MetaDefender Core Linux (BYOL AMI)

My main use case for MetaDefender is on my devices. I have a specific example of how I use MetaDefender on my devices in that it has been installed by the administrator on my VMs which are being listed on my public cloud.

I don't have anything specific to add about how I use MetaDefender in my setup, as it is protecting my whole VMs, so not any particular file.

The best features MetaDefender offers, in my opinion, are that it adapts the policies on the go, and that is the best feature.

When I say it adapts policies on the go, it has the ability that if there is a new policy or the new configuration that has come up without any downtime, it just adjusts it and reiterates to all of the users and all of the devices. MetaDefender has positively impacted my organization as it has reduced time for the users.

MetaDefender reduces time for users in their working, as it does not occupy the RAM usage of their devices plus it does not take time for the downtime or shutting down or the rebooting of the devices.

I have not seen any areas where I can suggest improvements for MetaDefender, so probably it is good enough. I would rate it an eight because its interface can be improved and it can improve their integrations as well, so there is room for improvement.

I have been working in my current field for four and a half years. I have been using MetaDefender for the past six months.

MetaDefender is stable.

MetaDefender's scalability is pretty much scalable.

The customer support is good.

I previously used a different solution, Palo Alto, which I switched from because it was very expensive.

I have seen a return on investment as fewer employees are needed in terms of implementation.

My experience with pricing, setup cost, and licensing is that it is good and at par with other competitors.

Before choosing MetaDefender, I evaluated other options, including Palo Alto and Check Point, as many were evaluated.

My impression of the detection rates provided by MetaScan Multi-scanning is that it is good and pretty accurate. I would assess the effectiveness of Deep CDR in reconstructing files safely and without signatures as they are pretty much effective, and it is really useful for the administrator.

My thoughts on the file-based vulnerability assessment feature in identifying vulnerabilities before deployment are that it is good, and it is a very good feature. I use adaptive sandbox analysis, and its impact on analyzing suspicious files is very great because it detects pretty much early.

I am using the enhanced reporting and audit visibility features, and they have helped meet our audit requirements as it has given us a great requirement study and plus it has also helped in ISO audit requirement as well. I would assess the effectiveness of the solution in blocking or sanitizing content based on policy as good and pretty much effective.

My advice to others looking into using MetaDefender is that if you are looking ahead at a solution which can be implemented quickly and at a lesser cost, go ahead with it. I would rate this product an eight overall.

The major use cases of MetaDefender in my work environment involve preventing malware updates, data breaches, and compliance violations through scanning files for malware, vulnerabilities, and sensitive data at the network perimeter.

The best features of MetaDefender include its ability to detect malware and vulnerabilities, which I also use at server levels, including production and testing servers, helping me identify and address vulnerabilities by applying patch updates.

When sanitizing files based on policies, MetaDefender processes and sanitizes files to remove hidden content, including embedded objects and scripts while preserving the visible content.

I use MetaDefender Archive Extractor, which supports over 30 archive file types, improving detection and preventing archive bombs, allowing administrators to perform archive handling once for each file type.

I would like to see improvements in the tool's automation capabilities. It would be beneficial if it could automatically create tickets and notify responsible teams about any identified vulnerabilities rather than relying on a manual process.

I want to see enhancements allowing for automatic ticket creation using APIs to streamline the workflow and assign tickets to respective teams.

I have been using MetaDefender for the last two years on my official laptop.

I do not have any stability issues with MetaDefender.

MetaDefender is scalable; it allows for automation in scaling resources as needed during peak times.

I would rate technical support as a nine out of ten.

I have evaluated other options available in the market, such as Microsoft and McAfee, but found MetaDefender to be distinct.

I decided to go with MetaDefender due to its architectural compatibility with the client's budget requirements, as its scanning and vulnerability detection capabilities are better than other tools.

For me, onboarding MetaDefender was not too difficult, being balanced between straightforward and complex.

I have seen measurable benefits, as MetaDefender saves time, preventing the need for manual processes associated with other tools.

The detection rates from MetaScan multi-scanning are managed mainly by other teams in alignment with our organization policy, where they can achieve detection rates of 81-87% with four engines or 95% with sixteen engines, and the comparison with Microsoft Defender often yields similar results.

I do not have an opinion on the effectiveness of Deep CDR in file reconstruction.

We have a process in place for identifying vulnerabilities before deployment where team members raise tickets on the ServiceNow portal for the respective teams to address.

I do not use Adaptive Sandbox analysis, as that is managed by another team.

I do not notice improvements in workflow automation as recent enhancements are managed by other teams; I am focused on using the tool to identify vulnerabilities.

I do not have an assessment of how multi-scanning and content disarm and reconstruction affect our data security operations.

I recommend implementing MetaDefender for its impressive features that maintain the health of the system. My overall review rating for MetaDefender is nine out of ten.

