Investigation procedures for virtual machines

1. A method, comprising:

receiving a first indication to initiate an investigation procedure for a plurality of virtual machines hosted in a first environment;

receiving a second indication of a selection of a plurality of sets of virtual machines and a corresponding plurality of snapshots for the investigation procedure, wherein the corresponding plurality of snapshots are stored in a second environment, and wherein a snapshot of the corresponding plurality of snapshots is associated with a version of a respective set of virtual machines of the plurality of sets of virtual machines;

mounting, in response to receiving the first indication and the second indication, the plurality of sets of virtual machines to a plurality of testing environments different than the first environment and the second environment, wherein the mounting uses the plurality of snapshots to provide the plurality of testing environments with query access to respective versions of the plurality of sets of virtual machines hosted in the first environment; and

performing one or more querying operations between the first environment comprising the plurality of sets of virtual machines and the plurality of testing environments as part of the investigation procedure.

2. The method of claim 1 , wherein performing the one or more querying operations comprises:

providing the plurality of testing environments access to the respective versions of the plurality of sets of virtual machines to facilitate the investigation procedure for the plurality of sets of virtual machines.

3. The method of claim 1 , further comprising:

receiving a third indication of a set of virtual machines selected for recovery from among the plurality of sets of virtual machines and a corresponding snapshot selected for the recovery from among the corresponding plurality of snapshots, wherein the set of virtual machines and the corresponding snapshot are selected for the recovery based at least in part on the investigation procedure for the plurality of sets of virtual machines; and

recovering, in response to the third indication, a respective version of the set of virtual machines to a production environment based at least in part on the corresponding snapshot stored in the second environment.

4. The method of claim 1 , further comprising:

receiving parameters for the plurality of testing environments; and

identifying the plurality of testing environments in accordance with the parameters, wherein mounting the plurality of sets of virtual machines to the plurality of testing environments is based at least in part on identifying the plurality of testing environments.

5. The method of claim 4 , further comprising:

retrieving metadata associated with the plurality of testing environments; and

validating the parameters for the plurality of testing environments based at least in part on the metadata.

6. The method of claim 1 , further comprising:

generating a recovery plan that comprises the selection of the plurality of sets of virtual machines, the selection of the corresponding plurality of snapshots, and one or more parameters associated with the plurality of testing environments, the plurality of sets of virtual machines, the corresponding plurality of snapshots, or any combination thereof; and

storing the recovery plan for subsequent investigation procedures.

7. The method of claim 6 , further comprising:

receiving a third indication to initiate a second investigation procedure; and

performing the second investigation procedure in accordance with the stored recovery plan.

8. The method of claim 1 , further comprising:

receiving, via the second indication, a set of computing resources, network resources, or both, wherein the mounting comprises using the set of computing resources, network resources, or both to mount the plurality of virtual machines to the plurality of testing environments.

9. The method of claim 1 , wherein the plurality of sets of virtual machines and the corresponding plurality of snapshots are selected in response to a ransomware attack on the plurality of sets of virtual machines.

10. The method of claim 1 , wherein the plurality of sets of virtual machines and the corresponding plurality of snapshots are selected randomly.

11. The method of claim 1 , wherein the plurality of sets of virtual machines comprise the same virtual machines, and the corresponding plurality of snapshots are associated with different point-in-time versions of the same virtual machines.

12. The method of claim 1 , wherein the plurality of testing environments comprise sandboxed environments.

13. An apparatus, comprising:

at least one processor;

memory coupled with the at least one processor; and

instructions stored in the memory and executable by the at least one processor to cause the apparatus to:

receive a first indication to initiate an investigation procedure for a plurality of virtual machines hosted in a first environment;

receive a second indication of a selection of a plurality of sets of virtual machines and a corresponding plurality of snapshots for the investigation procedure, wherein the corresponding plurality of snapshots are stored in a second environment, and wherein a snapshot of the corresponding plurality of snapshots is associated with a version of a respective set of virtual machines of the plurality of sets of virtual machines;

mount, in response to receiving the first indication and the second indication, the plurality of sets of virtual machines to a plurality of testing environments different than the first environment and the second environment, wherein the mounting uses the plurality of snapshots to provide the plurality of testing environments with query access to respective versions of the plurality of sets of virtual machines hosted in the first environment; and

perform one or more querying operations between the first environment comprising the plurality of sets of virtual machines and the plurality of testing environments as part of the investigation procedure.

