Skip to navigation
Research and SpikesMalware Scanning Approach

Malware Quarantine Soft Delete and Recovery

Purpose

Define how files are handled after a malware scan result is received, including quarantine behavior, soft delete handling, and recovery actions

Scope

This document applies to files uploaded through File Intake that receive malware scan results from Microsoft Defender for Storage

Data Model Alignment

This behavior is anchored on the [fileIntake].[File] table

Relevant fields:

  • FileID
  • InternalUrl
  • MalwareScanResult

InternalUrl identifies the blob in storage

MalwareScanResult contains the scan result returned by Defender.

Quarantine Behavior

  • Quarantine is applied when MalwareScanResult equals Malicious
  • Quarantine is implemented using Blob Storage soft delete
  • The blob identified by InternalUrl is soft deleted
  • The database record remains intact

Non-Quarantine Conditions

  • Files are not quarantined when MalwareScanResult is:
    • No Threat Found
    • Error
    • Not Scanned
    • null

Processing Gate

  • Files are eligible for downstream processing only when: MalwareScanResult equals No Threat Found
  • Files are blocked from downstream processing when:
    • MalwareScanResult is Malicious
    • MalwareScanResult is Error
    • MalwareScanResult is Not Scanned
    • MalwareScanResult is null

Error Handling

  • Error indicates Defender attempted a scan and did not complete successfully
  • Files with MalwareScanResult equal to Error remain blocked
  • No automatic retry behavior is defined in this document

Not Scanned Handling

  • Not Scanned indicates Defender did not scan the file
  • Files with MalwareScanResult equal to Not Scanned remain blocked

Recovery Behavior

  • Recovery actions are initiated manually or through operational workflows
  • Recovery may include:
    • Restoring a soft-deleted blob
    • Re-uploading the file
    • Re-triggering a scan through storage-level actions
  • Recovery behavior does not modify historical scan results

Soft Delete Retention

  • Blob retention is governed by storage account configuration
  • File Intake does not control soft delete retention duration

Audit and Observability

  • MalwareScanResult is retained on the file record
  • Blob deletion and restoration events are logged by the storage platform
  • No additional audit schema is defined in this document