I am an integrator for MetaDefender. My usual use cases for MetaDefender involve connecting the products into the environment of the customer, including MetaDefender Core, ICAPs, endpoints, and all the related components.

I find the CDR, specifically the CDR ability, the most valuable aspect of MetaDefender so far. I appreciate the CDR because I can show customers how it works and demonstrate the effectiveness of this feature, and it is very helpful.

I did not pay much attention to the expanded file type and archive coverage feature initially. Could you explain what you mean by file type?

The enhanced reporting and audit visibility features are acceptable. Some customers of mine had problems with the health checks and monitoring of the logs, but it has improved, so that is very positive.

Most of the time, in our experience at Danet Communications, we work with government offices, and they need the CDR. However, because CDR is affecting files such as MSI and EXE files, they are always creating new passes of scanning. This is acceptable, but I would like OPSWAT to improve that, perhaps to decrease the impact when the process becomes slower. I am not sure if that is something that is possible.

There is something about MetaDefender that I think could be improved or enhanced, specifically regarding a feature request. Something that annoyed me was the less noticeable improvement from version 5.8.0 to 5.9.0 of MetaDefender Core. Now you have to search in the block if you want to create a blocklist, which is somewhat annoying when searching for your file. I may have just been accustomed to the old version.

From my experience, there are perhaps some improvements in workflow automation with the recent enhancements to policy orchestration and engine parallelization. However, there are many settings in the workflow that you cannot quickly understand what they are doing. Adding a question mark around them that provides a bit more information about that option would be beneficial.

I have been working with MetaDefender for approximately six to seven months.

Regarding the reliability and stability level of MetaDefender, there are minor problems here and there, but nothing specific. Every time when help is needed, we receive the assistance.

When I say there are some troubles here and there, I mean there are different and unusual bugs or complications and things that cannot be connected to each other even though all the network configuration is acceptable.

The scalability level of MetaDefender is good. It is learning and increasing with every patch, and that is acceptable.

When I need help, I reach out first by trying to find information in the documentation. If I cannot find that, I go to the Ozi AI. If I see that the AI cannot help me, then I ask for an agent.

When it comes to my communication with agents, I find they are responsive and professional. A lot of the time, they are busy, so they cannot participate in calls or Teams meetings. However, if we schedule a meeting, they will attend, especially if it is very important.

I usually participate in the initial setup, including the installation of MetaDefender. Most of the time, I send requirements for the server, and the customer has to create a server that meets what I have requested. After the customer has made the prerequisites, I can work with them on installing and connecting the products into their environment.

The initial setup usually looks like this for me: first, I need to send the prerequisites for every product, and I reference OPSWAT documentation to see what is needed, such as Visual Studio or Desknet. Then I send downloads of the products.

I usually find the initial setup has small challenges such as connectivity issues, but these are not on OPSWAT's side. They are more related to the customer's environment.

I assess the effectiveness of MetaDefender in blocking or sanitizing content based on policy as very good. It contains a lot of file types, and most of the file types are included, so that is acceptable.

My impression of the detection rate provided by MetaScan multi-scanning is positive. I work mostly with the core, and my clients have not encountered false positives or those kinds of issues.

I evaluate the effectiveness of Deep CDR in reconstructing files safely and without signatures as good. I measure if it is effective by processing a lot of files, verifying that the content I want to be removed is being removed, and confirming that the hash is different.

To be honest, the file-based vulnerability assessment feature is more of a toggle option that we always enable, but we have not thoroughly tested it. I do see the effectiveness of this feature.

I think the adaptive sandbox analysis of MetaDefender works well. We do not have many customers using it, but from the customers who are using it, it functions effectively. Some of my customers describe its impact on analyzing suspicious files as adding additional layers of security. The reviews were positive, and while it may slow the scanning time slightly, that is understandable.

I rate this review an eight out of ten overall.

I have used MetaDefender for various use cases on my PCs at home and also enrolled it on some of my virtualized devices in my virtualized lab, which runs on Linux and Windows. I tried it on Windows 11, Windows 10, Ubuntu, and Kali Linux, and I enrolled the devices after trying quite a few use cases.

I blocked USB access on all the Windows machines, and it successfully blocked it, so I cannot use USB devices on these machines. I also utilize MetaDefender for patching my Windows devices, as it picks up outdated software and often identifies vulnerable third-party programs. Sometimes I need to patch the software or uninstall older versions before installing the new ones. I also use it for Windows updates, as it flags when my Windows updates and OneDrive application need to be updated. Additionally, it checks my browser extensions for status and compliance.

