Receive the file task
The API accepts file identity, path and optional SHA-256, then verifies caller scope and file state.
Multi-Engine File Security Gateway
One file. Multiple engines. One traceable verdict.
QINGJIAN connects enterprise NAS, upload portals, artifact repositories and internal file systems to malware detection engines through a unified API. It combines real-time scan results, asynchronous alerts and file-integrity evidence into one consistent decision.
Vendor-neutral architectureOn-premises deploymentUnified APIAuditable evidence
Engine orchestration / QJ-7F3A● ● ●
Real-time verdict engineMicrosoft Defender AdapterResult received
Auxiliary verificationEnterprise AV AdapterAlert correlated
Extensible analysisSandbox / YARA / ReputationOn demand
SHA-256 and task evidence verifiedUnified verdict: Clean
One integrationBusiness systems call a single API
Multiple signalsSynchronous results and asynchronous alerts
Trusted file stateHash and timestamp verification
Traceable decisionsTasks, nodes, evidence and reviews
The value is not tied to one antivirus engine. It is the integrity of the verdict chain.
Security products report findings in different ways. Some return a result immediately; others start a task and later emit a Syslog or platform event. QINGJIAN normalizes these differences through adapters and turns multiple signals into a standard result that business systems can act on.
Run real-time detection
An available worker executes the configured verdict engine and produces the first structured result.
Collect supporting signals
Additional API responses, Syslog events, sandbox reports or reputation signals are linked to the task.
Return one verdict
A normalized result is delivered by webhook. Conflicts enter human review with the evidence preserved.
Capabilities are defined by role, not locked to a single vendor.
Organizations choose engines based on existing licenses, region and security policy. Delivered integrations are marked as current, while other enterprise security products can be adapted quickly around their interfaces, licensing and deployment requirements.
Real-time verdict engines
Return structured clean, infected, unscannable or failed results quickly enough for a business workflow.
- Current implementation: Microsoft Defender
- Worker scheduling and result parsing
Auxiliary verification
Provide independent evidence through APIs, Syslog or enterprise security management events.
- Current implementation: Huorong Enterprise
- Adaptable: Kaspersky and other enterprise products
Deep analysis
Add rule, reputation or sandbox analysis for higher-risk files and stronger evidence.
- Extensible: YARA / ClamAV
- Extensible: sandbox / reputation / threat intelligence
Everything needed to decide whether a file may continue.
From intake to evidence retention, QINGJIAN turns separate security tools into an operational enterprise service.
Adapter architecture
Normalizes synchronous results, task APIs and alert formats from different security vendors.
File integrity
Checks size, timestamp and SHA-256 to distinguish NAS metadata changes from real content changes.
Distributed workers
Supports concurrent workers, node roles and health monitoring as scan volume grows.
API and webhooks
Fits upload, approval, download and artifact-delivery workflows without exposing engine differences.
Asynchronous correlation
Links Syslog or platform events to the original file task within a controlled observation window.
Audit and review
Preserves execution stages and raw evidence, with human review for conflicting engine results.
Deploy inside your environment and build on the security tools you already own.
QINGJIAN coordinates detection, protects file integrity and records results; it does not replace endpoint protection, EDR, sandboxes or security operations.
Actual engine support depends on vendor licensing, interface availability, log formats and deployment conditions.
Business systemsAPI / Webhook
→QINGJIAN GatewayOrchestrate / Correlate / Decide
→Detection capabilitiesAV / YARA / Sandbox
The central service, real-time scan workers and auxiliary-engine workers can be separated by role while one task model tracks node health, execution state and verdict evidence.
Delivered capabilities and future adaptations are stated separately.
Planned adapters are not presented as shipping features. Buyers can evaluate the current product accurately and request support for the security products already deployed in their environment.
Current product foundation
- Unified file-scan API and webhooks
- Microsoft Defender real-time verdicts
- Huorong Enterprise task and Syslog correlation
- Distributed workers, audit and human review
Adaptation directions
- Kaspersky and other enterprise AV products
- YARA, ClamAV and custom rules
- File reputation, threat intelligence and cloud sandboxes
- Regional and industry-specific deployment topologies
Frequently asked questions
Is QINGJIAN an antivirus product?
No. It is a security gateway between business file workflows and detection engines. It handles intake, orchestration, correlation, verdicts and audit.
Does it already support Kaspersky and other vendors?
The current implementation covers Microsoft Defender and Huorong Enterprise capabilities. Other vendors require validation and adaptation based on APIs, event outputs, licensing terms and deployment models.
Why use more than one detection engine?
Engines differ in rules, update cycles and signal sources. Independent evidence can improve decision quality, but no combination guarantees detection of every threat. QINGJIAN makes the decision traceable.
Send me your file workflow.
Tell us about your storage, daily file volume, deployed security products and the business processes you want to connect. We can start with a focused scenario assessment.
teemo.dcx@gmail.com