File Security on Azure

Question

I am currently looking into what the best option is for scanning file content that is uploaded.

VirusTotal has an API that can be used but it is pricey.
ClamAV I looked at, but I am not convinced too much of the accuracy of it.

The last one is Microsoft security essentials on Azure, is there maybe another way that I am overlooking?

Answer 1

This is a popular question and source of feedback on feedback.azure.com (I've since voted on this and would encourage you to do the same to increase visibility). The primary answer here comes from the Azure Storage Team which has recommended using security partners like Symantec which has released support for Azure Blob Storage:

Symantec in Azure Marketplace: Symantec Cloud Workload Protection for Storage

Use Symantec Cloud Workload Protection for Storage (CWP for Storage) to protect your Azure blob storage from malware. The CWP for Storage uses Symantec's latest built-in anti-malware technologies to protect the blob storage and their objects from malware threats. The ability to detect malware threats in blob storage at runtime is possible by leveraging the scanning capabilities of CWP for Storage. Automatic initiation of the Near real-time scan operation immediately after discovery of the blob storage helps in instant detection of malware in storage. Additionally, perform periodic checks of blob storage by scheduling scans as per your convenience.

Additional options used by others include VirusTotal and ClamAV, like you mentioned:

• Scanning Blob storage for viruses with Azure Functions and Docker (using ClamAV)
• Virus Scan File Uploads Using Multi-Container Web App (mentions VirusTotal and ClamAV)
• On Demand Malware Scanning for Azure Storage Blobs with VirusTotal (VirusTotal)

Outside of virus scanning, there are related Azure services to be aware of:

• Azure Defender for Storage (Advanced Threat Protection)
• Azure Security Center
• Microsoft Antimalware for Azure

I hope that helps!

Answer 2

@Anonymous Does this service provide the requested solution for blob storage? https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction

Answer 3

Hi

I enabled Azure Defender Local Storage to detect Malware. When I try to upload EICAR.txt directly using Azure Platform after few hours I have the warning on Azure Defender.

But when I try to use BlockBlobClient to upload files I don't have any warning on Azure Defender.

Any idea why I don't have warnings?