14. The apparatus of claim 13 , wherein the instructions to perform the one or more querying operations are executable by the at least one processor to cause the apparatus to:

provide the plurality of testing environments access to the respective versions of the plurality of sets of virtual machines to facilitate the investigation procedure for the plurality of sets of virtual machines.

15. The apparatus of claim 13 , wherein the instructions are further executable by the at least one processor to cause the apparatus to:

receive a third indication of a set of virtual machines selected for recovery from among the plurality of sets of virtual machines and a corresponding snapshot selected for the recovery from among the corresponding plurality of snapshots, wherein the set of virtual machines and the corresponding snapshot are selected for the recovery based at least in part on the investigation procedure for the plurality of sets of virtual machines; and

recover, in response to the third indication, a respective version of the set of virtual machines to a production environment based at least in part on the corresponding snapshot stored in the second environment.

16. The apparatus of claim 13 , wherein the instructions are further executable by the at least one processor to cause the apparatus to:

receive parameters for the plurality of testing environments; and

identify the plurality of testing environments in accordance with the parameters, wherein mounting the plurality of sets of virtual machines to the plurality of testing environments is based at least in part on identifying the plurality of testing environments.

17. The apparatus of claim 13 , wherein the instructions are further executable by the at least one processor to cause the apparatus to:

generate a recovery plan that comprises the selection of the plurality of sets of virtual machines, the selection of the corresponding plurality of snapshots, and one or more parameters associated with the plurality of testing environments, the plurality of sets of virtual machines, the corresponding plurality of snapshots, or any combination thereof; and

store the recovery plan for subsequent investigation procedures.

18. A non-transitory computer-readable medium storing code, the code comprising instructions executable by at least one processor to:

receive a first indication to initiate an investigation procedure for a plurality of virtual machines hosted in a first environment;

receive a second indication of a selection of a plurality of sets of virtual machines and a corresponding plurality of snapshots for the investigation procedure, wherein the corresponding plurality of snapshots are stored in a second environment, and wherein a snapshot of the corresponding plurality of snapshots is associated with a version of a respective set of virtual machines of the plurality of sets of virtual machines;

mount, in response to receiving the first indication and the second indication, the plurality of sets of virtual machines to a plurality of testing environments different than the first environment and the second environment, wherein the mounting uses the plurality of snapshots to provide the plurality of testing environments with query access to respective versions of the plurality of sets of virtual machines hosted in the first environment; and

perform one or more querying operations between the first environment comprising the plurality of sets of virtual machines and the plurality of testing environments as part of the investigation procedure.

19. The non-transitory computer-readable medium of claim 18 , wherein the instructions to perform the one or more querying operations are executable by the at least one processor to:

provide the plurality of testing environments access to the respective versions of the plurality of sets of virtual machines to facilitate the investigation procedure for the plurality of sets of virtual machines.

20. The non-transitory computer-readable medium of claim 18 , wherein the instructions are further executable by the at least one processor to:

receive a third indication of a set of virtual machines selected for recovery from among the plurality of sets of virtual machines and a corresponding snapshot selected for the recovery from among the corresponding plurality of snapshots, wherein the set of virtual machines and the corresponding snapshot are selected for the recovery based at least in part on the investigation procedure for the plurality of sets of virtual machines; and

recover, in response to the third indication, a respective version of the set of virtual machines to a production environment based at least in part on the corresponding snapshot stored in the second environment.