Commvault Cloud for Sentinel

Commvault Security IQ for Microsoft Sentinel helps organizations monitor cyber resilience across their Commvault data protection environments. The solution ingests Commvault anomaly and threat events into Microsoft Sentinel, enabling centralized detection, investigation, and incident response.

Key Features

• Ingest security-relevant Commvault anomaly and threat events into Microsoft Sentinel, including events documented in the Threat Indicators Dashboard.
• Help reduce security blind spots and manual monitoring overhead across data protection environments.
• Create Microsoft Sentinel incidents from Commvault anomaly events using the included analytic rule template.
• Automate response actions such as disabling Commvault users, disabling SAML identity providers, and disabling data aging using the included playbook templates.
• Support managed Codeless Connector Framework ingestion.

How It Works

• Install the Commvault Security IQ solution from Microsoft Sentinel Content hub.
• Configure the Codeless Connector Framework connector with the Commvault API endpoint and API token. The connector polls for new anomaly events and stores them in the table.