Views:

Before you begin

Complete all five checks in Before you begin first. In particular, do not start if C1FSS is deployed into a VNet, and make sure you have recorded the C1FSS event subscription details for every storage account C1FSS protects. You need those details to roll back.
You can follow this zero-downtime process to update from TrendAI Cloud One File Storage Security (C1FSS) to TrendAI Vision One™ File Security Storage (V1FSS) in Azure. This method keeps your existing C1FSS deployment active and scanning blobs while you set up and validate V1FSS.
During the overlap, both products receive every blob event and scan independently. If you use the promote-or-quarantine plugin, be aware that the overlap introduces the risk of a race condition. If that risk is not acceptable, use the brief-downtime path instead.

Procedure

  1. Install V1FSS and turn on storage account scanning.
    1. In the TrendAI Vision One console, go to Cloud Security → File Security, and then on the Inventory page, under Storage, select Azure.
    2. Click Add Subscription, select Single Subscription, and complete the required fields on the General information page.
    3. On the Features and Permissions page, enable File Security Storage and select the regions where you want to deploy the File Security scanner.
      Important
      Important
      Select every region where C1FSS runs. For the full deployment procedure and the quota requirements, see Deploy File Security Storage to Azure.
    4. In the Azure portal, open Cloud Shell and select Bash if you are prompted, and then follow the steps shown on the Add Azure Subscription page in the TrendAI Vision One console to upload and extract the deployment package.
    5. Check permissions and quota. This command creates nothing.
      ./deploy.sh preflight
      Fix anything the command reports as failed, and then run it again. If it reports a problem with an app registration or a service principal, that is the Microsoft Entra ID plane: you need directory permissions, not more subscription permissions.
    6. Deploy V1FSS.
      ./deploy.sh install
      The script creates one resource group per region, named v1fss-<region>-rg, and registers the subscription with TrendAI Vision One automatically. If Cloud Shell times out partway through, reconnect, change back to the deployment directory, and run the same command again. It continues from where it stopped.
    7. Confirm that the subscription appears under Azure on the Inventory page after the deployment completes.
    8. Confirm that the storage accounts in your subscription are listed.
      Note
      Note
      It might take some time to sync your storage accounts to TrendAI Vision One.
    9. Turn on scanning for the storage accounts you recorded in Before you begin.
    10. Also turn on scanning for one storage account that C1FSS does not protect.
      This storage account is your test target in step 2. An empty container is enough. Step 2 explains why you validate here rather than on a storage account that C1FSS protects.
    Check point
    • The subscription appears under Azure on the Inventory page.
    • Your storage accounts are listed under the subscription.
    • Each storage account's Events → Event Subscriptions page now lists two subscriptions: the C1FSS tmbl0…-trigger subscription and the V1FSS v1fss-…-blob-created-sub subscription.
    Both products now receive every blob event and scan independently. This is the zero-downtime overlap.
  2. Validate that V1FSS is working.
    Important
    Important
    Run every check in this step against the storage account that C1FSS does not protect, which is the one you turned on in step 1. Do not run them against a storage account that C1FSS protects, because during the overlap you cannot tell which product produced the result.
    1. Upload a new file to the storage account.
      In the Azure portal, open the storage account and go to Storage browser → Blob containers, select a container, and then click Upload.
    2. Check that the tags exist on the new file.
      Click the uploaded blob and check Metadata and Blob index tags. Expect fss-scan-result to be no issues found.
    3. Check the scan activity on the TrendAI Vision One File Security page.
    4. Upload the EICAR test file to the storage account.
      Run the following in Cloud Shell, changing only the storage account and container names on the last line.
      curl -sSL https://secure.eicar.org/eicar.com.txt -o eicar.com.txt && \
az storage blob upload --auth-mode login --overwrite \
  --file eicar.com.txt --name eicar.com.txt \
  --account-name <storage-account> --container-name <container>
      Note
      Note
      EICAR is a standard anti-malware test string, not real malware.
    5. Check the file tags.
      Expect fss-scan-result to be malicious.
    6. Wait for the scan results to sync and the malware detection to appear in TrendAI Vision One.
    Note
    Note
    A race condition may occur when a V1FSS quarantine destination is configured, or when the C1FSS promote-or-quarantine plugin is in use. During concurrent processing, V1FSS may move or quarantine a blob while the C1FSS scanner is still processing it. As a result, the blob may no longer be available when C1FSS attempts to access it, causing expected errors in the C1FSS scanner logs. The same applies in reverse: whichever product moves the blob first, the other one finds nothing.
    If you use the plugin and want to end the double move sooner without removing C1FSS scanning, delete only the plugin's promote-or-quarantine-subscription as described in step 4. Record its settings first if you might still roll back.
  3. Remove the C1FSS event subscription from the storage account.
    This is the cutover. After this step, only V1FSS scans that storage account.
    1. In the Azure portal, go to Storage accounts → your target storage account → Events → Event Subscriptions.
    2. Select the tmbl0…-trigger subscription and delete it.
    3. Leave the v1fss-…-blob-created-sub subscription in place.
    4. Repeat for every storage account in this region.
    The overlap ends here. From this point on, each of these storage accounts is scanned by V1FSS only.
    Check point
    • Each storage account's Events → Event Subscriptions page now lists only the v1fss-…-blob-created-sub subscription.
    • Upload one file to a storage account that C1FSS protected, and confirm that it is scanned. Use either case from step 2. Both the TrendAI Vision One scan activity and the blob tags should show the result.
    This is your end-to-end confirmation on a storage account that C1FSS protected. C1FSS resources still exist at this point, so if the check fails, you can roll back by recreating the C1FSS event subscription before you go on to step 4.
  4. Remove the old C1FSS storage stack, scanner stack, or All-in-One stack.
    Important
    Important
    Deleting the resource groups is not enough. C1FSS also created resources outside them.
    1. Remove the promote-or-quarantine plugin, if you use one.
      Do this before you delete the storage resource groups, so that the plugin's Service Bus subscription is removed with its consumer rather than orphaned.
      1. Open the C1FSS storage resource group, and then go to the tmsrt0… Service Bus namespace and select Topics → scan-result-topic → Subscriptions.
      2. Record the settings of the promote-or-quarantine-subscription subscription: max delivery count 3, message lock duration PT4M, and message time to live PT1H. None of these are the portal defaults, and you need the values if you roll back before the resource groups are gone.
      3. Delete the promote-or-quarantine-subscription subscription.
      4. Delete the plugin's own resource group, which is the one containing the pqfunction… storage account.
      5. Go to Subscriptions → your subscription → Access control (IAM), remove the role assignment, and then delete the custom role whose name starts with FSS-ScanningStoragePromteQuarantineRole-.
        Note
        Note
        The misspelling Promte is part of the name C1FSS created. It is not an error on your side.
      6. Repeat for every plugin instance in this region.
    2. Delete the C1FSS Azure stacks.
      Follow the steps in Delete Azure stacks.

