked, which necessitates accessing Central Management. I suggest allowing more settings to be adjustable directly in MetaDefender Core itself.

I have been using MetaDefender Core for a year now, and in addition to Core, I also use other solutions such as Email Gateway Security, MetaDefender IFR, and ICAP.

MetaDefender is one hundred percent stable.

MetaDefender's scalability is straightforward. You can scale by adding multiple MetaDefender Cores that work as a cluster, but you need an external load balancer for this purpose.

We used to use FortiSandbox, but we switched to MetaDefender because it is simply better.

I cannot share any relevant metrics about return on investment as we are not counting that information.

My experience with pricing, setup cost, and licensing has been excellent. When I ask for the price, it takes less than an hour to get all the information I need, and everything is fast.

Before choosing MetaDefender, I cannot really remember evaluating other options besides FortiSandbox and MetaDefender Core, but we ultimately chose MetaDefender Core because it was better.

I have not used MetaDefender's AI capabilities at all because this is a new feature, and both our customers and I have not utilized AI in MetaDefender.

I think the AI capabilities and accuracy of MetaDefender should be at the top based on my expectations, as the product overall is excellent.

My advice for others looking into using MetaDefender is to install it on either a Linux or Windows system, conduct your tests, explore, and you will see that MetaDefender Core is an excellent product.

I rate MetaDefender a ten out of ten.

The main use case for MetaDefender in the project with B****** is to ensure that files are scanned before sending them to the server, where I created a Java-based service that checks for viruses.

In the project with B******, my main use case for MetaDefender is to scan files that use Excel uploads and basic file uploads to prevent any virus infections, so I send the file bytes to MetaDefender APIs and check for viruses.

I do not know much about Deep CDR, as my integration is mostly for scanning viruses, and we just block files that are corrupted or harmful without reconstructing them.

MetaDefender has positively impacted B****** organization, as their security has increased significantly by scanning all the files in their environment before sending them to the servers.

I cannot share any specific outcomes or benefits that B****** has seen, as that is an internal organization matter.

In my experience, the best feature that MetaDefender offers is its perfect documentation, which is critical for API integrations to ensure files are not corrupted or infected with viruses.

I would add that for the dashboard, while I have used it, I am more fascinated about the API. It is good that we can manage users from one console, and I can see the history of uploads and whether the files are corrupted or not.

I think the detection rates provided by MetaDefender through multi-scanning are good, as it stops almost all of the virus files I have uploaded.

MetaDefender effectively blocks the harmful content based on our policies, as this is working perfectly fine for me, though I cannot share specific policies.

In my opinion, MetaDefender could improve its async version of their APIs, as the documentation is not that good for the async APIs and can be a bit complex to navigate for integrations.

Regarding needed improvements for MetaDefender, I think the dashboard could benefit from features that allow tracking IPs from where files are coming, which would enable blocking potential attackers.

I reported this issue, and while it is not directly MetaDefender's fault, it highlights a potential area where they could prevent misconfigurations.

I have been using MetaDefender for a project with an Indian client named B******, which is a big client, and they have requested us to integrate MetaDefender with their current flow.

I think MetaDefender works as expected without major issues, and I faced one, but it was due to the integration provider, OPSWAT.

There was an incident regarding the sending of hardcoded API keys, which caused me to receive unauthorized errors due to the overriding API key issue from OPSWAT.

In my experience, MetaDefender has been stable, as I have not noticed any downtime while my application uses it 24/7.

I do have concerns about scanning larger file sizes, like 400 MB, since we have set a maximum limit of 65 MB, and I would be worried if we were to increase this limit.

I have not had to reach out to MetaDefender for customer support.

I did not use a different solution before MetaDefender, as there was no prior solution.

I think my use case with MetaDefender fits into my workflow well, as it is quite easy to integrate, thanks to the thorough documentation, and we took about two or three days to integrate all of MetaDefender's APIs.

I have not seen a return on investment regarding time or money, but the implementation of MetaDefender provides an essential security layer that blocks potential threats.

Regarding pricing, setup cost, and licensing, I cannot provide specifics since it falls under B****** and OPSWAT's management, but from my perspective, the per API hit cost is a factor.

Before choosing MetaDefender, I did not evaluate other options, as it was a decision made by the higher management, and my role was to integrate it.

I would rate MetaDefender around seven to eight because I have used their file scan feature, though I have not fully explored all their capabilities. I would give it a seven or eight because I have not used all the functionalities provided, and I deduct a point for the async API documentation which could be better.

Regarding MetaDefender's AI capabilities, I believe they manage governance and security policies quite well, especially since B***** is a large and reputable firm.

MetaDefender is deployed on-premises in the organization, and there is also a trial version available on the cloud, but we are currently only using on-premises.

