Assets we investigate.

Pursuit / Hunt

Pursuit investigates EC2 system snapshots and AMIs. Hunt inspects workload data, including ECS and EKS data; this is not container runtime monitoring.

Pursuit / Hunt

Pursuit investigates supported system snapshots. Hunt inspects data in EBS volumes and snapshots.

Hunt

Inspect S3 object content for ransomware and malware.

Hunt

Inspect files in EFS, FSx for NetApp ONTAP, and FSx for Windows File Server.

Hunt

Inspect accessible AWS DRS replicas and SnapMirror targets and review their analysis history.

Hunt

Inspect recovery copies from AWS Backup, including logically air-gapped vault and restore-test workflows.

Pursuit / Hunt

Pursuit investigates Azure VM system snapshots. Hunt inspects VM data and recovery copies.

Pursuit / Hunt

Pursuit investigates supported system snapshots. Hunt inspects Azure Managed Disks and snapshot contents.

Hunt

Inspect blob contents for ransomware and malware. Hot, Cool, and Archive access follows the applicable retrieval requirements.

Hunt

Inspect Azure Files shares and accessible share snapshot contents.

Hunt

Inspect accessible replicated data from Azure Site Recovery and geo-redundant storage.

Hunt

Inspect Azure Backup recovery copies and compare analysis results over time.

Pursuit / Hunt

Pursuit investigates supported Windows VMware snapshots for evidence of compromise. Hunt analyzes snapshot contents for ransomware, malware, and corruption. See Pursuit for operating-system scope.

Hunt

Inspect VM recovery points through your Veeam connection and compare Hunt results before restoring. Source workload and backup format support follow the connection requirements.

Hunt

Inspect VM recovery points provided by Commvault and keep findings linked to the copy analyzed. Source workload and backup format support follow the connection requirements.

Hunt

Inspect DataProtect-managed recovery points for VMware and record ransomware and malware findings. Source workload and backup format support follow the connection requirements.

Hunt

Inspect Rubrik-managed VM recovery points and review analysis history before choosing a restore candidate. Source workload and backup format support follow the connection requirements.

Hunt

Inspect VM recovery points exposed by NetBackup for ransomware, malware, and corruption. Source workload and backup format support follow the connection requirements.

Hunt

Inspect IBM COS object content for ransomware and malware.

Hunt

Assess prior IBM COS object versions when retained and accessible. A current object alone does not provide version history.

Planned release

Compute Engine virtual machines are included in the planned Google Cloud release.

Planned release

Disk data is included in the planned launch scope. Specific disk families will be addressed during deployment planning.

Planned release

Point-in-time disk snapshots are included in the planned Google Cloud release.

Planned release

Backup data is included in the planned launch scope. Review backup connections as part of your evaluation.

Planned release

Object storage in Google Cloud Storage is included in the planned release.