Introducing Druva Marketplace, With Sumo Logic as Our First Partner App

Mike Taylor, Sr. Content Marketing Manager

November 05, 2026

Introducing Druva Marketplace, With Sumo Logic as Our First Partner App

Content

    Backup data holds some of the earliest signals of a cyberattack. A sudden wave of file deletions, a malicious file sitting in a snapshot, an admin login from an unfamiliar location: each of these can tell a security team something is wrong. These signals are most useful in the tools where security and IT teams already investigate and respond. When they stay inside a backup console, someone has to remember to go looking for them.

    That’s the problem Druva Marketplace is built to solve.

    What Is Druva Marketplace?

    Druva Marketplace is a curated application marketplace within Druva Resilience Cloud. It gives three groups one place to work:

    • Customers can discover, deploy, and manage Druva and partner integrations in one place, from the Druva console they already use.
    • Partners can list and manage their apps and reach Druva customers.
    • Developers can build integrations on Druva APIs using a developer sandbox, with defined security requirements and a review process for every app before it’s published.

    Security and IT teams buy platforms that connect to what they already operate, whether that’s SIEM, ITSM, SOAR, identity, compliance, or analytics. Today, integration availability is a standard part of how enterprises evaluate data protection. Marketplace makes Druva’s integrations easier to find, easier to use, and easier for partners to build.

    Why Integrations Matter for Cyber Resilience

    Backup telemetry is security intelligence. Druva already sees a great deal: unusual data activity, malicious files found in protected data, ransomware recovery actions, changes to admin access and API credentials. Getting that intelligence into the security stack has usually meant custom integration work that customers had to build and maintain themselves.

    Marketplace changes that model. Partners build the integrations, and Druva reviews them for security. Customers then configure the integration instead of building it. Because Druva is a fully-managed SaaS, partners don’t integrate against infrastructure the customer has to size and maintain. App management happens in the Druva platform.

    Our First Design Partner: Sumo Logic

    Sumo Logic is the first design partner to ship an app on Druva Marketplace.

    Sumo Logic delivers a unified intelligence platform for security and observability. Bringing together log analytics, SIEM, and agentic AI in one platform, SecOps and DevOps teams use Sumo Logic to manage their entire telemetry pipeline and lifecycle, turning machine data into trusted, AI-ready data to detect, investigate, and resolve issues before they impact the business. That makes it a natural first home for Druva telemetry.

    Sumo Logic built the app, called Druva – Platform Events, on the Druva developer sandbox. Druva engineering didn’t build it. The Sumo Logic team developed and tested the integration against Druva APIs, and Sumo Logic now publishes the app in its own App Catalog.

    How the Integration Works

    The integration is webhook-driven. Customers set up a webhook in the Integration Center of the Druva console. The webhook forwards Druva platform events to Sumo Logic, including:

    • Admin and platform access
    • API credential changes
    • Backup and restore activity
    • Enterprise workload jobs
    • Cybersecurity events
    • Ransomware recovery
    • Data access
    • Alerts

    Inside Sumo Logic, those events feed nine pre-built dashboards. The dashboards cover:

    • Platform access
    • API credentials
    • Data protection
    • Enterprise workloads
    • Ransomware recovery
    • Sensitive data and compliance
    • Cybersecurity
    • Alerts
    • An overview of all Druva events

    The app also includes five pre-configured monitors that flag high-priority conditions:

    • Mass deletion: An unusual data activity event that removes more than 100 files.
    • Malicious files: Malicious files detected during a scan or curated snapshot.
    • Failed admin logins: Repeated failed admin login attempts in a short window.
    • Backup failures: A sudden spike in backup failures.
    • High-risk data access: Data accessed from a high-risk or embargoed country.

    What Sumo Logic Customers Get

    • Backup signals in the security picture: Mass deletions, malicious files, and unusual admin activity arrive where the SOC already works. Analysts can correlate them with endpoint, identity, and network data without switching consoles.
    • Earlier ransomware warning: The mass-delete and malicious-file monitors surface ransomware indicators found in protected data. During response, the dashboards show quarantine and recovery activity as it happens.
    • Oversight of the backup system itself: Backup admin accounts and API credentials are high-value targets because they control recovery. The app watches logins, credential changes, and security configuration changes alongside the rest of a customer’s identity telemetry.
    • Compliance evidence and operational health in one place: Data access events and access locations help answer audit questions. Backup failure trends and VM job status give IT operations teams visibility without another login.

    Getting Started

    Setup takes configuration, not code. Customers create an HTTP source in Sumo Logic and add a webhook in Druva’s Integration Center pointing to it. Then they install the Druva – Platform Events app from the Sumo Logic App Catalog and turn on the monitors they want. Full step-by-step instructions are in Sumo Logic’s documentation for the integration.

    Built on the Druva Developer Sandbox

    The Sumo Logic app also shows how Marketplace works for partners. The developer sandbox lets partners build and test against Druva APIs without touching a production tenant. Druva runs sandbox provisioning and credential management as a service, so partners can focus on the integration itself.

    Before an app is published, it goes through Druva’s defined security requirements and review. Partners get a clear submission checklist, and customers get confidence that what they install has been reviewed.

    Sumo Logic went from sandbox to shipped app. For technology partners and ISVs who want to put their product in front of Druva customers, that’s the path Marketplace is designed to support.

    Explore Druva Marketplace

    Further Reading