Object storage has become the digital attic of the modern enterprise. Everything seems to end up there: AI training datasets, backups, application data, media files, compliance archives, and occasionally that one mysterious file nobody remembers creating but is suddenly business critical. As organizations continue to rely on S3-compatible storage platforms such as NetApp StorageGRID, the challenge is no longer simply storing data. The challenge is understanding what is moving into and out of those repositories, and whether any of it poses a risk.
In this article, I’ll bring together three well-known technology leaders to address exactly that challenge. NetApp StorageGRID provides the scalable S3 object storage platform, F5 BIG-IP serves as a high-speed secure reverse proxy and traffic intelligence layer in front of it, and OPSWAT delivers deep inspection and threat analysis capabilities. Individually, each product solves an important problem. Together, they create a powerful solution that provides visibility not only into who is accessing object storage and what data is being transferred, but also whether that data can be trusted.
Anatomy of a Secure S3 Pipeline
A new lab environment for this article was created; the idea was to double-click on protecting a NetApp StorageGRID cluster from risky uploaded content. Using the F5 SSL Orchestrator module, a decrypted copy of all S3 traffic is provided to an OPSWAT Network Detection and Response (NDR) appliance for analysis. The NDR platform can identify the files traversing the environment and, when integrated with OPSWAT MetaDefender Cloud, submit those payloads for inspection by multiple anti-malware engines.
The result is a practical architecture that transforms object storage traffic from a blind spot into a rich source of operational and security intelligence. Think of it as giving your S3 environment an airport security checkpoint, except every suitcase is inspected by a team of experts rather than a single scanner. Many of the products are offered as purpose-built appliances, however the lab steered towards virtualization for ease of setup. Also, OPSWAT MetaDefender Core, the co-located on-premises approach to malware scanning could be harnessed for those choosing to have analysis localized.
Finally, alternative designs exist, such as utilizing BIG-IP SSL Orchestrator as an ICAP client to leverage OPSWAT malware scanning. This allows a “wait-and-see” approach to security, where incoming client S3 delivered content is not proxied to the storage array until a definitive ICAP response is generated, indicating if malware was detected. The choice in this lab was to instead pursue the utmost in high speed delivery performance, as such the BIG-IP streams decrypted traffic to the network detection appliance and moves data into the storage tier. If signs of malware are detected the NetOps/SecOps team is immediately alerted and content removal is conducted. This allows the S3 data delivery to be executed at the most demanding of performance expectations.
From Load Balancer to Security Sensor
In many S3 deployments, the BIG-IP is already there and is well accepted an industry standard, a virtual server fronting a large cluster with advanced load balancing, like “Least Connections” and the immediate removal of unhealthy nodes if needed. What we are actually doing with this exercise is turning that, the well understood foundation, into something even more powerful. We are adding eyes into the data path. This is the traditional BIG-IP view of a virtual server, in this case configured to handle NetApp StorageGRID at one single endpoint, encrypted on TCP port 18082, for clients to terminate upon.
The ease of adding TLS visibility in this case is we can use the streamlined SSL Orchestrator and it’s “Guided Configuration” web form to simply act upon the intercepted TLS traffic. In this case, we just point the configuration to an “Existing Application”.
As depicted in the screenshot, a simple use case might be two BIG-IP interfaces carrying decrypted traffic to corporate tools, on the left possibilities existing analytics tools or perhaps billing solutions. On the right, the ability to have another decrypted tap feeding our security stack, in this case the OPSWAT MetaDefender NDR appliance.
The SSL Orchestrator is a rich and capable solution, it can support various deployments including transparent forward proxy mode to capture outbound corporate traffic, to name just one. It can also support a wealth of security tools, including handing traffic off to an IDS/IPS solution and taking back processed traffic for actual delivery. Perhaps the most powerful aspect, multiple topologies and multiple active tool integrations can all be carried out concurrently.
Lastly, beyond being a high-performance load balancer, and now a tool integration mechanism, the SSL Orchestrator also has a clean, almost utilitarian view of the traffic on your network. In this example, in one screen, we see the ratio of TLS 1.2 to new TLS 1.3 traffic, and the presence of different cipher suites live on our network.
In short, the load balancer has not only become a security sensor, but really a traffic cop of sorts, directing your rich decrypted traffic to your most important tools.
Every Object Gets a Background Check
While the F5 BIG-IP SSL Orchestrator provides the visibility into the NetApp S3 traffic in flight, the OPSWAT MetaDefender NDR platform is where that visibility becomes actionable intelligence. Positioned directly in the path of the decrypted S3 traffic stream, MetaDefender NDR continuously analyzes high-speed network traffic and extracts rich metadata about the files and transactions traversing the storage environment.
Rather than simply reporting that traffic exists in simple bits and bytes, it provides more detailed insight into what is actually moving through the network, including files transferred over S3. At the same time, the platform continuously monitors for thousands of different behavioral and security indicators, helping security teams identify suspicious activity that might otherwise remain hidden inside encrypted traffic flows.
