# File Inspection Engine

> Containerized file analysis service for real-time malware scanning via HTTP API. Runs on Docker or Kubernetes, analyzes 400+ formats on-premises.

# File Inspection Engine

File Inspection Engine (FIE) is a containerized file analysis service that performs synchronous, real-time scanning of files via an HTTP API. It is designed for integration into network security pipelines where files must be inspected inline — each request submits a file, waits for analysis to complete, and receives a verdict in the same response.

FIE uses [Spectra Core](/General/AnalysisAndClassification/SpectraCoreAnalysis) for static file analysis, enabling deep inspection of over 400 file formats without executing files. It is deployed as an OCI-compliant container on Docker or Kubernetes and maintains a local threat database, so file content never leaves your infrastructure during scanning.

## Key capabilities

- Synchronous HTTP API — submit a file, receive a classification verdict in one request
- Containerized deployment on Docker or Kubernetes (no agent installation required)
- Local threat database — all file analysis happens on-premises
- Configurable Spectra Core instances for throughput scaling
- Large file handling with dedicated core pools
- Optional enrichment with cloud threat details via [Spectra Intelligence](/SpectraIntelligence/) hash lookups (hash only, no file upload)

## Privacy

File Inspection Engine keeps all file data on-premises. Files submitted for scanning are processed locally using a bundled threat database and are not uploaded to external services. When the `--with-threat-details` option is enabled, FIE contacts Spectra Intelligence using the file hash only — the file itself is never transmitted. The threat database is updated on a regular schedule from ReversingLabs infrastructure.

## Deployment options

Choose a deployment model based on your infrastructure:

- [Deployment Overview and Hardware Requirements](./Deployment/) — capacity planning, Spectra Core instance sizing, and networking prerequisites
- [Docker Deployment](./Deployment/docker.md) — standalone container setup for development and smaller deployments
- [Kubernetes Deployment](./Deployment/kubernetes.md) — Helm chart installation for production Kubernetes clusters
- [Air-Gapped Kubernetes](./Deployment/air-gapped-kubernetes.md) — deployment in offline or restricted network environments
- [Helm Values Reference](./Deployment/Examples/values.md) — complete chart configuration reference

## Configuration

FIE is configured via CLI flags and environment variables. Key settings include the number of Spectra Core instances, analysis timeouts, maximum file size, and network interface bindings.

See the [Configuration Reference](./configuration.md) for all available options.

## Usage and API

FIE exposes a REST API for file submission, result retrieval, status monitoring, and classification overrides.

See the [Usage Guide](./usage.md) for API endpoint documentation, scanning workflows, response formats, and error handling.

## Related resources

- [Spectra Core Analysis](/General/AnalysisAndClassification/SpectraCoreAnalysis) — how the underlying static analysis engine works
- [Classification](/General/AnalysisAndClassification/Classification) — risk scores, threat levels, and classification methodology
- [Platform Requirements](/General/DeploymentAndIntegration/PlatformRequirements) — hardware sizing across all ReversingLabs products
