{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event/", "slug": "dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event", "url": "https://update.dsesecurity.com/updates/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event/" }, "title": "Validate Blob inventory output before accepting its completion event", "summary": "Distinguish an inventory event from a usable report and account for all files named in the manifest.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:14+00:00", "modified_at": "2026-09-10T01:20:46+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 225, "potentially_affected": "Workflows consuming Azure Blob inventory events, manifests and report files.", "dse_recommendation": "Check the run outcome and manifest evidence before allowing an inventory-driven workflow to proceed.", "primary_source": { "name": "Azure Storage blob inventory | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/blob-inventory", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

BlobInventoryPolicyCompleted can be raised for a run that fails before processing begins, such as an invalid policy or missing destination container. The event name alone therefore does not establish a successful report.

\n

Microsoft says generation of the checksum file marks completion of a rule run. That checksum covers the manifest, which describes the rule’s generated inventory files. A large inventory can produce multiple report files. Microsoft Learn.

\n

Applicability

\n

Identify the inventory rule, destination and downstream consumer. Decide which run and rule definition the consumer expects; do not substitute a report left by an earlier run when current output is missing.

\n

DSE recommendation

\n

DSE recommends a report-acceptance step that checks the event outcome, corresponding manifest and checksum, and the expected set of output files. Record a failed or incomplete run as such and keep dependent analysis on hold. Avoid selecting the first matching CSV or Parquet file and silently treating it as the whole inventory.

\n

Verification

\n

Test the consumer against a successful run, a documented pre-run failure scenario and a run represented by multiple files. Confirm it associates all evidence with the correct rule and run. Verify that missing output creates an actionable failure instead of an empty-success report. Retain the accepted manifest and file list alongside the resulting analysis for later reconciliation.

\n

Official references

\n

Microsoft Learn: Azure Storage blob inventory. Source retrieved September 9, 2026.

", "content_text": "Source facts\nBlobInventoryPolicyCompleted can be raised for a run that fails before processing begins, such as an invalid policy or missing destination container. The event name alone therefore does not establish a successful report.\nMicrosoft says generation of the checksum file marks completion of a rule run. That checksum covers the manifest, which describes the rule’s generated inventory files. A large inventory can produce multiple report files. Microsoft Learn.\nApplicability\nIdentify the inventory rule, destination and downstream consumer. Decide which run and rule definition the consumer expects; do not substitute a report left by an earlier run when current output is missing.\nDSE recommendation\nDSE recommends a report-acceptance step that checks the event outcome, corresponding manifest and checksum, and the expected set of output files. Record a failed or incomplete run as such and keep dependent analysis on hold. Avoid selecting the first matching CSV or Parquet file and silently treating it as the whole inventory.\nVerification\nTest the consumer against a successful run, a documented pre-run failure scenario and a run represented by multiple files. Confirm it associates all evidence with the correct rule and run. Verify that missing output creates an actionable failure instead of an empty-success report. Retain the accepted manifest and file list alongside the resulting analysis for later reconciliation.\nOfficial references\nMicrosoft Learn: Azure Storage blob inventory. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nBlobInventoryPolicyCompleted can be raised for a run that fails before processing begins, such as an invalid policy or missing destination container. The event name alone therefore does not establish a successful report.\n\nMicrosoft says generation of the checksum file marks completion of a rule run. That checksum covers the manifest, which describes the rule’s generated inventory files. A large inventory can produce multiple report files. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/blobs/blob-inventory).\n\n## Applicability\n\nIdentify the inventory rule, destination and downstream consumer. Decide which run and rule definition the consumer expects; do not substitute a report left by an earlier run when current output is missing.\n\n## DSE recommendation\n\nDSE recommends a report-acceptance step that checks the event outcome, corresponding manifest and checksum, and the expected set of output files. Record a failed or incomplete run as such and keep dependent analysis on hold. Avoid selecting the first matching CSV or Parquet file and silently treating it as the whole inventory.\n\n## Verification\n\nTest the consumer against a successful run, a documented pre-run failure scenario and a run represented by multiple files. Confirm it associates all evidence with the correct rule and run. Verify that missing output creates an actionable failure instead of an empty-success report. Retain the accepted manifest and file list alongside the resulting analysis for later reconciliation.\n\n## Official references\n\n[Microsoft Learn: Azure Storage blob inventory](https://learn.microsoft.com/en-us/azure/storage/blobs/blob-inventory). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event/", "url": "https://update.dsesecurity.com/updates/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Validate Blob inventory output before accepting its completion event", "item": "https://update.dsesecurity.com/updates/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event/", "url": "https://update.dsesecurity.com/updates/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event/", "headline": "Validate Blob inventory output before accepting its completion event", "description": "Distinguish an inventory event from a usable report and account for all files named in the manifest.", "abstract": "Distinguish an inventory event from a usable report and account for all files named in the manifest.", "articleBody": "Source facts\nBlobInventoryPolicyCompleted can be raised for a run that fails before processing begins, such as an invalid policy or missing destination container. The event name alone therefore does not establish a successful report.\nMicrosoft says generation of the checksum file marks completion of a rule run. That checksum covers the manifest, which describes the rule’s generated inventory files. A large inventory can produce multiple report files. Microsoft Learn.\nApplicability\nIdentify the inventory rule, destination and downstream consumer. Decide which run and rule definition the consumer expects; do not substitute a report left by an earlier run when current output is missing.\nDSE recommendation\nDSE recommends a report-acceptance step that checks the event outcome, corresponding manifest and checksum, and the expected set of output files. Record a failed or incomplete run as such and keep dependent analysis on hold. Avoid selecting the first matching CSV or Parquet file and silently treating it as the whole inventory.\nVerification\nTest the consumer against a successful run, a documented pre-run failure scenario and a run represented by multiple files. Confirm it associates all evidence with the correct rule and run. Verify that missing output creates an actionable failure instead of an empty-success report. Retain the accepted manifest and file list alongside the resulting analysis for later reconciliation.\nOfficial references\nMicrosoft Learn: Azure Storage blob inventory. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:28:14+00:00", "dateModified": "2026-09-10T01:20:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Validate Blob inventory output before accepting its completion event" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 225, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Azure Storage blob inventory | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/blob-inventory" } } ] } }