<- Back to featured projects

Draft Case Study

Azure Blob Malware Scanning with Defender for Storage

File ingestion pipelines need proactive malware detection before downstream processing.

Azure StorageDefender for CloudSecurityEvent-Driven

Problem

File ingestion pipelines need proactive malware detection before downstream processing.

Architecture

Draft architecture combines blob events, scanning workflows, and quarantine routing with secure notifications.

UploadScanQuarantineApproved
Sanitized storage security workflow with scan and quarantine branches.

Reference/proposed architecture diagram for portfolio demonstration. Not a client production architecture.

Architecture Explorer

Malware Scanning: Event-driven file validation with controlled quarantine branch.

Reference

Data flow: Upload events split into scan outcomes, routing suspicious objects to quarantine and approved content to downstream processing.

Accessible alternative: use the component buttons below to inspect architecture details without zoom.

Legend

  • Ingress / Trigger
  • Orchestration
  • Data / Storage
  • Security
  • Observability
  • Operations
  • Upload Endpoint -> Blob Landing (upload)
  • Blob Landing ~> Scan Orchestrator (scan trigger)
  • Scan Orchestrator -> Approved Store (clean verdict)
  • Scan Orchestrator -> Quarantine Store (suspicious verdict)
  • Quarantine Store ~> Ops Notification (incident signal)

Component Details

Upload Endpoint

Accept inbound file submissions for validation.

Responsibilities: Ingestion trigger | Object intake

Security controls: Authenticated upload path | Transport security

Dependencies: Blob Landing

Design decisions: Separate upload from downstream processing until scan verdict is known.

Security

Draft security model includes encrypted storage, minimal access paths, and auditable incident handling.

Verified Outcomes

  • Draft: improved containment posture for suspicious uploads.
  • Draft: clearer governance path for handling potentially malicious objects.

Design Decisions

  • Separate quarantine and approved-object paths to avoid accidental downstream ingestion.
  • Use event-driven orchestration for low-latency validation before processing.
  • Retain auditable scan-state metadata for traceability.

Implementation

  • Configure event triggers for blob uploads and scan-state updates.
  • Route suspicious files to quarantine while preserving triage context.
  • Integrate notification hooks for operational follow-up workflows.

Trade-offs

  • Early scanning improves safety but can add latency to ingestion pipelines.
  • Strict quarantine policies reduce risk while increasing operational review volume.

Engineering Evidence

Reference architecture evidence

Architecture Evidence

Diagram classification: Reference

Sanitized data flow: Uploaded objects are staged, scanned, then routed to approved storage or quarantine with incident notification signals.

Diagram source id: blob-malware-scanning-defender-storage

Evidence pending: no implemented demo route is linked for this case study.

Automated Tests and Results

  • Diagram validation and explorer rendering

    tests/architecture-explorer.test.ts

Latest test run (2026-09-26): Evidence pending: add executable modules and targeted tests for this case study.

Command: No case-study-specific automated tests are currently implemented for this architecture draft.

Latest build run (2026-09-26): Portfolio build passes, but this case study still lacks project-specific implementation artifacts.

Command: node_modules/.bin/next.cmd build

Limitations and Verification Gaps

  • No storage event handlers, scan orchestration code, or quarantine workflow modules are committed.
  • No malware scanning engine integration evidence is available in this repository.

Evidence Pending

  • Add event processing code and scan-result routing logic with integration tests.
  • Add sanitized run logs that demonstrate quarantine and approved-path handling.

Evidence Status

  • Local checks: Architecture/content checks only.
  • CI checks: Repository lint/type/build checks available.
  • Azure deployment: Not performed / Evidence pending.

Reproduction and Dependencies

Dependencies

  • Node.js (current project uses Next.js 16.x, React 19.x, TypeScript 6.x)
  • npm install
  • Local binaries under node_modules/.bin for lint/typecheck/test/build

Reproduction steps

  1. npm install
  2. Review architecture model in lib/architecture-explorer-data.ts
  3. Open the project case-study route and inspect Architecture Explorer
  4. Implementation evidence requires source modules and automated tests specific to this case study