Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-acronis-cyber-protect

Acronis Cyber Protect

You can integrate Acronis Cyber Protect with Sophos XDR so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

Acronis Cyber Protect product overview

Acronis Cyber Protect is an integrated cybersecurity and data protection service. The tool has a unified security approach by combining advanced backup capabilities with proactive cybersecurity measures. It helps ensure swift recovery and continuity of operations, effectively mitigating the impact of data breaches, ransomware attacks, and system failures on business activities.

What we ingest

Sophos XDR collects Acronis Cyber Protect Cloud alerts over HTTPS by polling the Acronis REST APIs at your configured base URL, with the client ID and client secret from the integration. We use the following HTTP request methods:

  • POST on /api/2/idp/token: Authenticates with OAuth 2.0 client credentials and obtains a bearer token used for subsequent calls.
  • GET on /api/alert_manager/v1/alerts: Pulls alert records for your tenant for each time range, filtered by created_at, ordered ascending, using limit/after cursor pagination until that range is finished.
  • GET on /api/resource_management/v4/resources/{resourceId}/attributes: Retrieves resource attributes for each workload referenced by an alert and merges a filtered subset (for example, name, IP, MAC addresses, OS info) into the alert as resourceInfo.

Acronis then returns JSON alert bodies. The event categories and types you see depend on which Acronis services and protection plans are active for your tenant.

Event and data types

We ingest the following event and data types from Acronis Cyber Protect Cloud. All alerts are returned in a single JSON envelope (id, type, category, severity, details, tenant, timestamps, and an optional resourceInfo block added by the integration). What you actually see depends on which Acronis services and protection plans are active for your tenant.

  • System alerts: Platform and infrastructure events such as failed activities, offline workloads, and agent issues (for example, ActivityFailed, MachineOffline30). Includes resource identifiers, task IDs, error context, and the affected workload. Normalized to third-party security alert telemetry.
  • Monitoring alerts: Behavioral and performance anomalies on protected workloads, including network traffic anomalies and resource-usage thresholds (for example, MiMonitoringIncomingTrafficAnomaly, MiMonitoringOutgoingTrafficAnomaly). This includes anomaly type, deviation values, time period, monitor name, and contributing processes. Normalized to third-party security alert telemetry.
  • Cyber protection and backup alerts: Backup, replication, and protection-plan events Acronis raises against protected resources. Includes plan identifiers, resource names, and error and result context where present. Normalized to third-party security alert telemetry.
  • Security and anti-malware alerts: Threat detections and policy events from Acronis security capabilities (for example, anti-malware and EDR), where enabled for your tenant. Normalized to third-party security alert telemetry.

Workload context (host name, IP addresses, MAC addresses, and OS systemInfo) is added to each alert as a resourceInfo block when the resource attributes call succeeds, so these fields are available regardless of category.

Data provided by this integration

Data provided by Acronis Cyber Protect gets normalized to the following schemas:

  • thirdpartyalert

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation