Understanding-and-using-the-file-output

User Objective

The objective is to use the CDR Platform to process a file, ensuring that any potentially malicious content is removed or neutralised. The ultimate goal is to produce a sanitised version of the file, making it safe to be opened and accessed by other users or information systems without any security risks.

Why?

Content Disarm and Reconstruction (CDR) is a security measure taken to protect against potential threats and cyber-attacks that may be embedded in files, particularly in documents, images, and other attachments. There are several reasons why you would want to use CDR to sanitise files before allowing other users or information systems to access them:

Malware Protection

Files received from external sources, such as emails or file downloads, can contain hidden malware, viruses, or other malicious code. CDR helps ensure that any potential threats are neutralised, preventing malware infections and data breaches.

Phishing Prevention

Some files may include hidden phishing links or malicious scripts, aiming to steal sensitive information or login credentials. CDR removes such dangerous elements, mitigating the risk of falling victim to phishing attacks.

Compliance and Regulation

Many industries and organisations have strict data protection regulations they must adhere to. By implementing CDR, businesses can demonstrate their commitment to security and compliance with data protection standards.

Zero-Day Threat Mitigation

CDR can be effective against new, previously unknown threats (zero-day threats) because it focuses on the file's structure and content rather than relying solely on signature-based detection.

Safe Collaboration

By using CDR, organisations can safely share files internally and externally, promoting efficient collaboration while maintaining security.

System Integrity

Opening a malicious file can harm not only the user's device but also the entire IT system. CDR helps preserve the integrity of the system by preventing the spread of malware.

Overall, employing CDR as part of a comprehensive cybersecurity strategy helps reduce the attack surface and enhances the overall safety and trustworthiness of the shared files, making it safer for users and information systems to interact with the data.

API Documentation

To enhance your personal and organisational security against potential attacks, the CDR Platform can be a valuable tool. By utilising the CDR Platform, you can safely process files and ensure they are free from hidden threats and malicious content. You can use the following API's to create a sanitised file:

POST api/v3/cdr-file
POST api/v3/cdr

For more information on our API's please visit our API documentation

API Authentication

To understand how to authenticate with the CDR Platform please see here

CDR Platform Flow of Events

Upon making a request to the CDR Platform the following will happen:

1. You send a file to the REST API for processing.
2. The file is stored in the CDR Platform whilst processing occurs.
3. The Glasswall Embedded Engine is notified to process the file.
4. The Glasswall Embedded Engine retrieves the file and begins its CDR process.
5. The clean file is then returned back to the user via the API response

Request Construction

The CDR Platform provides a wide range of file processing capabilities, accommodating both binary and base64 encoded files. Additionally, you have the option to leverage policies to guide the file processing according to your needs. For a comprehensive understanding and practical implementation of the policy management feature, consult the Understanding and Using Policy documentation.

When utilising the CDR Platform, you can submit files in either binary or base64 format, offering the flexibility to choose the most appropriate file representation for your specific use case and application requirements. Moreover, if you solely require a clean file without the analysis report, you can make this specific request using the response-content query parameter with the value set to noAnalysisReport.

This versatile functionality of the CDR Platform empowers you to tailor the file processing process precisely to your preferences and efficiently achieve your objectives with ease.

Binary File Processing

POST {baseUrl}/api/v3/cdr-file?response-content=noAnalysisReport 

Base64 Encoded File Processing

Submit the base64 encoded string in the request body to the following endpoint:

POST {baseUrl}/api/v3/cdr?response-content=noAnalysisReport 

Request Body Format

The body of the request should be in JSON format and include the base64 field containing the base64 encoded string of the file, and the fileName field specifying the original filename (including the appropriate file extension).

{
  "base64": "string",
  "fileName": "filename.pdf",
}

Variations

A variation of this request is to not pass in the response-content query param. This means that you will get both the rebuilt file and the analysis report back for the file you requested.

Binary File Processing

POST {baseUrl}/api/v3/cdr-file

Base64 Encoded File Processing

Submit the base64 encoded string in the request body to the following endpoint:

POST {baseUrl}/api/v3/cdr

Note:

• Replace {baseUrl} with the actual base URL of the Glasswall CDR Platform API.
• Correct auth header should be provided with each request
• For binary file processing, use a multipart form post, while for base64 encoded file processing, provide the file content in the JSON request body with the appropriate filename.

