Druva

Use Druva data with Cortex XSIAM.

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

This connector is available with any active Cortex XSIAM license.

The Druva Cloud Platform integration empowers you to automate ransomware issue response playbooks and orchestrate recovery actions across both your primary and backup environments. This event collector is applicable to customers using the Realize Ransomware Recovery module with inSync and Phoenix on Druva Public Cloud.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• DruvaEventCollector: Druva Ransomware Response Integration provides ransomware protection for endpoints, SaaS applications and data center workloads for Druva Ransomware Recovery customers.

To configure this connector, follow the steps outlined in the configuration wizard.