Views:

Before you begin

Complete all five checks in Before you begin first. In particular, do not start if C1FSS is deployed into a VNet, and make sure you have recorded the C1FSS event subscription details for every storage account C1FSS protects. You need those details to roll back.
You can follow this brief-downtime process to update from TrendAI Cloud One File Storage Security (C1FSS) to TrendAI Vision One™ File Security Storage (V1FSS) in Azure. Because C1FSS scanning stops before V1FSS scanning starts, this method avoids the race conditions that can occur when both products scan and act on the same blob.
Scanning pauses between step 2 and step 3. Blobs uploaded during that gap are scanned by neither product. Both actions are single actions in a console, so the gap is typically a few minutes and its duration depends on you, not on any deployment step.

Procedure

  1. Install V1FSS, and do not turn on scanning for any storage account.
    1. In the TrendAI Vision One console, go to Cloud Security → File Security, and then on the Inventory page, under Storage, select Azure.
    2. Click Add Subscription, select Single Subscription, and complete the required fields on the General information page.
    3. On the Features and Permissions page, enable File Security Storage and select the regions where you want to deploy the File Security scanner.
      Important
      Important
      Select every region where C1FSS runs. For the full deployment procedure and the quota requirements, see Deploy File Security Storage to Azure.
    4. In the Azure portal, open Cloud Shell and select Bash if you are prompted, and then follow the steps shown on the Add Azure Subscription page in the TrendAI Vision One console to upload and extract the deployment package.
    5. If you use the promote-or-quarantine plugin, configure the promote and quarantine settings now, before you install.
      See Update promote and quarantine settings. Configuring the settings now avoids a window in which V1FSS scans your files but does not move them.
    6. Check permissions and quota, and then deploy V1FSS.
      ./deploy.sh preflight
./deploy.sh install
      The preflight command creates nothing. Fix anything it reports as failed, and then run it again. If it reports a problem with an app registration or a service principal, that is the Microsoft Entra ID plane: you need directory permissions, not more subscription permissions.
      The install command creates one resource group per region, named v1fss-<region>-rg, and registers the subscription with TrendAI Vision One automatically. If Cloud Shell times out partway through, reconnect, change back to the deployment directory, and run the same command again. It continues from where it stopped.
    7. Confirm that the subscription appears under Azure on the Inventory page after the deployment completes, and that the storage accounts in your subscription are listed.
      Note
      Note
      It might take some time to sync your storage accounts to TrendAI Vision One.
    8. Do not turn on scanning yet for any storage account that C1FSS protects.
      Leaving them off until step 3 is what keeps the downtime short.
      Optionally, turn on scanning now for a storage account that C1FSS does not protect, and use it to confirm that V1FSS works before you cut anything over. That storage account has no C1FSS event subscription, so there is nothing to race with.
    Check point
    • The subscription appears under Azure on the Inventory page.
    • Every storage account that C1FSS protects is listed under the subscription and still shows as not protected.
    • C1FSS is still scanning, and its tmbl0…-trigger event subscription is untouched.
  2. Remove the C1FSS event subscription from the storage account.
    Important
    Important
    The downtime starts here. Blobs uploaded between this step and step 3 are scanned by neither product.
    1. In the Azure portal, go to Storage accounts → your target storage account → Events → Event Subscriptions.
    2. Select the tmbl0…-trigger subscription and delete it.
    3. Repeat for every storage account in this region.
    4. If you use the promote-or-quarantine plugin, also delete its promote-or-quarantine-subscription subscription, on the scan-result-topic topic of the tmsrt0… Service Bus namespace, so that C1FSS stops moving blobs as well as scanning them.
      Important
      Important
      Record the subscription's settings before you delete it. You need them to roll back, and they are not the Azure defaults, so recreating the subscription from the portal's prefilled values would change how C1FSS behaves. Open the subscription and note the max delivery count (3), the message lock duration (PT4M), and the default message time to live (PT1H). There are no filters, so the subscription receives every scan result.
  3. Turn on scanning for the storage accounts you recorded in Before you begin.
    The downtime ends when this step is complete.
    Optionally, you can also turn on scanning for a storage account that C1FSS did not protect, to confirm that V1FSS scans files independently.
  4. Validate that V1FSS is working.
    1. Upload a new file to the storage account.
      In the Azure portal, open the storage account and go to Storage browser → Blob containers, select a container, and then click Upload.
    2. Check that the tags exist on the new file.
      Click the uploaded blob and check Metadata and Blob index tags. Expect fss-scan-result to be no issues found.
    3. Check the scan activity on the TrendAI Vision One File Security page.
    4. Upload the EICAR test file to the storage account.
      Run the following in Cloud Shell, changing only the storage account and container names on the last line.
      curl -sSL https://secure.eicar.org/eicar.com.txt -o eicar.com.txt && \
az storage blob upload --auth-mode login --overwrite \
  --file eicar.com.txt --name eicar.com.txt \
  --account-name <storage-account> --container-name <container>
      Note
      Note
      EICAR is a standard anti-malware test string, not real malware.
    5. Check the file tags.
      Expect fss-scan-result to be malicious.
    6. Wait for the scan results to sync and the malware detection to appear in TrendAI Vision One.
    7. If you updated your promote and quarantine settings, confirm that blobs actually move.
      A successful scan says nothing about whether files reach the right place. The destination storage account, the container layout setting, and the destination's subscription are three separate things that can be wrong. Confirm both of the following:
      • The EICAR blob disappears from the source storage account and appears in your quarantine storage account, in a container named after the source container.
      • The clean blob does the same against your promote destination.
  5. Remove the old C1FSS storage stack, scanner stack, or All-in-One stack.
    Follow step 4 of Manually update to TrendAI Vision One File Security Storage for Azure - zero downtime. The procedure is the same for both update paths.
    Important
    Important
    Deleting the resource groups is not enough. C1FSS also created resources outside them.

Next steps

The update is complete. V1FSS is scanning your storage accounts and C1FSS is decommissioned.

Rollback for the brief-downtime update Parent topic

If you encounter an issue while updating from C1FSS to V1FSS, you can follow these steps to roll back to C1FSS.

Procedure

  1. Turn off V1FSS scanning first, to avoid a race condition.
    In the TrendAI Vision One console, go to the File Security Inventory page and turn off scanning for the storage account.
  2. If the event subscription has been removed, recreate it from the C1FSS event subscription details you recorded in Before you begin.
    In the Azure portal, go to Storage accounts → your target storage account → Events and click + Event Subscription. Set the name, the event types (Microsoft.Storage.BlobCreated and Microsoft.Storage.BlobRenamed), the endpoint type Azure Function, and the tmbl0… function app as the endpoint.
  3. If you use the promote-or-quarantine plugin, recreate its promote-or-quarantine-subscription subscription on the scan-result-topic topic of the tmsrt0… Service Bus namespace.
    Use the settings you recorded in step 2: max delivery count 3, message lock duration 4 minutes, and default message time to live 1 hour. Leaving the portal's defaults in place would change the retry and expiry behavior of C1FSS.
    C1FSS scans the storage account as it did before the update.

Next steps

Important
Important
Rollback is only possible before you delete the C1FSS resource groups. After those are gone, rolling back means deploying C1FSS again from scratch.