Response Handling

When a file is successfully processed by the CDR Platform, you will receive a 201 HTTP status code, indicating that a new file has been created, and this file is returned in the response. The format of the response depends on whether you used the binary or base64 endpoint.

For the binary endpoint, the file will be returned with the content type application/octet-stream. You can read all the bytes from the response body, forming the CDR'd file. The response will also include the content-disposition header, which contains the filename supplied in the multipart form, if available. If the filename was not provided, a generated GUID will be returned as the filename. This feature eliminates the need for you to maintain the filename while processing occurs.

If you requested a base64 encoded file to be processed, the response will be in JSON format with a status code of 201. The JSON body will contain the base64 encoded string representing the clean file produced by the CDR Platform. The response will look like this:

{
  "errorReason": null,
  "processingId": "d3bdc536-44ba-41ad-b40e-330ce6f169ce",
  "processingStatus": "rebuilt",
  "fileType": "jpg",
  "analysisReport": null,
  "rebuiltFile": {
    "content": "/9j/2wBDAAMCAgM...",
    "contentType": "application/octet-stream",
    "contentEncoding": "base64"
  }
}

To access the base64 encoded clean file, you can retrieve it from the rebuiltFile.content location within the response.

Variations

If you omit the response-content query parameter and utilize the default settings, both the clean file and the analysis report will be generated and included in the response.

In the context of the binary endpoint, the response format will be a compressed .zip file. Upon extracting this file, you will discover two subfolders: clean and report. The clean folder will house the clean file, which you can freely utilize according to your needs. Similarly, the report folder will contain the analysis report. For detailed instructions on utilising the analysis report, please refer to this resource.

If you requested a base64 encoded file to be processed, the response will be in JSON format with a status code of 201. The JSON body will contain the base64 encoded string representing the clean file produced by the CDR Platform. The response will look like this:

{
  "errorReason": null,
  "processingId": "de30c22d-fcef-467c-9ed9-16296318615b",
  "processingStatus": "rebuilt",
  "fileType": "archive",
  "analysisReport": { 
    "content": "UEsDBBQAAAgIACU/EFeWuyNVWwAAAL0AAAARAAAAbWFua...",
    "contentType": "application/octet-stream",
    "contentEncoding": "base64"
  }
  "rebuiltFile": {
    "content": "/9j/2wBDAAMCAgM...",
    "contentType": "application/octet-stream",
    "contentEncoding": "base64"
  }
}

To access the base64 encoded clean archives, you can retrieve it from the rebuiltFile.content location within the response, if you wish to gain access to the analysis files they can be found at analysisReport.content.

Objective Achievement

• You have successfully protected your organisation against potential malware threats by utilising the CDR Platform to sanitise files before sharing or processing them.

• You have prevented phishing attacks and safeguarded your users by neutralising hidden malicious scripts and phishing links in files processed through the CDR Platform.

• You have ensured compliance with data protection regulations by securely handling files and eliminating sensitive information through the CDR Platform.

• You have proactively mitigated zero-day threats by using the CDR Platform, which focuses on file structure rather than relying on known signatures.

• You have established a secure and trusted file-sharing environment, both internally and externally, by leveraging the CDR Platform capabilities.

• You have maintained the integrity of your information systems by preventing malware propagation through CDR-processed files.

• You have demonstrated a commitment to cybersecurity, building trust among clients, partners, and stakeholders through the secure file-handling practices achieved with the CDR Platform.

• You have streamlined your file processing workflows and reduced manual intervention by automating the process through the CDR Platform API integration.

• You have efficiently responded to potential security incidents by incorporating CDR as an additional layer of defence in your incident response plan.

• You have minimised downtime and reduced remediation costs by preventing malware infections through the CDR Platform.

• You have protected your organisation against supply chain attacks by sanitising files received from external sources using the CDR Platform

Overall, through CDR, you have significantly enhanced your organisation's cybersecurity posture, ensuring the safety of sensitive data and mitigating file-based threats effectively.

Quick Start

If you wish to take a look for yourself you can follow our quick start guide and use the CDR Platform yourself.