The real magic happens when the visibility capabilities unleashed through the BIG-IP SSL Orchestrator are combined with the file content inspection capabilities of the OPSWAT platform. Because SSL Orchestrator provides a decrypted copy of the traffic, MetaDefender NDR can see far more than it could from encrypted packet streams alone. It is here where the requisite importance of having a solution to inspect TLS traffic is usually inserted. In 2026 it’s estimated that 95 percent of all global web traffic in TLS encrypted, according to Google telemetry the number is now above 99 percent for public sites.
Even with TLS being pervasive, S3 objects from the decrypted stream can be identified, analyzed, and, when desired, submitted to OPSWAT MetaDefender Cloud for additional scrutiny. MetaDefender Cloud evaluates file contents against a large collection of anti-malware engines and threat intelligence sources, effectively giving every uploaded object its own security screening process. The result is a solution that not only shows which files are entering and leaving your object storage environment, but also helps answer the more important question: “Should that file really be there?”
Here is the starting dashboard for a typical MetaDefender NDR setup, it quickly delivers, at a glance, both a “Who’s Talking to Who?” snapshot and also the prevalent security signature matches in that traffic.
This lab investigation was laser focused upon S3 protective measures, as such S3 client traffic was driven between a sample host and the NetApp StorageGRID offering. By pivoting to an OPSWAT NDR “Hunt Screen” we can quickly determine key information around the S3 story from a single source of truth, the actual packets on the wire.
We observe that both the object names sent or retrieved from buckets automatically were listed, including the respective file sizes. Note that traffic is using the well-known NetApp S3 TCP port of 18082. For transactions exclusively referencing buckets names, without no objects in the filename, this corresponds to control-plane S3 actions, such as “S3: ListBucket” where the user has received back an object list of a bucket’s contents.
Double-clicking on the particular objects that were retrieved, highlighted in red above, perhaps the most valuable S3-specfic feature is seen. In two cases, files in flight were scanned by an OPSWAT curated list of varying malware engines. This can be done locally, with a MetaDefender Core instance or, as in this lab setup, a SaaS solution MetaDefender Cloud was harnessed.
We observe that one file, putty.exe was scanned and found to be innocuous, while another file, the well-known antivirus test pattern eicar.txt was flagged as “infected”.
Tests were conducted using eicar patterns embedded in Acrobat, Excel, and PowerPoint formats, along with zipped offerings. All were successfully identified. The advantage of eicar testing, initially, is the objects are not actually malware but test triggers that anti-virus engines should always flag, without exception.
For those interested in deeper security testing, perhaps zero-day samples of new content, various sources of test malware are readily available. Popular sources to search for are “TheZoo” and “MalwareBazaar”. This can be particularly interesting when pattern matching is only one step in complete path to safety. Advanced testing could include executables, such a PE32 or PE32+ binary in flight, where a sandbox offering can detonate the content and observe the resulting behavior for malicious indicators.
From Lab to Production – Needles, Please, not Haystacks
A likely case for an enterprise is to protect their storage solution, such as StorageGRID, with particular attention towards uploaded malicious content, even inadvertently, direct into the object store. To this end, a focused AV engine “hit” screen is updated in real-time on the NDR console, to alert SecOps of newly detected infractions.
We observe with this screen, the operator is only alerted to S3 objects that triggered detection by one of the many malware engines invoked, all other potential noise is removed from the view.
To dive deeper into the analysis, one can jump to the on-line portal for MetaDefender Cloud (www.metadefender.com), in air gapped or other high security environments, this analysis can be done on a co-located server.
Drilling into one of the blocked files, in this case a PowerPoint file, the user is presented with richly detail around what was found.
From this example, important information to take away is that of the 23 antivirus engines harnessed, 9 agreed that the content was malicious. As well, the date stamp of the inspection and importantly the duration, in this case 92 milliseconds, are clearly displayed.
Turning Object Storage Into Security Intelligence
The explosive growth of S3-compatible object storage has quickly transformed platforms such as NetApp StorageGRID into mission-critical repositories for enterprise applications. AI datasets, backups, archives, and business content; it’s all there. TLS encryption is essential for protecting data in transit, it can also create blind spots where malicious content hides in plain sight. This article demonstrated how F5 BIG-IP, NetApp StorageGRID, and OPSWAT technologies can work together to solve that challenge. By leveraging BIG-IP SSL Orchestrator as a transparent inspection point, organizations can maintain the benefits of encrypted communications while still gaining deep insight into the objects entering and leaving their storage environments.
MetaDefender NDR is all about speed, it provides detailed intelligence about files traversing the network as the burden of decryption is handled by BIG-IP. The NDR generates alerts when suspicious or malicious content is detected. Security teams can then pivot directly into MetaDefender Cloud for additional analysis and review the specific files that triggered detections across multiple anti-malware engines. The result is an architecture that helps organizations move from simply storing data to actively understanding and protecting it.