GravityZone

GravityZone provides secure access to incident and endpoint data and enables remediation actions through its APIs.

Endpoint · GravityZone

Details

IDGravityZone
CategoryEndpoint
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10381435

README

GravityZone provides secure access to incident and endpoint data and enables remediation actions through its APIs.
This integration was integrated and tested with version 6.6 of GravityZone.

Configure GravityZone in Cortex

Parameter Description Required
Server URL The URL of your GravityZone Cloud instance. True
API key API key to access the service REST API. True
Trust any certificate (not secure) When selected, the server certificates are not verified. False
Use system proxy settings Use the system proxy settings for connecting to the server. False
Fetch incidents When selected, the integration will fetch incidents from the server. False
Maximum incidents to fetch Maximum number of incidents per fetch. The default value is 50. False
First fetch time The time period from which the first fetch will start. False
Mirroring Direction The mirroring direction in which to mirror the incident. You can mirror “Incoming” (from GravityZone to Cortex XSOAR), “Outgoing” (from Cortex XSOAR to GravityZone), or in both directions. False
Incident type   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

fetch-incidents

Retrieves incidents from GravityZone Cloud.

Base Command

fetch-incidents

Context Output

There is no context output for this command.

gz-endpoint-list

Retrieves the list of managed endpoints.

Base Command

gz-endpoint-list

Input

Argument Name Description Required
limit The maximum number of endpoints to retrieve. Optional
name The endpoint name filter. Returns endpoints whose hostnames start with the specified value. The value must be at least 3 characters long. Supports an optional single leading ‘*’ wildcard pattern. Optional
node_id The ID of the target GravityZone company or network inventory group. If not specified, the default value is the ID of the company associated with the API key used to make the request. Optional

Context Output

Path Type Description
GravityZone.EndpointsList.ID String The endpoint ID.
GravityZone.EndpointsList.Hostname String The endpoint hostname.
GravityZone.EndpointsList.IP String The endpoint IP address.
GravityZone.EndpointsList.OS String The endpoint operating system version.
GravityZone.EndpointsList.MAC String The endpoint MAC address.
GravityZone.EndpointsList.Vendor String The endpoint vendor.
GravityZone.EndpointsList.FQDN String The endpoint’s fully qualified domain name (FQDN).
GravityZone.EndpointsList.CompanyID String The GravityZone company ID where the endpoint is located.
GravityZone.EndpointsList.GroupID String The GravityZone group ID where the endpoint is located.

