---
title: Azure snapshot export URI created
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Azure snapshot export URI created
---

# Azure snapshot export URI created
Classification:attackTactic:[TA0009-collection](https://attack.mitre.org/tactics/TA0009)Technique:[T1074-data-staged](https://attack.mitre.org/techniques/T1074) 
## Goal{% #goal %}

Detect if an Azure snapshot is exported. Export URLs generated in Azure are accessible to anyone with the URL.

## Strategy{% #strategy %}

Monitor Azure logs where `@evt.name` is `"MICROSOFT.COMPUTE/SNAPSHOTS/BEGINGETACCESS/ACTION"` and `@evt.outcome` is `Success`.

## Triage and response{% #triage-and-response %}

1. Verify the snapshot (`@resourceId`) has a legitimate reason for being exported.
1. If the activity is not expected, investigate the activity around the IP (`{{@network.client.ip}}`) creating the export URL.