3.4 Backup and Restore

3.4.1 Virtual Machine Snapshots#

For the central Guardpot appliance deployed as a VMware virtual machine (see Section 1.1), VMware's native snapshot functionality provides a full-system backup mechanism. Take regular snapshots according to your organization's disaster recovery policy, particularly before performing system updates (see Section 3.3).

3.4.2 Session Snapshot for Forensic Preservation#

Within the G-Hosts management interface, an automated forensic preservation feature is available. When adding a new G-Host (see Section 2.2.7.1), the Session Snapshot option can be enabled. When enabled, a snapshot of the virtual machine disk is automatically captured after each attacker session. The most recent snapshot for each session is retained and available for download from the forensic investigation interface.

3.4.3 Data Export for Off-System Backup#

The Export module (see Section 2.13) enables data extraction for external storage and integration with SIEM/SOAR platforms. Each export generates a unique API key, allowing automated, scheduled extraction of Guardpot data to external backup systems.