GravityZone

GravityZone provides secure access to incident and endpoint data and enables remediation actions through its APIs.

Endpoint · GravityZone

Configuration parameters

  • url — Server URL (required)
  • credentials — (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • max_fetch — Maximum incidents to fetch
  • first_fetch — First fetch time
  • mirror_direction — Mirroring Direction
  • incidentType — Incident type

Commands (27)

  • fetch-incidents

    Retrieves incidents from GravityZone Cloud.

  • get-mapping-fields

    Returns the list of fields available for outgoing mirroring. This command is intended for debugging purposes only.

  • get-modified-remote-data

    Retrieves incidents that were modified since the last data sync. This command is intended for debugging purposes.

  • get-remote-data

    Retrieves data from a remote incident without updating the current incident. This command is intended for debugging purposes.

  • gz-endpoint-create-memory-dump

    Initiates the creation of a memory dump for the specified endpoint. Once the dump is successfully generated, the resulting archive is uploaded to the Bitdefender cloud.

  • gz-endpoint-deisolate

    Restores an isolated endpoint to the network.

  • gz-endpoint-download-file

    Downloads a file from an endpoint.

  • gz-endpoint-download-investigation-package

    Collects and downloads an investigation package from an endpoint.

  • gz-endpoint-get

    Retrieves endpoint details by endpoint ID.

  • gz-endpoint-get-process-tree-by-hash

    Retrieves the process tree on an endpoint for a specified process hash. The applied policy must allow Live Search and the endpoint must be online.

  • gz-endpoint-isolate

    Isolates an endpoint from the network.

  • gz-endpoint-kill-process

    Terminates a process on an endpoint by process ID.

  • gz-endpoint-list

    Retrieves the list of managed endpoints.

  • gz-endpoint-list-by-running-process-hash

    Retrieves endpoints that are running processes with a specified hash. The API key and the applied policy must allow Live Search and endpoints must be online. The command waits up to five minutes for responses before timing out.

  • gz-endpoint-memory-dump-status

    Verifies the status of a task initiated via gz-endpoint-create-memory-dump.

  • gz-endpoint-run-command

    Runs a command on the endpoint. The applied policy must have remote shell enabled for this action to work.

  • gz-endpoint-upload-file

    Uploads a file to an endpoint.

  • gz-endpoint-users-loggedin

    Retrieves details of all active user sessions on a specific managed endpoint.

  • gz-incident-add-note

    Adds a note to one or more incidents.

  • gz-incident-change-status

    Changes the status of one or more incidents.

  • gz-incident-get

    Retrieves incident details by ID.

  • gz-incident-list

    Retrieves incidents from the last three days for all endpoints or for a specific endpoint.

  • gz-poll-endpoint-users-loggedin-status

    Verifies the status of a task initiated via gz-endpoint-users-loggedin. This command is invoked automatically and is not intended for direct use.

  • gz-poll-investigation-activity-status

    Checks the status of an investigation activity. This command is not intended for direct use.

  • gz-poll-live-search-status

    Checks the status of a Live Search query. This command is not intended for direct use.

  • gz-poll-task-status

    Checks the task status. This command is not intended for direct use.

  • update-remote-system

    Updates the remote incident with local incident changes without updating the current incident. This command is intended for debugging purposes.