Cohesity + DataSunrise: Security Meets Resilience

Key Highlights

Although the two systems operate independently, they reinforce each other. DataSunrise detects threats at the database layer and signals Cohesity to act. In response, Cohesity preserves the data in an immutable, tamper-proof state — without any manual coordination.

How the Joint Solution Works

DataSunrise monitors every database query in real time. When it detects anomalous activity — SQL injection, privilege escalation, or behavioral anomalies — it triggers a response through the Cohesity REST API.

As a result, Cohesity creates an immutable snapshot, applies DataLock/WORM retention, or vaults data to FortKnox — depending on the configured policy. Because this response is automated, the system captures a clean copy of the data before damage can spread.

In effect, detection and preservation happen within the same event chain, without requiring SIEM orchestration or manual escalation.

Automated Incident Response

The primary integration scenario connects DataSunrise threat detection directly to Cohesity data protection. Whenever a database anomaly is identified, the system automatically initiates a snapshot — preserving the current state before any potential data loss or corruption.

This approach eliminates the delay between detection and response. Rather than waiting for a security team to assess and act, the system triggers an immediate backup and stores it in an immutable format.

Moreover, the integration path is straightforward: DataSunrise Subscriber events feed into the Cohesity REST API, so no custom development or middleware is required.

Compliance Evidence Chain

On the detection side, DataSunrise captures a complete SQL audit trail — every query, bind parameters, session metadata, user identity, and affected objects. This provides the detailed evidence required for regulatory compliance.

Cohesity then stores that audit data under DataLock/WORM retention, making it tamper-proof and admin-resistant. For stricter isolation requirements, Cohesity can also vault the data to FortKnox with air-gapped protection.

Consequently, the combined chain — from query capture to immutable storage — satisfies requirements across SOX, HIPAA, GDPR, and PCI DSS 4.0 without requiring separate archival systems.

Secured Restored Environments

When Cohesity restores or clones production data for development, testing, or forensic analysis, the restored environment inherits the same security exposure as the original. Without additional controls, sensitive data in restored copies remains fully accessible.

However, DataSunrise addresses this by applying dynamic masking, firewall rules, and activity monitoring to restored environments immediately. As a result, security policies follow the data regardless of where it is deployed.

This means that cloned databases used for development or investigation do not become unmonitored copies of production data.

Database Coverage

Cohesity provides backup and recovery for major database platforms including Oracle, SQL Server, PostgreSQL, MySQL, MongoDB, Cassandra, SAP HANA, and DynamoDB.

In addition, DataSunrise extends security coverage to platforms beyond what backup tools typically reach — including Snowflake, Databricks, BigQuery, Redis, Redshift, Azure SQL, DB2, and Teradata. It also covers AI and cloud storage services such as ChatGPT, Amazon Bedrock, Azure OpenAI, Amazon S3, and Azure Blob.

Together, the two platforms therefore cover a broader range of data infrastructure than either could address alone. Cohesity protects what can be backed up, while DataSunrise secures what needs to be monitored.

Who This Is For

The combined approach is relevant for organizations that need both real-time threat response and resilient data recovery. It applies to environments handling regulated data, operating critical databases, or requiring demonstrable compliance evidence chains.

Different teams benefit in different ways depending on their responsibilities and recovery requirements.

Conclusion

Cohesity and DataSunrise address different phases of data protection. One preserves data through immutable backup and recovery, while the other monitors and controls live access at the database layer.

Because they are connected through API integration, the two systems form a closed loop: detect, preserve, recover. Threats identified in real time trigger automated protection, and consequently, recovery operations inherit security controls from the start.

The result is a coordinated model for protecting data across its full lifecycle — from the moment of first access to the moment of full recovery.

FAQ