Bulk snapshot recovery

1 . A method, comprising:

performing, by a data management system, a malware scan to scan for malware within a plurality of respective sets of snapshots of a plurality of computing objects of a computing system;

updating, by the data management system based at least in part on a result of the malware scan, a data structure comprising a plurality of entries storing metadata for the plurality of respective sets of snapshots of the plurality of computing objects of the computing system, wherein the plurality of respective sets of snapshots comprises a respective set of multiple snapshots for each computing object included in the plurality of computing objects and wherein updating the data structure comprises:

updating respective metadata stored in first respective entries of the plurality of entries for a first set of snapshots included in the plurality of respective sets of snapshots to indicate that snapshots in the first set of snapshots are anomalous based at least in part on detection of the malware in the first set of snapshots during the malware scan;

receiving, by the data management system, a request to restore the plurality of computing objects, the request indicating a recovery time range, and the data management system storing the plurality of respective sets of snapshots and the metadata for the plurality of respective sets of snapshots;

filtering, by the data management system, the plurality of entries of the data structure to obtain a subset of entries associated with a second set of snapshots from among the plurality of respective sets of snapshots that are available for restoring two or more computing objects of the plurality of computing objects, wherein the subset of entries is obtained via the filtering based at least in part on second respective entries of the subset of entries for the second set of snapshots indicating that respective creation times of the second set of snapshots satisfy the recovery time range and further based at least in part on the second set of snapshots being exclusive of the first set of snapshots that are indicated by the first respective entries as being anomalous; and

indicating, by the data management system, at least two snapshots from among the second set of snapshots, the at least two snapshots comprising at least one respective snapshot for each of the two or more computing objects that are available for restoring the two or more computing objects.

2 . The method of claim 1 , wherein the metadata for the plurality of respective sets of snapshots comprises creation time information, expiration time information, anomalous state information, encryption information, quarantine information, target identification information, or any combination thereof for the plurality of respective sets of snapshots.

3 . The method of claim 1 , further comprising:

generating, for a computing object of the plurality of computing objects, a snapshot of the plurality of respective sets of snapshots; and

updating the data structure to include an entry for the snapshot, the entry comprising first respective metadata for the snapshot, and the first respective metadata for the snapshot including a creation time, an expiration time, a target identifier, or any combination thereof.

4 . The method of claim 3 , further comprising:

determining whether the snapshot is anomalous based at least in part on performing the malware scan; and

updating the first respective metadata of the entry for the snapshot to include an indication of whether the snapshot is anomalous.

5 . The method of claim 3 , further comprising:

performing, based at least in part on generating the snapshot, a quarantine operation for the snapshot; and

updating the first respective metadata of the entry for the snapshot to include an indication that the snapshot is quarantined.

6 . The method of claim 1 , wherein filtering the data structure comprises:

filtering, based at least in part on a current date, the plurality of entries to obtain the subset of entries associated with a subset of snapshots that are valid, wherein each snapshot of the second set of snapshots is included in the subset of snapshots that are valid and has respective expiration date metadata indicating an expiration date that occurs after the current date.

7 . The method of claim 1 , wherein filtering the data structure comprises:

filtering the plurality of entries to obtain the subset of entries associated with a subset of snapshots that are in a nominal state, wherein each snapshot of the second set of snapshots is included in the subset of snapshots that are in the nominal state and has respective operating status metadata indicating a nominal status.

8 . The method of claim 1 , wherein filtering the data structure comprises:

filtering the plurality of entries to obtain the subset of entries associated with a subset of snapshots that are in an unquarantined state, wherein each snapshot of the second set of snapshots is included in the subset of snapshots that are in the unquarantined state and has respective quarantine status metadata indicating an unquarantined status.

9 . The method of claim 1 , further comprising:

identifying, for a computing object of at least the two or more computing objects, one or more snapshots in the plurality of respective sets of snapshots that are available for restoring; and

selecting, for the computing object, a snapshot of the one or more snapshots with a most recent creation date for restoring the computing object, wherein indicating the at least two snapshots comprises indicating the selected snapshot.

10 . The method of claim 1 , further comprising:

indicating, for a second subset of the plurality of computing objects, a lack of available snapshots for restoring the second subset of the plurality of computing objects.

11 . The method of claim 10 , further comprising:

receiving, in response to indicating the lack of available snapshots, a second request to restore the computing system, the second request associated with a second time range that is different than the recovery time range associated with the request.

12 . The method of claim 10 , further comprising:

receiving, in response to indicating the lack of available snapshots, a selection of respective snapshots for the second subset of the plurality of computing objects.

13 . The method of claim 1 , further comprising:

receiving, via a user interface, a selection to restore all of the two or more computing objects associated with the at least two snapshots; and

restoring, in response to the selection, all of the two or more computing objects associated with the at least two snapshots to the computing system.

