contextual information associated with a virtual machine image, such as its name, resource group, status (active or inactive), type (custom or prebuilt), size, creation date, and permissions. This metadata is critical for understanding the state and configuration of virtual machine images in cloud environments. Examples:
This data component can be collected through the following measures:
Cloud Platform-Specific Tools
az image show --name MyCustomImage --resource-group MyResourceGroupaws ec2 describe-images --image-ids ami-1234567890abcdef0gcloud compute images describe webserver-image APIs
GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/images/{imageName}DescribeImages API.GET https://compute.googleapis.com/compute/v1/projects/{project}/global/images/{image}.Cloud Management Portals
SIEM Integration
| Name | Channel |
|---|---|
| docker:events | docker.events.json |
| esxi:vmkernel | VMX startup messages without associated vCenter inventory records |
| kubernetes:apiserver | Resource creation and update logs |