Reads the endpoint inventory, per-endpoint security posture, EDR incidents and patch state from the BitDefender GravityZone Control Center JSON-RPC API.
For the general flow of adding a source, see Connect Data Sources.
Before you start
A GravityZone Control Center account allowed to manage API keys
The Patch Management add-on, for the Patches table — the other three tables do not need it
The EDR/XDR entitlement, for the Incidents table: without it GravityZone does not expose the incident method at all, whatever scopes the key carries
The Access URL and API key stored securely — the key is shown only once
Step 1 — Create an API key
Sign in to GravityZone Control Center
Open My Account → API keys → Add
Enable these scopes: Network (API), Incidents (API), Patch Management (API)
Leave the write scopes (isolate, blocklist, scan, policies) disabled — HARVEN only reads
Click Save, then copy the key immediately (shown only once)
On the same screen, copy the Access URL — it ends with /api
Step 2 — Configure the connector in HARVEN
Open Workspace → Data sources → Add → BitDefender GravityZone
Paste the Access URL, e.g. https://cloud.gravityzone.bitdefender.com/api
Paste the API key
Enter the Company ID — see below for where to read it
Test the connection before saving: the test performs a Network-scope read, so a key missing that scope fails here rather than at the first query
How the tables are queried
GravityZone exposes module status one endpoint at a time, so endpoint_security_status is always read for specific endpoints — joined to endpoints, or filtered on an endpoint id. A query with no endpoint filter is refused rather than run, because it would call the API once per machine in the fleet.
The patches table merges the provider's missing- and installed-patch methods; its status column says which side a row came from.
GravityZone refuses to return incidents or patches unless the request names a company, which is why the Company ID is required. HARVEN does not guess it: on a partner Control Center managing several customers, guessing would scope a report to one of them while presenting it as the whole estate.
What to enter in HARVEN
Access URL — GravityZone API base URL for your company (Control Center → My Account → API keys; ends with /api)
API key — GravityZone API key with the Network, Incidents and Patch Management scopes (Control Center → My Account → API keys → Add)
Company ID — Identifies the company whose incidents and patches are read; letters and digits only, roughly 24 characters (GravityZone Control Center, on the company's own details page — the same id also appears in that page's URL)
What HARVEN reads
endpoints — Endpoint inventory: identification and join keys (endpoint_id, name, fqdn, ip, macs), agent presence and containment (is_managed, first_seen, is_isolated), scope and policy (group_id, policy_name, policy_applied)
endpoint_security_status — Per-endpoint posture, queried by endpoint: agent health (state, last_seen, agent_engine_version), signature freshness (signature_outdated, signature_update_disabled), protection coverage (module_edr_sensor, module_antimalware, module_encryption, module_patch_management), infection state (malware_detected_24h, malware_infected)
incidents — EDR incidents: identification (incident_id, endpoint_id), triage (status, priority, severity_score), detection and response latency (created_at, last_incident_change)
patches — Patch state per endpoint: patch and compliance state (name, status, type, operating_system), vulnerability references (cves, kb_number, bulletin_url), vendor release date (release_date)
Official documentation
Need help? Contact [email protected].
