Anomaly characterization using snapshots

A data management system, comprising:

• one or more memories;
• and
• one or more processors, wherein the one or more memories store code comprising instructions executable, individually or collectively, by the one or more processors to cause the data management system to:
• detect, based at least in part on an analysis of one or more snapshots of computing objects within a computing system, an anomaly in data of the computing system, wherein the computing system comprises a plurality of computing objects;
• compare, based at least in part on detecting the anomaly, first data associated with a first snapshot of a first computing object of the plurality of computing objects with second data associated with a second snapshot of a second computing object of the plurality of computing objects;
• and
• determine, based at least in part on comparing the first data with the second data, whether the anomaly is associated with desirable activity in the computing system.

A non-transitory, computer-readable medium storing code that comprises instructions that are executable, individually or collectively, by one or more processors of a data management system to cause the data management system to:

• detect, based at least in part on an analysis of one or more snapshots of computing objects within a computing system, an anomaly in data of the computing system, wherein the computing system comprises a plurality of computing objects;
• compare, based at least in part on detecting the anomaly, first data associated with a first snapshot of a first computing object of the plurality of computing objects with second data associated with a second snapshot of a second computing object of the plurality of computing objects;
• and
• determine, based at least in part on comparing the first data with the second data, whether the anomaly is associated with desirable activity in the computing system.