---
title: "DataProtect"
url: "https://axoflow.com/docs/axoflow/data-sources/appliances/cohesity/dataprotect/"
description: "Send Cohesity DataProtect audit and data protection logs to Axoflow, and look up the labels that Axoflow adds to its data."
last_modified: "2026-10-27T10:18:05+01:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axoflow/llms.txt).

# DataProtect

Send Cohesity DataProtect audit and data protection logs to Axoflow, and look up the labels that Axoflow adds to its data.

DataProtect:
Backup and recovery cluster that sends cluster audit, API access, data protection, and SMB file audit events.

To onboard such a source to Axoflow, complete the [generic appliance onboarding steps](https://axoflow.com/docs/axoflow/data-sources/appliances/index.md).

## Labels

Axoflow automatically adds the following labels to data collected from this source:

| Analytics label | Message field | value |
| --- | --- | --- |
| `vendor` | [`meta.vendor`](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.vendor) | `cohesity` |
| `product` | [`meta.product`](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.product) | `dataprotect` |
| `service` | [`meta.service.name`](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.service.name) | `cluster_audit`, `api_audit`, `dataprotection_events`, `filesystem_audit`, `shell_commands_audit`, or `cli_audit` |

The `service` label depends on the Cohesity log that the message comes from (the program name in the syslog header):

- `cluster_audit`: Cluster audit log
- `api_audit`: API access audit log
- `dataprotection_events`: Data protection events
- `filesystem_audit`: File system (SMB) audit log
- `shell_commands_audit`: Shell commands audit log
- `cli_audit`: CLI audit log

You can use the labels as:

- labels in **Customize Graph** on the [Analytics page](https://axoflow.com/docs/axoflow/metrics/analytics/index.md),
- in the **Filter labels** field during [log tapping](https://axoflow.com/docs/axoflow/onboard-hosts/log-tapping/index.md).

You can use the message fields

- in [Flow Processing steps](https://axoflow.com/docs/axoflow/data-management/processing/index.md), for example, in the **Query** field of **Select Messages** steps,
- in AQL expressions in the search bars.

## Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

| sourcetype | index |
| --- | --- |
| `cohesity:api:audit` | `infraops` |
| `cohesity:cluster:audit` | `infraops` |
| `cohesity:cluster:dataprotection` | `infraops` |

The `api_audit` service uses the `cohesity:api:audit` sourcetype, the `dataprotection_events` service uses `cohesity:cluster:dataprotection`, and every other service uses `cohesity:cluster:audit`.

If the Axoflow classification doesn’t set the source field for the message automatically, and you haven’t set it in a [flow processing step](https://axoflow.com/docs/axoflow/data-management/processing/index.md#set-fields) manually (by setting the `meta.destination.splunk.source` field), AxoRouter automatically sets the source to the [name of the AxoRouter connector](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.connector.name) that received the message (for example, `axorouter-syslog-tcp-514`).

## Sending data to Google SecOps

When sending the data collected from this source to a [*dynamic* Google SecOps destination](https://axoflow.com/docs/axoflow/destinations/google/secops/index.md), Axoflow sets the following log type: `COHESITY`.