What does Cloud Workload Protection for Storage use for scanning files.
Internally CWPS uses SPE which scans files based on two technologies:
1) Virus definition based - CWPS downloads virus definitions periodically. The version of the definitions can be viewed from console.
2) File insight/reputation - Additionally CWPS sends the files hash to Symantec to get the reputation of the files.