14 . The method of claim 1 , further comprising:

receiving, via a user interface, a selection of one or more snapshots of the at least two snapshots indicated for restoring one or more of the two or more computing objects; and

restoring, in response to the selection, the one or more of the two or more computing objects to the computing system using the selected one or more snapshots.

15 . An apparatus, comprising:

a processor; and

a memory storing instructions that, when executed by the processor, cause the apparatus to:

perform, by a data management system, a malware scan to scan for malware within a plurality of respective sets of snapshots of a plurality of computing objects of a computing system;

update, by the data management system based at least in part on a result of the malware scan, a data structure comprising a plurality of entries storing metadata for the plurality of respective sets of snapshots of the plurality of computing objects of the computing system, wherein the plurality of respective sets of snapshots comprises a respective set of multiple snapshots for each computing object included in the plurality of computing objects, and wherein, to update the data structure, the instructions, when executed by the processor, cause the apparatus to:

update respective metadata stored in first respective entries of the plurality of entries for a first set of snapshots included in the plurality of respective sets of snapshots to indicate that snapshots in the first set of snapshots are anomalous based at least in part on detection of the malware in the first set of snapshots during the malware scan;

receive, by the data management system, a request to restore the plurality of computing objects, the request indicating a recovery time range, and the data management system storing the plurality of respective sets of snapshots and the metadata for the plurality of respective sets of snapshots;

filter, by the data management system, the plurality of entries of the data structure to obtain a subset of entries associated with a second set of snapshots from among the plurality of respective sets of snapshots that are available for restoring two or more computing objects of the plurality of computing objects, wherein the subset of entries is obtained via the filtering based at least in part on second respective entries of the subset of entries for the second set of snapshots indicating that respective creation times of the second set of snapshots satisfy the recovery time range and further based at least in part on the second set of snapshots being exclusive of the first set of snapshots that are indicated by the first respective entries as being anomalous; and

indicate, by the data management system, at least two snapshots from among the second set of snapshots, the at least two snapshots comprising at least one respective snapshot for each of the two or more computing objects that are available for restoring the two or more computing objects.

16 . The apparatus of claim 15 , wherein the instructions are further executable by the processor to cause the apparatus to:

store creation time information, expiration time information, anomalous state information, quarantine information, target identification information, or any combination thereof for the plurality of respective sets of snapshots.

17 . The apparatus of claim 15 , wherein the instructions are further executable by the processor to cause the apparatus to:

generate, for a computing object of the plurality of computing objects, a snapshot of the plurality of respective sets of snapshots; and

update the data structure to include an entry for the snapshot, the entry comprising first respective metadata for the snapshot, and the first respective metadata for the snapshot including a creation time, an expiration time, a target identifier, or any combination thereof.

18 . A non-transitory, computer-readable medium storing code comprising instructions executable by a processor of a device to cause the device to:

perform, by a data management system, a malware scan to scan for malware within a plurality of respective sets of snapshots of a plurality of computing objects of a computing system;

update, by the data management system based at least in part on a result of the malware scan, a data structure comprising a plurality of entries storing metadata for the plurality of respective sets of snapshots of the plurality of computing objects of the computing system, wherein the plurality of respective sets of snapshots comprises a respective set of multiple snapshots for each computing object included in the plurality of computing objects, and wherein, to update the data structure, the instructions are executable by the processor of the device to cause the device to:

update respective metadata stored in first respective entries of the plurality of entries for a first set of snapshots included in the plurality of respective sets of snapshots to indicate that snapshots in the first set of snapshots are anomalous based at least in part on detection of the malware in the first set of snapshots during the malware scan;

receive, by the data management system, a request to restore the plurality of computing objects, the request indicating a recovery time range, and the data management system storing the plurality of respective sets of snapshots and the metadata for the plurality of respective sets of snapshots;

filter, by the data management system, the plurality of entries of the data structure to obtain a subset of entries associated with a second set of snapshots from among the plurality of respective sets of snapshots that are available for restoring two or more computing objects of the plurality of computing objects, wherein the subset of entries is obtained via the filtering based at least in part on second respective entries of the subset of entries for the second set of snapshots indicating that respective creation times of the second set of snapshots satisfy the recovery time range and further based at least in part on the second set of snapshots being exclusive of the first set of snapshots that are indicated by the first respective entries as being anomalous; and

indicate, by the data management system, at least two snapshots from among the second set of snapshots, the at least two snapshots comprising at least one respective snapshot for each of the two or more computing objects that are available for restoring the two or more computing objects.

19 . The non-transitory, computer-readable medium of claim 18 , wherein the instructions are further executable by the processor to cause the device to:

store creation time information, expiration time information, anomalous state information, quarantine information, target identification information, or any combination thereof for the plurality of respective sets of snapshots.

20 . The apparatus of claim 17 , wherein the instructions are further executable by the processor to cause the apparatus to:

determine whether the snapshot is anomalous based at least in part on performing the malware scan; and

update the first respective metadata of the entry for the snapshot to include an indication of whether the snapshot is anomalous.