Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Malware Scanning Results Should be Stored as Metadata not Index Tags #900

Open
phil000 opened this issue Aug 28, 2024 · 4 comments
Open

Comments

@phil000
Copy link

phil000 commented Aug 28, 2024

Is your feature request related to a problem? Please describe.
Yes.
We use blob index tags within our own application. However, by far and away our largest storage cost is the index tags, making up 75% of our storage bill. We are removing all index tags now as they are not frequently used.
Malware Scanning also adds index tags as files are scanned:

  1. "Malware Scanning scan result"
  2. "Malware Scanning scan time UTC"

When dealing with millions of blobs this cost starts to add up a lot for our customers.

Describe the solution you'd like
We'd like to stop the scanning processing from creating index tags - specifically as these are starting to cost us a lot of money - and store the scan results in metadata instead - which is free! FREE.

There is also really no reason for the scan results to be 'searchable'. Having 100,000,000 blobs all with a searchable index tag with the value "No threats found" is of no value at all.

The names of results may need to change a bit to comply with the naming guidelines of Metadata (vs tags). e.g. "MalwareScanningResult" and "MalwareScanningTimeUTC" or something.

Describe alternatives you've considered
We use azcopy to remove all index tags from all blobs right now, and will probably keep doing this on a regular basis.

Additional context
Scan results stored as index tags:

image
Add any other context or screenshots about the feature request here.

@TomJanetscheck
Copy link
Contributor

@velahuer for visibility

@velahuer
Copy link
Collaborator

We are aware of this feedback and are looking for ways to let users decide where to have the "index tags values".

In the meantime, we released a PowerShell script that removes the index tags on a specific storage account or on a specific subscription: https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Powershell%20scripts/Remove%20Malware%20Scanning%20Index%20Tags

@velahuer
Copy link
Collaborator

@phil000 would you mind sharing me your details (name, company) to keep you as customer evidence?

@phil000
Copy link
Author

phil000 commented Aug 28, 2024

@velahuer
Done

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants