Image Metadata

contextual information associated with a virtual machine image, such as its name, resource group, status (active or inactive), type (custom or prebuilt), size, creation date, and permissions. This metadata is critical for understanding the state and configuration of virtual machine images in cloud environments. Examples:

  • Azure Compute Service Image Metadata Example:
    • Name: MyCustomImage
    • Resource Group: MyResourceGroup
    • State: Available
    • Type: Managed Image
  • AWS EC2 AMI Metadata Example:
    • Image ID: ami-1234567890abcdef0
    • Name: ProdImage
    • State: Available
    • Platform: Windows
  • Google Cloud Compute Engine Image Metadata Example:
    • Image Name: webserver-image
    • Project: my-project-id
    • Family: webserver
    • Source Disk: my-disk-id
  • VMware vSphere Template Metadata Example:
    • Name: LinuxTemplate
    • Disk Size: 40GB
    • Network Adapter: VM Network

This data component can be collected through the following measures:

Cloud Platform-Specific Tools

  • Azure:
    • Use Azure CLI to query metadata: az image show --name MyCustomImage --resource-group MyResourceGroup
  • AWS:
    • Use AWS CLI to describe AMI metadata: aws ec2 describe-images --image-ids ami-1234567890abcdef0
  • Google Cloud:
    • Use Google Cloud SDK to retrieve image metadata: gcloud compute images describe webserver-image

APIs

  • Azure: GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Compute/images/{imageName}
  • AWS: DescribeImages API.
  • Google Cloud: GET https://compute.googleapis.com/compute/v1/projects/{project}/global/images/{image}.

Cloud Management Portals

  • View metadata directly from the cloud provider's management console or dashboard.

SIEM Integration

  • Aggregate metadata into SIEM platforms for centralized monitoring:
ID: DC0028
Domains: Enterprise
Version: 2.0
Created: 20 October 2021
Last Modified: 21 October 2025

Log Sources

Name Channel
docker:events docker.events.json
esxi:vmkernel VMX startup messages without associated vCenter inventory records
kubernetes:apiserver Resource creation and update logs

Detection Strategy