Cohesity DataProtect Integration

Note: This integration requires Cisco XDR Advantage or Cisco XDR Premier licensing tier.

Integrating Cohesity DataProtect with Cisco XDR allows SOC and IT teams to automatically take a snapshot of business-critical data, early in the incident response process. Automated workflows also allow teams to rapidly recover impacted assets from recent and immutable backup snapshots.

By adding Cohesity DataHawk, analysts gain visibility into any data sensitivity information, identified by DataHawk's data classification capabilities for impacted virtual machines, and incorporate it into the scope of incident response.

  1. In the Cisco XDR navigation menu, choose Administration > Integrations.

  2. On the Integrations page, click the Third-Party tab and navigate to the Cohesity DataProtect integration.

  3. Click the plus sign (+) in the lower-right corner of the card. The Cohesity DataProtect integration page is displayed.

  4. Expand the Integration Guide area and follow the instructions on how to add the Cohesity DataProtect integration in Cisco XDR.

You can perform the following tasks after you integrate Cohesity DataProtect with Cisco XDR:

  • Pivot Menu - Install the Cohesity workflows from the Automation Exchange to use the Pivot menu to access actions in Cohesity DataProtect. Available actions include capturing snapshots of virtual machines in Cohesity DataProtect.

  • Automation:

    • Workflows - The workflows for Cohesity DataProtect can be installed from the Automation Exchange. See Workflows and Exchange.

    • Target - The Cohesity DataProtect target is automatically created for out-of-box and custom workflows. See Targets Created From Integrations.