defender_for_storage

Creates, updates, deletes, gets or lists a defender_for_storage resource.

Overview

Name	defender_for_storage
Type	Resource
Id	azure.security.defender_for_storage

Fields

The following fields are returned by SELECT queries:

get_malware_scan

Name	Datatype	Description
scanEndTime	string	The time at which the scan has ended. Only available for a scan which has terminated.
scanId	string	The identifier of the scan.
scanStartTime	string	The time at which the scan had been initiated.
scanStatus	string	A status code of the scan operation.
scanStatusMessage	string	A description of the status of the scan.
scanSummary	object	A summary of the scan results.

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
isEnabled	boolean	Indicates whether Defender for Storage is enabled on this storage account.
malwareScanning	object	Properties of Malware Scanning.
overrideSubscriptionLevelSettings	boolean	Indicates whether the settings defined for this storage account should override the settings defined for the subscription.
sensitiveDataDiscovery	object	Properties of Sensitive Data Discovery.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
isEnabled	boolean	Indicates whether Defender for Storage is enabled on this storage account.
malwareScanning	object	Properties of Malware Scanning.
overrideSubscriptionLevelSettings	boolean	Indicates whether the settings defined for this storage account should override the settings defined for the subscription.
sensitiveDataDiscovery	object	Properties of Sensitive Data Discovery.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_malware_scan	select	resource_id, setting_name, scan_id		Gets the Defender for Storage malware scan for the specified storage resource.
get	select	resource_id, setting_name		Gets the Defender for Storage settings for the specified storage account.
list	select	resource_id		Lists the Defender for Storage settings for the specified storage account.
create	insert	resource_id, setting_name		Creates or updates the Defender for Storage settings on a specified storage account.
start_malware_scan	exec	resource_id, setting_name		Initiate a Defender for Storage malware scan for the specified storage account. Blobs and Files will be scanned for malware.
cancel_malware_scan	exec	resource_id, setting_name, scan_id		Cancels a Defender for Storage malware scan for the specified storage account.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
resource_id	string	The fully qualified Azure Resource manager identifier of the resource. Required.
scan_id	string	The identifier of the scan. Can be either 'latest' or a GUID. Required.
setting_name	string	The defender for storage setting name. Known values are: "MCAS", "WDATP", "WDATP_EXCLUDE_LINUX_PUBLIC_PREVIEW", "WDATP_UNIFIED_SOLUTION", "Sentinel", and "current". Required.

SELECT examples

get_malware_scan

Gets the Defender for Storage malware scan for the specified storage resource.

SELECT
scanEndTime,
scanId,
scanStartTime,
scanStatus,
scanStatusMessage,
scanSummary
FROM azure.security.defender_for_storage
WHERE resource_id = '{{ resource_id }}' -- required
AND setting_name = '{{ setting_name }}' -- required
AND scan_id = '{{ scan_id }}' -- required
;

get

Gets the Defender for Storage settings for the specified storage account.

SELECT
id,
name,
isEnabled,
malwareScanning,
overrideSubscriptionLevelSettings,
sensitiveDataDiscovery,
systemData,
type
FROM azure.security.defender_for_storage
WHERE resource_id = '{{ resource_id }}' -- required
AND setting_name = '{{ setting_name }}' -- required
;

list

Lists the Defender for Storage settings for the specified storage account.

SELECT
id,
name,
isEnabled,
malwareScanning,
overrideSubscriptionLevelSettings,
sensitiveDataDiscovery,
systemData,
type
FROM azure.security.defender_for_storage
WHERE resource_id = '{{ resource_id }}' -- required
;

INSERT examples

create

Creates or updates the Defender for Storage settings on a specified storage account.

INSERT INTO azure.security.defender_for_storage (
properties,
resource_id,
setting_name
)
SELECT 
'{{ properties }}',
'{{ resource_id }}',
'{{ setting_name }}'
RETURNING
id,
name,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: defender_for_storage
props:
  - name: resource_id
    value: "{{ resource_id }}"
    description: Required parameter for the defender_for_storage resource.
  - name: setting_name
    value: "{{ setting_name }}"
    description: Required parameter for the defender_for_storage resource.
  - name: properties
    description: |
      Defender for Storage resource properties.
    value:
      isEnabled: {{ isEnabled }}
      malwareScanning:
        onUpload:
          isEnabled: {{ isEnabled }}
          capGBPerMonth: {{ capGBPerMonth }}
          filters:
            excludeBlobsWithPrefix:
              - "{{ excludeBlobsWithPrefix }}"
            excludeBlobsWithSuffix:
              - "{{ excludeBlobsWithSuffix }}"
            excludeBlobsLargerThan: "{{ excludeBlobsLargerThan }}"
        scanResultsEventGridTopicResourceId: "{{ scanResultsEventGridTopicResourceId }}"
        blobScanResultsOptions: "{{ blobScanResultsOptions }}"
        automatedResponse: "{{ automatedResponse }}"
        operationStatus:
          code: "{{ code }}"
          message: "{{ message }}"
      sensitiveDataDiscovery:
        isEnabled: {{ isEnabled }}
        operationStatus:
          code: "{{ code }}"
          message: "{{ message }}"
      overrideSubscriptionLevelSettings: {{ overrideSubscriptionLevelSettings }}

Lifecycle Methods

start_malware_scan

Initiate a Defender for Storage malware scan for the specified storage account. Blobs and Files will be scanned for malware.

EXEC azure.security.defender_for_storage.start_malware_scan 
@resource_id='{{ resource_id }}' --required, 
@setting_name='{{ setting_name }}' --required
;

cancel_malware_scan

Cancels a Defender for Storage malware scan for the specified storage account.

EXEC azure.security.defender_for_storage.cancel_malware_scan 
@resource_id='{{ resource_id }}' --required, 
@setting_name='{{ setting_name }}' --required, 
@scan_id='{{ scan_id }}' --required
;