Reads the endpoint inventory, per-endpoint security posture, EDR incidents and patch state from the GravityZone Control Center JSON-RPC API.
For the general flow of adding a source, see Connect Data Sources.
Prerequisites
A GravityZone Control Center account allowed to manage API keys
The Patch Management add-on, for the Patches table (the other tables do not need it)
A GravityZone licence that includes incidents, for the four incident tables
The Access URL and API key stored securely — the key is shown only once
Setup
Step 1 - Create an API key
Sign in to GravityZone Control Center
Open My Account → API keys → Add
Enable these scopes:
Network (API),Incidents (API),Patch Management (API)Leave the write scopes (isolate, blocklist, scan, policies) disabled — HARVEN only reads
Click Save, then copy the key immediately (shown only once)
On the same screen, copy the Access URL — it ends with
/api
Step 2 - Fill the parameters in HARVEN
Open Workspace → Data sources → Add → BitDefender GravityZone
Paste the Access URL, e.g.
https://cloud.gravityzone.bitdefender.com/apiPaste the API key
Enter the Company ID — see below for where to read it
Click Save. HARVEN does not test the credentials on save: the connector opens on its Tables tab, where each table is checked, so a key missing the Network scope shows up there as failing tables
How the tables are queried
GravityZone exposes module status one endpoint at a time, so Endpoint security status is always read for specific endpoints — joined to Endpoints, or filtered on an endpoint id. A query with no endpoint filter is refused rather than run, because it would call the API once per machine in the fleet.
The Patches table merges the provider's missing- and installed-patch methods; its status column says which side a row came from.
The three Incident details, Incident alerts and Incident entities tables are read one incident at a time, like Endpoint security status: they are joined to Incidents or filtered on an incident id. GravityZone limits how often the incident list can be read, so checking these tables on the Tables tab can take a minute or two.
GravityZone refuses to return patches unless the request names a company, which is why the Company ID is required. HARVEN does not guess it: on a partner Control Center managing several customers, guessing would scope a report to one of them while presenting it as the whole estate.
Fields to fill in HARVEN
Field | Where to find it |
|---|---|
Access URL | Control Center → My Account → API keys (ends with /api) |
API key | Control Center → My Account → API keys → Add |
Company ID | GravityZone Control Center, on the company's own details page — the same id also appears in that page's URL |
Collected data
endpoints — Endpoint inventory: Identification and join keys (endpoint_id, name, fqdn, ip, macs), Agent presence and containment (is_managed, first_seen, is_isolated), Scope and policy (group_id, policy_name, policy_applied)
endpoint_security_status — Per-endpoint posture (queried by endpoint): Agent health (state, last_seen, agent_engine_version), Signature freshness (signature_outdated, signature_update_disabled), Protection coverage (module_edr_sensor, module_antimalware, module_encryption, module_patch_management), Infection state (malware_detected_24h, malware_infected)
incidents — Endpoint and organization incidents: Identification (incident_id, incident_number, incident_type), Affected endpoint and detection (endpoint_id, computer_name, detection_name), Triage (status, priority, main_action, severity_score, attack_types), Detection and response latency (created_at, last_updated, last_incident_change)
incident_details — What GravityZone concluded about each incident (queried by incident): GravityZone's account of the incident (narrative, reasoning), How far the attack went (kill_chain_phases, mitre_tactics, mitre_techniques), Grouping of endpoint and organization incidents (contains, part_of)
incident_alerts — The alerts inside each incident (queried by incident): What ran, and under which account (name, detected_at, process_path, command_line, user_name), Network connection (direction, source_ip, destination_ip, destination_port, smb_user, smb_share), File and registry key involved (file_path, registry_key)
incident_entities — The graph of each incident (queried by incident): Process, file, registry key, domain, IP address or machine (type, name, is_external), Process and file evidence (command_line, user_name, file_path, sha256), Network evidence and machines (ip, domain, url, endpoint_id)
patches — Patch state per endpoint: Patch and compliance state (name, status, type, operating_system), Vulnerability references (cves, kb_number, bulletin_url), Vendor release date (release_date)
Official documentation
Need help? Contact [email protected].