My advice to others looking into using MetaDefender is to read the documentation first before implementing anything. I would rate MetaDefender an eight out of ten overall.

Before accessing the company's protected resources, it is being scanned through MetaDefender Endpoint, which scans the local operating system and machine before the request actually hits the company's protected resources.

MetaDefender Endpoint has been installed in the Windows operating system machine, and before accessing any protected resource of the company, MetaDefender scans the request and the resources, and it even scans the local machine. If there is any vulnerability or any kind of malware, then it immediately blocks the resource and does not allow access to the protected resource for the company. In this case, it is the company's protected resource, so access is not allowed. It checks the software and checks the various software that is installed in the machine, and if all are acceptable, then only MetaDefender is allowed to access the protected resources.

For companies that are widely distributed and have resources with company employees widely located across the world, it provides a centralized, secure platform before accessing any protected resource. This is a mandatory software that everyone should install in their machine and ensure that it passes all the quality checks, making it a strong platform in terms of security and securing protected resources.

MetaDefender is fundamentally a security platform. All resources that are company proprietary resources are secured with MetaDefender Endpoint, and this is what was desired at the company level. It is mandatory for each and every resource in the company located across the globe to be scanned by MetaDefender Endpoint before accessing these protected resources.

All employees in the organization are keeping their machines up to date; all software is regularly upgraded. For example, browser versions or other software such as Notepad++ are being upgraded. They are also conducting full Windows scans, meaning they are doing complete security full scans on their machines on a monthly basis because this is set at the organization security policy where it is mandatory to scan the machine once a month. These security policies are implemented, and MetaDefender is valuing these policies and ensuring that all employees are aligning with the security policy.

MetaDefender checks all the software and its latest version, and whether the local software that is installed is aligned with the organization policy that is set by the organization security administrator. MetaDefender passes all this information and checks against those policies that are being set and determines whether the installed software is aligned with the organization policy or not. For example, if any deprecated software or any software that has any kind of malware is in the machine, then it immediately highlights and stops accessing those protected resources.

MetaDefender is always on at startup; it must be enabled during startup of the operating system, and when accessing any protected resource, after authorization and authentication, it immediately checks whether the resource being accessed is allowed for access, and it scans all the software. Whether it is a browser version such as Chrome browser, or if it is having a deprecated or older version, or any operating system software such as WinRAR or Notepad++, any software that is deprecated or has an older version, it will immediately flag that as an error and will not allow access to the protected resources.

This is quite helpful in terms of securing resources; it immediately brings those vulnerabilities or incompatibilities in the system to attention. It also provides the feature to check the status of the operating system or machine status immediately. There is an icon at the taskbar; clicking and rechecking the status of MetaDefender Endpoint shows the current status. If all are acceptable, then it will confirm that all is well, and access to the protected resources can proceed. If there is any issue, it will flag that on the screen when rechecking the status.

MetaDefender highlights all the vulnerabilities the moment of accessing the protected resources, so it scans all the files in the system and brings those issues when clicking the recheck button.

It does the auditing of the local machine and maintains awareness of what is occurring on the machine, specifically from the security perspective. If there is any vulnerability or any kind of malware being deployed in the machine, it immediately stops access to those protected resources.

If there is any major vulnerability, then it is understood that it should not allow access to the protected resource. However, if the vulnerabilities are not serious and are at the information or warning level, then MetaDefender should allow access to those protected resources. For example, if using an older Chrome browser version, it should not be a significant security issue. Similarly, older version Notepad++ represents low priority issues that MetaDefender could still allow employees to access the protected resources, but currently, MetaDefender treats these small issues as high priority.

MetaDefender will not automatically open the screen and display vulnerabilities unless the recheck button is clicked, which is something that could be improved. The moment the operating system or machine is opened, it should highlight any issues if there are vulnerabilities rather than waiting for the recheck button to be clicked.

The recheck button needs to be clicked every time. Additionally, low priority issues are taken very seriously and considered blockers. For example, outdated browser versions or any software in the machine that does not have the latest version could be considered low priority if the software is not critical.

The full scan takes considerable time; a complete Windows full scan takes almost 12 hours because it has billions of files. The full scan is time-consuming, and if MetaDefender could scan it more quickly and provide results faster, that would be an improvement.

Regarding improvements, low priority software that is highlighted as a blocker could be reworked to still allow the user to access the protected resources. Additionally, MetaDefender could introduce some kind of workflow or user interface which highlights all issues or vulnerabilities in one place rather than requiring clicking the recheck button and navigating through the browser.

This product has been in use for two years.

MetaDefender is stable, but it brings or highlights items which are low priority, and software upgrades need to occur very frequently because it checks all the minute details in the operating system and system and brings them forward, necessitating software upgrades.

