Skip to navigation
Research and SpikesMalware Scanning Approach

Defender for Storage Malware Scanning Design

Purpose

Define the event-driven malware scanning integration between Microsoft Defender for Storage and Fluxx using Event Grid and Azure Service Bus

This document defines:

  • Malware scanning architecture
  • Event routing model
  • File Intake responsibilities
  • Correlation strategy
  • Scan result persistence
  • Sequence of operations

Architectural Overview

Key Characteristics

  • Hierarchical Namespace (HNS) is enabled on the storage account
  • Microsoft Defender for Storage performs asynchronous malware scanning
  • Malware scan results are emitted as security events
  • Event Grid routes scan result events to Azure Service Bus
  • File Intake consumes scan result events and updates the database

End-to-End Flow

  1. A file is uploaded via File Intake
  2. The file is persisted to Blob Storage
  3. Defender for Storage scans the blob asynchronously
  4. Defender emits a malware scanning security event
  5. Event Grid receives the security event
  6. Event Grid publishes the event to a Service Bus topic
  7. File Intake consumes the Service Bus message
  8. File Intake updates the file record with the scan result
  9. Malicious files are quarantined via soft delete

Event Delivery Model

Event Grid and Service Bus

  • Defender emits security events asynchronously
  • Event Grid subscribes to Defender malware scanning events
  • Event Grid delivers malware scan result events to an Azure Service Bus topic
  • Fluxx uses an established Service Bus consumption pattern
  • Application services do not consume Event Grid subscriptions directly

Event Grid Ownership Validation

  • Event Grid ownership validation is enforced through Azure resource configuration
  • No HTTP validation endpoint is required
  • Authorization is established through Azure-managed identities and role assignments
  • Event Grid is permitted to publish to the Service Bus topic

Scan Result Ingestion (File Intake)

Consumer Role

  • File Intake is the sole consumer of malware scan result events
  • File Intake subscribes to the Service Bus topic containing scan results
  • File Intake is responsible for:
    • Parsing Event Grid messages
    • Correlating scan results to uploaded files
    • Persisting scan results
    • Triggering quarantine actions

Event Message Structure

Service Bus Message Body

  • The message body contains the Event Grid event payload
  • The payload is an array, including when a single event is emitted

File Intake processes only events of type: Microsoft.Security.MalwareScanningResultDetected

Correlation Strategy

Correlation ID

  • The correlation ID is the blob URI
  • The blob URI is stored in: [fileIntake].[File].[InternalUrl]
  • Scan result events are correlated using this value

Scan Result Persistence Model

  • Column: MalwareScanResult
  • The column stores the scan result returned by Defender
  • Possible values include:
    • Malicious
    • No Threat Found
    • Error
    • Not Scanned

If no scan result has been received, the column value is null

Processing Gate

  • Downstream processing is allowed only when: MalwareScanResult equals No Threat Found
  • Downstream processing is blocked when MalwareScanResult is:
    • Malicious
    • Error
    • Not Scanned
    • Null

Timing Model

  • Malware scanning is asynchronous
  • Scan completion commonly occurs within a few seconds
  • No SLA exists for scan completion
  • File Intake may wait briefly before responding to return a scan result when available
  • Absence of a scan result is treated as pending

Sequence Diagram