Procedure

1. A user or program uploads a file to any container inside the protecting storage account. The upload generates an Microsoft.Storage.BlobCreated event and pushes the event to an Event Grid System Topic.
2. The Blob Listener Function detects the Microsoft.Storage.BlobCreated event, and sends a URL containing the shared access signature (SAS) to the Scanner Queue in the scanner stack. The URL links back to the file that needs to be scanned.
3. The Scanner Function, which is subscribed to the Scanner Queue, does the following:
   • Retrieves the URL message from the Scanner Queue.
   • Finds the file in Azure storage account at the URL location.
   • Performs scanning on the file.
   • Generates file identification information.
   • Sends the file identification information to the Trend Micro Global Smart Protection Server in the cloud.
4. The Trend Micro Global Smart Protection Server leverages the Trend Micro Smart Protection Network (not shown in diagram) to perform the remaining scanning on the file identification information (not the file). The scan results are returned to the Scanner Function.
5. The Scanner Function does the following:
   • Publishes the scan results to the Scan Result Topic in the storage stack.
   • Sends the scan results to the File Storage Security console. (The console is not shown in the diagram).
6. The Scan Result Topic notifies its subscribers that new scan results are available. Its subscribers are:
   • the File Storage Security's Post Scan Action Tag Function
   • your custom post-scan action Function function
7. After receiving the notification from Scan Result Topic:
   • The PostScanActionTagFunction adds the scan results to the file using Azure blob metadata and blob index tags. For details, see Understand tags and scan results.
   • Your custom post-scan action Function acts on the scan information provided in the Scan Result Topic. For example, it might quarantine or delete the file if it is found to be malicious.