Next steps

The update is complete. V1FSS is scanning your storage accounts and C1FSS is decommissioned.

Rollback for the zero-downtime update Parent topic

If you encounter an issue while updating from C1FSS to V1FSS, you can follow these steps to roll back to C1FSS.

Procedure

  1. If the event subscription has been removed, recreate it from the C1FSS event subscription details you recorded in Before you begin.
    In the Azure portal, go to Storage accounts → your target storage account → Events and click + Event Subscription. Set the name, the event types (Microsoft.Storage.BlobCreated and Microsoft.Storage.BlobRenamed), the endpoint type Azure Function, and the tmbl0… function app as the endpoint.
  2. If you deleted the plugin's promote-or-quarantine-subscription subscription early to end the double move, recreate it on the scan-result-topic topic of the tmsrt0… Service Bus namespace.
    Use the settings you recorded: max delivery count 3, message lock duration 4 minutes, and default message time to live 1 hour. The portal's defaults differ and would change the retry and expiry behavior of C1FSS.
  3. In the TrendAI Vision One console, go to the File Security Inventory page and turn off scanning for the storage account.
    C1FSS scans the storage account as it did before the update.

Next steps

Important
Important
Rollback is only possible before you delete the C1FSS resource groups. After those are gone, rolling back means deploying C1FSS again from scratch.