Skip to content

DS0020 Snapshot

A point-in-time copy of cloud volumes (files, settings, etc.) that can be created and/or deployed in cloud environments12

Item Value
ID DS0020
Platforms IaaS
Collection Layers Cloud Control Plane
Version 1.0
Created 20 October 2021
Last Modified 10 November 2021

Data Components

Snapshot Creation

Initial construction of a new snapshot (ex: AWS create-snapshot)

Domain ID Name
enterprise T1578 Modify Cloud Compute Infrastructure
enterprise T1578.001 Create Snapshot
enterprise T1537 Transfer Data to Cloud Account

Snapshot Deletion

Removal of a snapshot (ex: AWS delete-snapshot)

Domain ID Name
enterprise T1485 Data Destruction
enterprise T1490 Inhibit System Recovery
enterprise T1578 Modify Cloud Compute Infrastructure

Snapshot Enumeration

An extracted list of snapshops within a cloud environment (ex: AWS describe-snapshots)

Domain ID Name
enterprise T1580 Cloud Infrastructure Discovery

Snapshot Metadata

Contextual data about a snapshot, which may include information such as ID, type, and status

Domain ID Name
enterprise T1578 Modify Cloud Compute Infrastructure
enterprise T1578.001 Create Snapshot
enterprise T1537 Transfer Data to Cloud Account

Snapshot Modification

Changes made to a snapshop, such as metadata and control data (ex: AWS modify-snapshot-attribute)

Domain ID Name
enterprise T1578 Modify Cloud Compute Infrastructure
enterprise T1537 Transfer Data to Cloud Account

References

  1. Microsoft. (2021, September 16). Create a snapshot of a virtual hard disk. Retrieved October 13, 2021. ↩

  2. Amazon. (n.d.). Amazon EBS snapshots. Retrieved October 13, 2021. ↩

  3. Amazon. (2020). Logging AWS Backup API Calls with AWS CloudTrail. Retrieved April 27, 2020. ↩

  4. Google. (2020, April 23). Creating and Starting a VM instance. Retrieved May 1, 2020. ↩

  5. Google. (n.d.). Audit Logs. Retrieved June 1, 2020. ↩

  6. Microsoft. (2019, June 4). Monitor at scale by using Azure Monitor. Retrieved May 1, 2020. ↩