Command example


#### Context Example

```json
{
    "GravityZone": {
        "EndpointsList": [
            {
                "CompanyID": "6909d1859866985b410b2969",
                "FQDN": "win",
                "GroupID": "6909d1869866985b410b296e",
                "Hostname": "WIN",
                "ID": "699d81cdab613e65696e452e",
                "IP": "IP1",
                "MAC": "005056b1b175",
                "OS": "Windows 10 Pro",
                "Vendor": "GravityZone"
            },
            {
                "CompanyID": "6909d1859866985b410b2969",
                "FQDN": "xdr-nsva",
                "GroupID": "6909d1869866985b410b296e",
                "Hostname": "xdr-nsva",
                "ID": "69fc10a547f2e985e6774a0f",
                "IP": "IP2",
                "MAC": "005056b156b1",
                "OS": "Linux Ubuntu 24.04.4 LTS",
                "Vendor": "GravityZone"
            },
            {
                "CompanyID": "6909d1859866985b410b2969",
                "FQDN": "ta349cf3rjt5",
                "GroupID": "6909d1869866985b410b296e",
                "Hostname": "TA349CF3RJT5",
                "ID": "6a6043865de62c6f81270b8d",
                "IP": "IP3",
                "MAC": "005056b8bfd3",
                "OS": "Windows 10 Enterprise",
                "Vendor": "GravityZone"
            }
        ]
    }
}

Human Readable Output

GravityZone Endpoints List

ID Hostname IP OS MAC Vendor FQDN CompanyID GroupID
699d81cdab613e65696e452e WIN IP1 Windows 10 Pro 005056b1b175 GravityZone win 6909d1859866985b410b2969 6909d1869866985b410b296e
69fc10a547f2e985e6774a0f xdr-nsva IP2 Linux Ubuntu 24.04.4 LTS 005056b156b1 GravityZone xdr-nsva 6909d1859866985b410b2969 6909d1869866985b410b296e
6a6043865de62c6f81270b8d TA349CF3RJT5 IP3 Windows 10 Enterprise 005056b8bfd3 GravityZone ta349cf3rjt5 6909d1859866985b410b2969 6909d1869866985b410b296e

Command example

!gz-endpoint-list name=TA66

Human Readable Output

GravityZone Endpoints List

No entries.

Command example

!gz-endpoint-list node_id=6909d1859866985b410b2969

Context Example

{
    "GravityZone": {
        "EndpointsList": [
            {
                "CompanyID": "6909d1859866985b410b2969",
                "FQDN": "win",
                "GroupID": "6909d1869866985b410b296e",
                "Hostname": "WIN",
                "ID": "699d81cdab613e65696e452e",
                "IP": "IP1",
                "MAC": "005056b1b175",
                "OS": "Windows 10 Pro",
                "Vendor": "GravityZone"
            },
            {
                "CompanyID": "6909d1859866985b410b2969",
                "FQDN": "xdr-nsva",
                "GroupID": "6909d1869866985b410b296e",
                "Hostname": "xdr-nsva",
                "ID": "69fc10a547f2e985e6774a0f",
                "IP": "IP2",
                "MAC": "005056b156b1",
                "OS": "Linux Ubuntu 24.04.4 LTS",
                "Vendor": "GravityZone"
            },
            {
                "CompanyID": "6909d1859866985b410b2969",
                "FQDN": "ta349cf3rjt5",
                "GroupID": "6909d1869866985b410b296e",
                "Hostname": "TA349CF3RJT5",
                "ID": "6a6043865de62c6f81270b8d",
                "IP": "IP3",
                "MAC": "005056b8bfd3",
                "OS": "Windows 10 Enterprise",
                "Vendor": "GravityZone"
            }
        ]
    }
}

Human Readable Output

GravityZone Endpoints List

ID Hostname IP OS MAC Vendor FQDN CompanyID GroupID
699d81cdab613e65696e452e WIN IP1 Windows 10 Pro 005056b1b175 GravityZone win 6909d1859866985b410b2969 6909d1869866985b410b296e
69fc10a547f2e985e6774a0f xdr-nsva IP2 Linux Ubuntu 24.04.4 LTS 005056b156b1 GravityZone xdr-nsva 6909d1859866985b410b2969 6909d1869866985b410b296e
6a6043865de62c6f81270b8d TA349CF3RJT5 IP3 Windows 10 Enterprise 005056b8bfd3 GravityZone ta349cf3rjt5 6909d1859866985b410b2969 6909d1869866985b410b296e

gz-endpoint-get

Retrieves endpoint details by endpoint ID.

Base Command

gz-endpoint-get

Input

Argument Name Description Required
id The ID of the endpoint to retrieve. Required

Context Output

Path Type Description
GravityZone.Endpoint.ID String The endpoint ID.
GravityZone.Endpoint.Hostname String The endpoint hostname.
GravityZone.Endpoint.IP String The endpoint IP address.
GravityZone.Endpoint.OS String The endpoint operating system version.
GravityZone.Endpoint.Status String The endpoint status.
GravityZone.Endpoint.Vendor String The endpoint vendor.
GravityZone.Endpoint.LastLoggedUsers String The last users who logged on the endpoint.
Endpoint.ID String The endpoint ID.
Endpoint.Hostname String The endpoint hostname.
Endpoint.IPAddress String The endpoint IP address.
Endpoint.OS String The endpoint operating system version.
Endpoint.Status String The endpoint status.
Endpoint.Vendor String The endpoint vendor.

Command example

!gz-endpoint-get id=6942a43afe8d4e463ca5c197

Context Example

{
    "Endpoint": {
        "Hostname": "bdvm",
        "ID": "6942a43afe8d4e463ca5c197",
        "IPAddress": "1.1.1.1",
        "OS": "Linux Ubuntu 24.04.2 LTS",
        "Status": "Online",
        "Vendor": "GravityZone"
    },
    "GravityZone": {
        "Endpoint": {
            "Hostname": "bdvm",
            "ID": "6942a43afe8d4e463ca5c197",
            "IP": "1.1.1.1",
            "LastLoggedUsers": "",
            "OS": "Linux Ubuntu 24.04.2 LTS",
            "Status": "Online",
            "Vendor": "GravityZone"
        }
    }
}

Human Readable Output

GravityZone Endpoint

ID Hostname IP OS Status Vendor LastLoggedUsers
6942a43afe8d4e463ca5c197 bdvm 1.1.1.1 Linux Ubuntu 24.04.2 LTS Online GravityZone  

gz-endpoint-download-investigation-package

Collects and downloads an investigation package from an endpoint.

Base Command

gz-endpoint-download-investigation-package

Input

Argument Name Description Required
id The ID of the endpoint from which to collect the investigation package. Required
