Integrate RBI with OPSWAT

Table of Contents

Integrate with a Third-Party Content Disarm and Reconstruction Provider

Integrate RBI with OPSWAT

Integrate RBI with OPSWAT MetaDefender to sanitize files that users download during isolated browsing.

Where Can I Use This?	What Do I Need?
Prisma Access (Managed by Strata Cloud Manager)	Prisma Access 5.1 Innovation Prisma Access license with the Mobile User or Remote Networks license subscription Remote Browser Isolation license OPSWAT MetaDefender Cloud account with an API key OPSWAT rule that sanitizes files (content disarm and reconstruction)

Files that you download from websites during isolated browsing can carry malware, macros, or embedded scripts, and detection-only scanning can miss new threats. Integrate RBI with OPSWAT MetaDefender Cloud, a third-party content disarm and reconstruction (CDR) engine, to remove active content from downloaded files and still give you a usable file.

When you download a file in an isolated browsing session, RBI sends the file to OPSWAT before delivering it to the user's device. OPSWAT removes macros, scripts, and other active content, and RBI delivers the sanitized file that OPSWAT returns, with its original file name. While the file is scanned, you see a Scanning file notification that shows the progress.

You set up the OPSWAT connection once, and then you turn on malicious file protection in each isolation profile that should use OPSWAT. Because you enable it per isolation profile, you can apply CDR to the users, URL categories, or rules that use that profile.

Keep the following in mind when you use OPSWAT:

RBI sends only file downloads to OPSWAT. File uploads aren't sanitized.
When a user downloads a password-protected file or archive, RBI prompts the user for the password. The user has a maximum of five attempts to enter the correct password. RBI blocks downloads of archives that contain nested encrypted archives or password-protected files.
If the upload to OPSWAT or the download of the sanitized file fails with a temporary error, such as a timeout or a rate limit, RBI makes up to three attempts in total: the first attempt and two retries. If every attempt fails, RBI applies the fallback action that you configure in the isolation profile for scan unavailability. RBI doesn't retry files that are too large or are an unsupported file type. It applies the fallback for those conditions right away.
Each of the following conditions has its own fallback option in the isolation profile: scan unavailability, file size limit, and unsupported file type.
If Admin State is enabled in the Votiro settings, RBI sends all downloads in the session to Votiro. To use OPSWAT, disable the Votiro Admin State. When it's disabled, RBI uses the engine in the isolation profile that applies to each website. If that profile has Malicious File Protection disabled, RBI doesn't send downloads to any CDR engine.
RBI supports OPSWAT MetaDefender Cloud only.
OPSWAT removes files that it sanitizes after one hour.
RBI sends a MALWARE_SCAN event to Strata Logging Service when it blocks a download because OPSWAT found harmful content and can't provide a safe file, and when a scan can't complete because OPSWAT is unavailable, the file is too large, or the file type isn't supported. For a scan that can't complete, the action in the event (allow or deny) follows the fallback option in the isolation profile. Each event shows the file name, the URL of the page where the download started, the file size, and the reason for the block or the failure. To view the events, open Log Viewer.

Set up the integration with OPSWAT in Strata Cloud Manager.
1. In Strata Cloud Manager, select ConfigurationNGFW and Prisma AccessConfiguration ScopeGlobalSetup and select the Remote Browser Isolation settings.
2. On the Infrastructure tab, go to the Third-Party Engines section and click the settings icon.
  
  The Third-Party Engines page shows the configuration status of OPSWAT and Votiro.
3. If you are integrating OPSWAT with RBI for the first time, set up the OPSWAT integration. Otherwise, edit the OPSWAT integration settings.
4. Enter the Server URL of OPSWAT MetaDefender Cloud. This is the site to which RBI sends files for sanitization.
5. Enter the Server API Key that RBI uses to authenticate with OPSWAT. You can obtain the API key from your OPSWAT account.
6. Enter the Rule Name of the OPSWAT rule that RBI applies to downloaded files. cdr is the default CDR rule that OPSWAT provides. To use a custom rule, create it under the CDR workflow in the OPSWAT portal and enter its name here.
7. Click Save.
  
  The Third-Party Engines page shows OPSWAT as configured.
Turn on malicious file protection in an isolation profile.
1. On the Remote Browser Isolation page, select the Isolation Profiles tab.
2. Select an existing isolation profile to edit, or click Add Isolation Profile to create a new profile.
3. In the Security Control section, enable Malicious File Protection.
4. For Engine, choose OPSWAT.
  
  If the Votiro integration is enabled, Malicious File Protection in the isolation profile has no effect, because the Votiro integration takes precedence.
5. Choose how RBI handles downloads that OPSWAT can't scan. For each of the following conditions, select the option to block the download, or clear the option to allow the download without sanitization:
  In case of scan unavailability, action will be blocked—RBI can't reach OPSWAT or the scan doesn't complete.
  In case of scan error due to file size limitation, action will be blocked—The file is larger than OPSWAT can scan.
  In case of scan error due to unsupported file type, action will be blocked—OPSWAT doesn't support the file type.
6. Click Save.
  
  If an isolation profile is configured to block file downloads, that action overrides malicious file protection and blocks the file downloads before RBI sends the files to OPSWAT.
Push Config to Prisma Access.

Downloads in isolated sessions that use this isolation profile are now sanitized by OPSWAT.