Parser for Cohesity

Download the parser for Cohesity and gain full visibility into backup operations, configuration changes, and security events across your Cohesity environment directly within Logmanager. The package also includes a classifier and a ready-to-use dashboard for quick deployment and analysis.

Parser:

Classifier:

Dashboard:

What is Cohesity?

Cohesity is a data management and protection platform that unifies backup, recovery, archiving, and other secondary data operations into a single system. Instead of relying on multiple standalone tools, it provides a consolidated layer built on a distributed hyperconverged architecture with its own file system that scales horizontally by adding nodes to a cluster.

Cohesity protects data through global deduplication, compression, and redundant storage across the cluster, ensuring that the failure of a single node does not compromise data availability. It can be deployed both on-premises and in the cloud, supports hybrid environments, and is increasingly positioned as a key component of cyber resilience strategies. This is particularly important in ransomware protection, where immutable snapshots and anomaly detection play a critical role.

Why Integrate Cohesity with Logmanager?

Integrating Cohesity with a centralized log management solution such as Logmanager provides significant benefits, especially in terms of event correlation and long-term log retention.

While Cohesity provides detailed visibility into backup operations, user logins, configuration changes, and security alerts within the backup environment, Logmanager places this information into the broader context of your entire infrastructure.

Forwarding Cohesity logs to Logmanager enables:

• Faster Incident Detection: Correlate activity from backup appliances with events from firewalls, servers, and endpoints. Suspicious actions such as unexpected backup deletions or mass configuration changes can be detected before they escalate into serious incidents.
• Ransomware Protection: Monitoring backup integrity and analyzing Cohesity logs for suspicious behavior helps identify attempts to encrypt, delete, or compromise protected data before significant damage occurs.
• Audit Compliance: Logmanager provides secure, tamper-resistant, and compliant log storage in a centralized location, helping organizations meet audit and regulatory requirements.
• Advanced Search and Analysis: Instead of manually reviewing records in the Cohesity interface, security and operations teams can perform complex searches, correlate events, and build custom dashboards for deeper visibility.
• Regulatory Compliance: Centralized log collection supports compliance with cybersecurity regulations such as NIS2 and industry standards, including requirements for log retention, integrity, and monitoring.

Parser, Classifier, and Dashboard

If you use Cohesity, you can import a ready-made parser into Logmanager.

Follow these steps to import the Cohesity parser, classifier, and dashboard:

1. Create a new parser and paste the parser XML code into the XML editor.
2. Click the tag at the beginning of the parser and change its name to cohesity.

3. Enter the parser name and save it.

4. Create an IP Prefix List named Cohesity.

5. Add all IP addresses of possible Cohesity log sources to the Prefix List.

6. Create a new classifier, assign it a name, and paste the provided XML code.

7. In the IP Prefix List block, change the referenced Prefix List name to cohesity.

8. In the Pass to Parser block, select the previously saved parser named cohesity.

9. Finally, open any dashboard and use the Folder icon and the Advanced menu to import the downloaded Cohesity dashboard.

You are now ready to receive and analyze Cohesity logs in Logmanager.