For malware protection, I am using McAfee, but if it has not scanned for some time, MetaDefender flags that too. I need to fine-tune my policy because it identifies McAfee, Windows Defender, and Microsoft Teams as unapproved products, so I will look into that. I have configured a policy, but since I am using a free version, I could not use DLP, and some intensive endpoint management functionalities are limited. It performs many tasks, including patching my devices, tracking critical issues, third-party vulnerabilities, and showing device locations on a graph. In brief, I am using it mostly for endpoint security.

I did not manage to enroll my IoT devices, including my child's device running on iOS and some Amazon products. I could not enroll my Fire Stick or monitor certain network devices. I initially thought I could enroll all those devices, including some children's IoT devices, but there seem to be limitations with Linux endpoint management as well. I hoped MetaDefender could help with parental controls for my Amazon Kids products.

I have not contacted technical support, though I thought I might need assistance fine-tuning my policy. When MetaDefender flagged some Windows DLL files as infections, I looked up information online and needed to whitelist them if they run directly from the Windows folder. If I could not resolve that, I would reach out for support, but I have not raised any tickets with MetaDefender yet.

MetaDefender is flexible because, for a free product, you can enroll up to 50 devices, and I have only used about eight devices so far. This flexibility allows you to explore its features before committing to a contract with MetaDefender, unlike other products that provide trial versions for a limited time.

I appreciate that you can use MetaDefender for various tasks, including patching, monitoring, vulnerability assessment, and compliance checking for up to 50 devices on the free license.

On the free version, I can only monitor device compliance, which includes the total enrolled devices and my compliance dashboard showing critical issues and warnings. It compiles data by desktops, laptops, virtual machines, servers, and mobile devices, including my enrolled Windows, Android, and one iOS device. The reports show compliant and non-compliant devices, allowing me to fine-tune my policies and group my devices for different policy applications.

There is no maintenance required on my end because the application on my endpoint automatically patches itself. When there is a new update, it handles the patching and alerts me when I am running the latest version. However, a feature I wish MetaDefender had is the ability to patch my devices centrally from my dashboard, including scheduling patches during off-peak times. I cannot provide a full review since I am using the free version, but based on my experiences, I would recommend MetaDefender to peers and companies using Windows endpoints.

I am not using the Expanded File Type and Archive Coverage feature, as it is not part of the free version. I was wondering if I could enroll more devices and replace McAfee with MetaDefender if it can serve as antivirus as well.

The initial deployment is straightforward, as there is an enroll link on the portal. Clicking that gives me options to enroll in MetaDefender Core, Endpoint, or Industrial File. I receive a QR code, and for devices like phones, scanning it enrolls them automatically. For Windows devices, it provides links to download the EML or EXE files, enabling easy Active Directory use. This straightforward enrollment process applies to Linux and macOS as well. However, for IoT devices, it is not so straightforward since it requires building the application from a downloaded file and running it, especially for Linux-based IoTs.

I have been working with the solution for more than eight months.

MetaDefender does not crash and runs well without conflicts with other Windows or Linux applications, indicating that the developers have optimized its performance very well.

I have only enrolled about eight devices, and I cannot comment on scalability for corporate networks with more than 500 endpoints since I have not tested it with larger numbers. I could consider testing on a licensed version to push patches automatically from the portal to assess its full capabilities. I would appreciate a trial period of one or two weeks for better testing of the full version features.

I have not contacted technical support, though I thought I might need assistance fine-tuning my policy. When MetaDefender flagged some Windows DLL files as infections, I looked up information online and needed to whitelist them if they run directly from the Windows folder. If I could not resolve that, I would reach out for support, but I have not raised any tickets with MetaDefender yet.

I have previously used other endpoint products like Fortinet's FortiEDR, but only in a virtualized environment. I could do similar use cases with that one as well.

The initial deployment is straightforward, as there is an enroll link on the portal. Clicking that gives me options to enroll in MetaDefender Core, Endpoint, or Industrial File. I receive a QR code, and for devices like phones, scanning it enrolls them automatically. For Windows devices, it provides links to download the EML or EXE files, enabling easy Active Directory use. This straightforward enrollment process applies to Linux and macOS as well. However, for IoT devices, it is not so straightforward since it requires building the application from a downloaded file and running it, especially for Linux-based IoTs.

I have previously used other endpoint products like Fortinet's FortiEDR, but only in a virtualized environment. I could do similar use cases with that one as well.

I am not using the Expanded File Type and Archive Coverage feature, as it is not part of the free version. I was wondering if I could enroll more devices and replace McAfee with MetaDefender if it can serve as antivirus as well.

On the free version, I can only monitor device compliance, which includes the total enrolled devices and my compliance dashboard showing critical issues and warnings. It compiles data by desktops, laptops, virtual machines, servers, and mobile devices, including my enrolled Windows, Android, and one iOS device. The reports show compliant and non-compliant devices, allowing me to fine-tune my policies and group my devices for different policy applications.

I would rate this product an 8 out of 10.