DOCSEARCHbyAlgolia
Submit Docs

Glasswall Documentation

website·Indexed 34 days ago

https://docs.glasswall.com

Documentation for Glasswall CDR (Content Disarm and Reconstruction) technology, featuring the Glasswall Halo and Genesis platforms. It covers the four-step CDR process (inspection, rebuilding, cleaning, and delivery), supported file formats including NITF and NSIF, archive processing, and detailed installation guides for Managed Kubernetes and Oracle Kubernetes Engine (OKE). Includes technical specifications for the Synchronous and Asynchronous APIs, Policy Management API, and integration with ReversingLabs.

Tokens
184.4K
Snippets
621
Records
1.3K
Agent score
62%

What's inside Glasswall

  1. Overview of Glasswall Content Disarm and Reconstruction (CDR)

    Glasswall CDR (Content Disarm and Reconstruction) is a security technology designed to protect against zero-day threats by removing potential threats from unknown files in less than a second without compromising the file's contents. Unlike antivirus or sandboxing, which rely on detection, CDR works by:

    1. Inspecting a file's digital DNA.
    2. Cleaning risky content based on a set policy.
    3. Rebuilding the file to a 'known good' standard.
    4. Delivering a safe and visually identical file.

  2. Overview of Glasswall Embedded Engine CDR capabilities

    The Glasswall Embedded Engine provides Zero Trust file protection using Content Disarm and Reconstruction (CDR). Instead of searching for malicious content, it treats all files as untrusted and validates, rebuilds, and cleans them against the manufacturer's 'known-good' specification. The engine is delivered via an SDK and API, allowing organizations to integrate CDR into applications and apply user-configurable security preferences based on their risk appetite.

    Key capabilities include:

    • Validating, cleaning (sanitizing and remediating), and reconstructing files.
    • Generating XML reports with deep file analysis.
    • Managing files through a configurable content management policy.
    • Performing reliable file type identification.
    • Searching and redacting text within MS Office file types.
    • Creating and manipulating a document object model (DOM) for supported file types.

  4. Overview of Glasswall Synchronous API capabilities

    The Glasswall Synchronous API provides Content Disarm and Reconstruction (CDR) technology to analyze and sanitize files. Key capabilities include:

    • Complete File Analysis: Detects non-conformance with industry specifications for full transparency.
    • True File Type Detection: Identifies file types based on actual content, ignoring misleading file extensions or magic numbers.
    • File Protection: Removes threats and restores files to known-good specifications.
    • Policy Customization: Offers content management options to align with an organization's specific security risk appetite.

  5. Overview of Glasswall Halo Content Disarm and Reconstruction (CDR)

    Glasswall Halo uses Content Disarm and Reconstruction (CDR) technology to process files by removing or neutralizing potentially malicious content. The system cleans and rebuilds files to match 'known good' industry specifications, producing a sanitized version of the file that is safe for users and information systems to access without security risks.

  7. Overview of Glasswall Halo Portal capabilities

    The Halo portal is the centralized management interface for Glasswall’s Content Disarm and Reconstruction (CDR) technology. It provides tools for monitoring file processing and threat detection via reporting, customizing granular protection policies, and managing ICAP integration, XML validation, and API configurations.

  8. Overview of Glasswall Halo ICAP Integration

    Glasswall Halo uses the Internet Content Adaptation Protocol (ICAP) to offload virus scanning and content filtering. It acts as an intermediary between ICAP clients (proxy servers, firewalls, or gateways) and the Glasswall Halo service to sanitize files using Content Disarm and Reconstruction (CDR). This process removes potentially harmful elements and reconstructs files to ensure they are safe in real-time.

    ICAP requests are handled in two ways:

    1. Response modifications: When a user requests to download files or content from a server.
    2. Request modifications: When a user sends or uploads a file or content to a server.

  9. Understand the Glasswall CDR file sanitization process

    Glasswall CDR (Content Disarm and Reconstruction) secures files by deconstructing them into multiple layers and inspecting their 'digital DNA'. Risky content is removed according to the manufacturer's 'known good' settings. The file is then rebuilt into a safe, visually identical version.

  10. Glasswall Halo Technical Architecture and Deployment

    Glasswall Halo uses a cloud-native architecture based on scalable Kubernetes (k8s) to automate the deployment, scaling, and management of containerized applications. It supports managed Kubernetes services such as Azure Kubernetes Service (AKS), Amazon Elastic Kubernetes Service (EKS), and Oracle Kubernetes Engine (OKE). Deployment is supported via Terraform scripts and Helm charts.

  11. Understand Glasswall Export package structure

    The Glasswall Export package is a ZIP archive containing XML or SISL file streams, embedded images, and JSON metadata files (specifically for PDF images). To minimize the size of exported file streams, internal names for XML tags, attributes, SISL types, and parameters are shortened.

  12. Interpret Glasswall Halo Risk Report metrics

    The Risk Report in the Glasswall Halo portal provides a high-level and detailed breakdown of file processing and security outcomes. Key metrics include:

    Protected File Overview:

    • Total files protected and their total size.
    • Total number of risky items removed.
    • Average time taken to protect a file.

    Risk Summary Details:

    • Original file risk level: The risk assigned to the file before it was rebuilt.
    • File protection level: The status of the file after the rebuilding process.
    • Original malware status: Classification of the original file's maliciousness based on ReversingLabs reputation databases.
    • Severity of malicious files: A threat severity score from 1-5 for files confirmed as malicious by ReversingLabs.
    • Risky content removed/allowed: Lists of content removed based on organization policy, or content allowed through based on policy settings.
    • Top protected file types: A list of the most common file formats processed by Glasswall CDR.
    • Product/API usage: A breakdown of which Glasswall products were used for the rebuilds.