MetaDefender handles the scale well. There are quite a lot of employees, more than 50,000 employees, and all are using it, making it a quite scalable platform.

Customer service has not been contacted yet because it is a quite stable environment and a stable platform. MetaDefender highlights all the issues and even guides how to resolve vulnerabilities, for example, by installing upgraded software or conducting a full scan. It is quite comprehensive in explaining the issues that are currently encountered.

MetaDefender Endpoint has provided benefit from its use. The company's resources are fully protected and secured; no unauthorized access can reach the protected resources. All resources are now secured, and MetaDefender Endpoint can be trusted in this area.

The setup and pricing are managed at the organization level, and the security department or the infrastructure department would have better knowledge of costing and pricing.

Previously, the authentication and authorization method was using Azure Active Directory, or Azure Entra ID, and now MetaDefender is also used along with Azure AD.

From the security perspective, I would rate it an eight. MetaDefender is on-premises and managed by the company's platform. For any company where resources are widely located across the globe, MetaDefender Endpoint should be considered as one of the security platforms that ensure all protected resources are very much secure.

My main use case for MetaDefender is for security purposes, as we are a cybersecurity team, and currently we are using it for purposes such as antivirus scanning and other security measures.

In my day-to-day work, we are working with a company called Opswat, and we have devices, so to keep everything clean and clear, we are using MetaDefender as an antivirus firewall. We are inserting this MetaDefender chip for scanning purposes and using it as a firewall as well, but I do not have much knowledge about it because I am in a non-technical role right now.

In terms of using MetaDefender, we are utilizing it for threat detection, multi-scanning, and enterprise security.

MetaDefender has impacted my organization positively by adding an extra layer of security to our file and content handling process, and through its CDR, it ensures that files are sanitized before they reach our environment, which has improved our security posture.

I have noticed that the confidence and security of file processing have improved, with multi-engine scanning providing threat detection, and the security checks help us identify malicious files before they enter our environment, although I have not yet observed a specific, quantified business impact.

In my experience, MetaDefender offers a Deep CDR, and other major strengths include multi-scanning, Tri-tech AI, Adaptive Sandbox, Proactive DLP, and file vulnerability assessment.

Out of those features, I find myself relying on Deep CDR the most because it is one of MetaDefender's key differentiators; it does not depend only on detecting known malware but sanitizes and reconstructs files to prevent potentially malicious content, including zero-day threats, from reaching the environment.

Regarding MetaDefender's AI features, I think it handles data responsibly and keeps things secure by providing protection in multiple layers through malware scanning, threat detection, and content sanitization, which helps organizations manage security risks while maintaining a good balance between security, control, and compliance.

I find MetaDefender's AI capabilities to be reliable and useful as an additional layer of threat detection, with results that have been generally consistent and provide useful insights when analyzing files, though I have not used the AI capabilities long enough to independently measure accuracy.

My impression of the detection rates from MetaDefender's Metascan Multi-scanning has been positive; using multiple scanning engines provides broader coverage and greater confidence that potential threats will not be missed, and while I have not independently measured the detection rate, the results I have seen are consistent and useful for identifying potential malicious files.

I assess Deep CDR as highly effective in reconstructing files safely and without signatures because it focuses on safely reconstructing files rather than relying only on traditional malware signatures, which is particularly valuable for handling unknown or potentially zero-day threats while keeping reconstructed files usable.

I think the file-based vulnerability assessment feature is valuable because it helps identify potential vulnerabilities before files or applications are deployed, providing an additional preventive security layer that helps organizations address risk earlier rather than discovering them post-deployment.

We are using the reporting and audit visibility features to gain better visibility into scanning activities and results, which help provide a clearer record of what has been scanned and the outcomes, aiding in tracking and audit purposes from an operational perspective.

One area where MetaDefender could improve is by making the user experience more intuitive, especially for new users, with clear guidance, simpler navigation, and a more detailed explanation of scan results and outcomes, which would enhance the effectiveness for users, while better onboarding and learning resources would help users get familiar with the different features more quickly.

The usability and onboarding are my main concerns, as I do not have much overview on the technical aspects.

I have been using MetaDefender for two to three months.

MetaDefender offers strong security capabilities and multiple layers of threat detection, but since I am still relatively new to this platform, I would explore more of its features before giving it a higher rating. Even though MetaDefender provides a strong, multilayered security and is quite useful and comprehensive, the user experience on onboarding and the clarity of scan results could be simpler, especially for new users.

My advice to organizations looking into using MetaDefender is to seek an additional layer of security around file and content handling, as it is a great choice with multi-engine scanning, CDR, and vulnerability assessment capabilities providing good overall coverage. It is important to clearly understand your organization's security requirements and take time to explore the different features and integrations to get the most value from the platform.

I would rate MetaDefender as an eight out of ten.