LoFP LoFP / snapshot consolidation after backups, storage pressure, and planned decommissioning can remove every snapshot for a vm. confirm the account and whether the command ran against one vm or every vm.

Techniques

Sample rules

ESXi Virtual Machine Snapshot Removed

Description

Detects removal of all snapshots for an ESXi virtual machine. Snapshots are on-host recovery points for a guest. Removing all of them deletes those recovery points, so the virtual machine cannot be reverted to an earlier disk state.

Detection logic

data_stream.dataset: "vsphere.log" and (
  message: "snapshot.removeall"
)