> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://cla-demo.postmansolutions.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://cla-demo.postmansolutions.com/_mcp/server.

# Defender for Storage Malware Scanning Design

## Purpose

Define the event-driven malware scanning integration between Microsoft Defender for Storage and Fluxx using Event Grid and Azure Service Bus

This document defines:

* Malware scanning architecture
* Event routing model
* File Intake responsibilities
* Correlation strategy
* Scan result persistence
* Sequence of operations

---

## Architectural Overview

### Key Characteristics

* Hierarchical Namespace (HNS) is enabled on the storage account
* Microsoft Defender for Storage performs asynchronous malware scanning
* Malware scan results are emitted as security events
* Event Grid routes scan result events to Azure Service Bus
* File Intake consumes scan result events and updates the database

---

## End-to-End Flow

1. A file is uploaded via File Intake
2. The file is persisted to Blob Storage
3. Defender for Storage scans the blob asynchronously
4. Defender emits a malware scanning security event
5. Event Grid receives the security event
6. Event Grid publishes the event to a Service Bus topic
7. File Intake consumes the Service Bus message
8. File Intake updates the file record with the scan result
9. Malicious files are quarantined via soft delete

---

## Event Delivery Model

### Event Grid and Service Bus

* Defender emits security events asynchronously
* Event Grid subscribes to Defender malware scanning events
* Event Grid delivers malware scan result events to an Azure Service Bus topic
* Fluxx uses an established Service Bus consumption pattern
* Application services do not consume Event Grid subscriptions directly

---

## Event Grid Ownership Validation

* Event Grid ownership validation is enforced through Azure resource configuration
* No HTTP validation endpoint is required
* Authorization is established through Azure-managed identities and role assignments
* Event Grid is permitted to publish to the Service Bus topic

---

## Scan Result Ingestion (File Intake)

### Consumer Role

* File Intake is the sole consumer of malware scan result events
* File Intake subscribes to the Service Bus topic containing scan results
* File Intake is responsible for:
  * Parsing Event Grid messages
  * Correlating scan results to uploaded files
  * Persisting scan results
  * Triggering quarantine actions

---

## Event Message Structure

### Service Bus Message Body

* The message body contains the Event Grid event payload
* The payload is an array, including when a single event is emitted

File Intake processes only events of type: `Microsoft.Security.MalwareScanningResultDetected`

---

## Correlation Strategy

### Correlation ID

* The correlation ID is the blob URI
* The blob URI is stored in: `[fileIntake].[File].[InternalUrl]`
* Scan result events are correlated using this value

---

## Scan Result Persistence Model

* Column: MalwareScanResult
* The column stores the scan result returned by Defender
* Possible values include:
  * Malicious
  * No Threat Found
  * Error
  * Not Scanned

If no scan result has been received, the column value is null

---

## Processing Gate

* Downstream processing is allowed only when: `MalwareScanResult` equals `No Threat Found`
* Downstream processing is blocked when MalwareScanResult is:
  * Malicious
  * Error
  * Not Scanned
  * Null

---

## Timing Model

* Malware scanning is asynchronous
* Scan completion commonly occurs within a few seconds
* No SLA exists for scan completion
* File Intake may wait briefly before responding to return a scan result when available
* Absence of a scan result is treated as pending

---

## Sequence Diagram

* [Asynchronous Malware Scanning with Short Poll](https://lucid.app/lucidchart/fd430117-d851-4559-8187-a1ddb40a7697/edit?viewport_loc=-9769%2C-5937%2C4001%2C2035%2CbhJgTb~LLK_s\&invitationId=inv_fa219e54-6c7d-4ccb-bc2d-7909188ad3a2)