Project Name
Salesforce Files Had Zero Malware Scanning; Dual-Engine ClamAV and Sophos Fixed It
A large technology-enabled services organisation operating across multiple geographies managed high volumes of customer and partner documents within Salesforce. Thousands of file uploads daily – contracts, compliance forms, and sensitive account attachments – were processed with zero real-time virus or malware scanning. With regulatory audits tightening and a growing threat landscape, the organisation needed an enterprise-grade solution that could inspect every file at upload without degrading user experience or disrupting existing Salesforce workflows. Applying its AI-First approach, Ksolves designed a trigger-driven, dual-engine file scanning architecture embedded within Salesforce that intercepts every file upload, routes it through both ClamAV and Sophos in parallel, and enforces a quarantine-or-release decision before the file becomes accessible to any other user.
- Zero Malware Protection at Upload: Salesforce natively provides no antivirus scanning for files stored in its Content or Attachment objects, leaving the organisation blind to embedded malware, ransomware payloads, and macro-laced documents.
- Dual-Engine Requirement: Security policy mandated both open-source (ClamAV) and commercial (Sophos) scanning engines to be active simultaneously, requiring orchestration logic to reconcile results across two distinct APIs.
- Performance at Scale: Thousands of file events per day meant the scanning pipeline had to be asynchronous, non-blocking, and capable of completing in near real-time without triggering Salesforce governor limits.
- Quarantine and Notification Workflow: Infected files needed to be instantly quarantined, the uploading user notified, and the security team alerted within the Salesforce platform using native automation.
- False Positive Management: ClamAV and Sophos can disagree in edge cases. The system needed a tiebreaker policy and an admin-override workflow to prevent legitimate files from being permanently blocked.
- Audit Trail and Compliance Logging: Every scan result - pass, fail, or inconclusive - had to be recorded in a structured object with timestamp, engine version, signature hash, and resolution action for SOC audit readiness.
Ksolves designed a trigger-driven, dual-engine file scanning architecture embedded within Salesforce that intercepts every ContentVersion insert, routes the file through both ClamAV and Sophos in parallel, and enforces a quarantine-or-release decision before the file becomes accessible to other users. The governing principle was zero-trust at the content layer: no file is clean until both engines confirm it.
- Apex Trigger on ContentVersion: An after-insert Apex trigger captures every new file upload and enqueues a Queueable job with the ContentDocumentId, bypassing synchronous processing limits and enabling retry-safe execution.
- ClamAV Integration via REST: A secure callout transmits the file binary to a ClamAV daemon deployed on a hardened EC2 instance. The response includes scan result, virus signature name if found, and engine version for logging.
- Sophos Intelix API Integration: Files are submitted in parallel to the Sophos Intelix cloud API for ML-enhanced static and dynamic analysis, returning a threat score and verdict used alongside the ClamAV result.
- threat score and verdict used alongside the ClamAV result. Consensus Engine and Quarantine Logic: A consensus class evaluates both verdicts. A single INFECTED result from either engine triggers immediate quarantine by setting a custom ContentVersion field and revoking sharing permissions via ContentDocumentLink deletion.
- Automated Notifications and Escalation: Flow-based automation triggers on the quarantine field, sending a real-time email to the uploading user and a Chatter post to the security team with file metadata and engine verdicts.
- Scan Result Custom Object: A custom object records every scan event with engine name, verdict, signature, file hash (SHA-256), timestamp, and admin action taken, enabling full SOC-ready audit reporting.
Technology Stack
| Category | Technology |
|---|---|
| CRM Platform | Salesforce |
| Antivirus Engine | ClamAV |
| Commercial AV | Sophos Intelix |
| Platform Logic | Apex / Queueable Jobs |
| Automation | Salesforce Flow |
| Infrastructure | AWS EC2 |
- File Scan Coverage From 0% to 100%: Every new file upload to Salesforce is now scanned by both ClamAV and Sophos before becoming accessible to any other user. Zero antivirus coverage replaced with dual-engine coverage on 100% of uploads.
- Infected Files Quarantined in Under 30 Seconds: The asynchronous Queueable pipeline completes both engine scans and enforces quarantine within under 30 seconds of upload. Infected files are access-revoked before any other user can open or download them.
- Dual-Engine Consensus Reduces False Negatives: Sophos ML layer flags polymorphic payloads missed by ClamAV signature matching. Dual-engine consensus reduces undetected threat risk compared to any single-engine approach.
- SOC-Ready Audit Trail on Every File Event: Every scan event logged with SHA-256 hash, engine version, verdict, and resolution action. Fully queryable for compliance audits and SOC reporting without manual log compilation.
- Zero User Experience Degradation: Asynchronous Queueable execution ensures file uploads complete at normal speed. Scanning runs in the background without blocking the upload interaction or triggering governor limit errors.
“Every file uploaded to our Salesforce environment was a blind spot. Contracts, compliance forms, partner attachments – none of it was scanned. Ksolves closed that gap with a dual-engine pipeline that runs invisibly on every upload and quarantines threats before anyone else can touch them. The audit trail alone justified the investment.”
– CISO / Head of Information Security.
A large technology services organisation uploading thousands of files daily to Salesforce with zero antivirus coverage, no quarantine capability, and no audit trail was transformed through Ksolves Salesforce consulting services. A dual-engine ClamAV and Sophos scanning pipeline now intercepts every ContentVersion upload, runs both engines in parallel, enforces quarantine in under 30 seconds, and logs every scan event with SHA-256 hash and full resolution history. File scan coverage moved from 0% to 100%. The architecture is extensible to additional scanning engines, DLP rules, and cross-object file types as the organisation’s security posture matures.
Is Your Salesforce Content Layer Protected From Malware Hidden in Uploaded Files?