output_file The output file name in Cortex XSOAR to save the collected package. For Windows and macOS use .zip, for Linux use .tgz. Required

Context Output

Path Type Description
GravityZone.Command.DownloadFile.EndpointID String The endpoint ID.
GravityZone.Command.DownloadFile.Status String The command status.
GravityZone.Command.DownloadFile.ErrorCode String The command error code.
GravityZone.Command.DownloadFile.OutputFile String The output file name.
GravityZone.Command.DownloadFile.RemoteFile String The remote file path.
GravityZone.Command.DownloadFile.FileID String The file ID.
File.SHA1 String The SHA1 hash of the downloaded file.
File.SHA256 String The SHA256 hash of the downloaded file.
File.SHA512 String The SHA512 hash of the downloaded file.
File.SSDeep String The SSDeep hash of the downloaded file.
File.EntryID String The EntryID hash of the downloaded file.
File.Info String Information about the downloaded file.
File.Type String The downloaded file type.
File.MD5 String The MD5 hash of the downloaded file.
File.Extension String The downloaded file extension.
File.Size Number The downloaded file size.
File.Name String The downloaded file name.

Command example

!gz-endpoint-download-investigation-package id=6942a43afe8d4e463ca5c197 output_file=investigation_package.zip

Context Example

{
    "GravityZone": {
        "Command": {
            "DownloadFile": {
                "ActivityID": "69443b020126750c1a0dbe2f",
                "ActivityType": "DownloadFile",
                "Status": "Success",
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "ErrorCode": null,
                "RemoteFile": null,
                "OutputFile": "investigation_package.zip",
                "FileID": "LtvQ6B8eCFvTNo7bf3vDUD@25729aa7-7442-4231-8b98-ecb0fc29a642",
                "FileName": "investigation_package.zip"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.DownloadFile command on host 6942a43afe8d4e463ca5c197

EndpointID Status ErrorCode OutputFile RemoteFile FileID
6942a43afe8d4e463ca5c197 Success   investigation_package.zip   LtvQ6B8eCFvTNo7bf3vDUD@25729aa7-7442-4231-8b98-ecb0fc29a642

gz-endpoint-download-file

Downloads a file from an endpoint.

Base Command

gz-endpoint-download-file

Input

Argument Name Description Required
id The ID of the endpoint to download the file from. Required
remote_file The full path of the remote file on the endpoint to download. Required
output_file The output file name in Cortex XSOAR to save the downloaded file to. Required

Context Output

Path Type Description
GravityZone.Command.DownloadFile.EndpointID String The endpoint ID.
GravityZone.Command.DownloadFile.Status String The command status.
GravityZone.Command.DownloadFile.ErrorCode String The command error code.
GravityZone.Command.DownloadFile.OutputFile String The output file name.
GravityZone.Command.DownloadFile.RemoteFile String The remote file path.
GravityZone.Command.DownloadFile.FileID String The file ID.
File.SHA1 String The SHA1 hash of the downloaded file.
File.SHA256 String The SHA256 hash of the downloaded file.
File.SHA512 String The SHA512 hash of the downloaded file.
File.SSDeep String The SSDeep hash of the downloaded file.
File.EntryID String The EntryID hash of the downloaded file.
File.Info String Information about the downloaded file.
File.Type String The downloaded file type.
File.MD5 String The MD5 hash of the downloaded file.
File.Extension String The downloaded file extension.
File.Size Number The downloaded file size.
File.Name String The downloaded file name.

Command example

!gz-endpoint-download-file id=6942a43afe8d4e463ca5c197 remote_file=/root/test/test.txt output_file=downloaded_file.gzip

Context Example

{
    "GravityZone": {
        "Command": {
            "DownloadFile": {
                "ActivityID": "6943fb82c1f339e18b0949a1",
                "ActivityType": "DownloadFile",
                "RemoteFile": "/root/test/test.txt",
                "Status": "Success",
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "ErrorCode": null,
                "OutputFile": "downloaded_file.gzip",
                "FileID": "LtvQ6B8eCFvTNo7bf3vDUD@25729aa7-7442-4231-8b98-ecb0fc29a642",
                "FileName": "downloaded_file.gzip"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.DownloadFile command on host 6942a43afe8d4e463ca5c197

EndpointID Status ErrorCode OutputFile RemoteFile FileID
6942a43afe8d4e463ca5c197 Success   downloaded_file.gzip /root/test/test.txt LtvQ6B8eCFvTNo7bf3vDUD@25729aa7-7442-4231-8b98-ecb0fc29a642

gz-endpoint-isolate

Isolates an endpoint from the network.

Base Command

gz-endpoint-isolate

Input

Argument Name Description Required
id The ID of the endpoint to isolate. Required

Context Output

Path Type Description
GravityZone.Command.Isolate.TaskID String The task ID.
GravityZone.Command.Isolate.TaskType String The task type.
GravityZone.Command.Isolate.EndpointID String The endpoint ID.
GravityZone.Command.Isolate.Hostname String The endpoint name.
GravityZone.Command.Isolate.Status String The command status.
GravityZone.Command.Isolate.ErrorCode String The command error code, or “Success”.
GravityZone.Command.Isolate.Error String The command error message, or “Success”.
GravityZone.Command.Isolate.StartDate Date The start date of the command execution.
GravityZone.Command.Isolate.EndDate Date The end date of the command execution.

Command example

!gz-endpoint-isolate id=6942a43afe8d4e463ca5c197

Context Example

{
    "GravityZone": {
        "Command" : {
            "Isolate" : {
                "TaskID": "6941bbc98ba450a5c10e5a16",
                "TaskType": "Isolate",
                "Status": "Processed",
                "EndDate": "2025-12-16T22:06:33Z",
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "Hostname": "ENDPOINT_NAME",
                "ErrorCode": "Success",
                "Error": "Success",
                "StartDate": "2025-12-16T22:06:33Z"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.Isolate command on hosts ENDPOINT_ID

EndpointID Hostname StartDate EndDate Error
6942a43afe8d4e463ca5c197 ENDPOINT_NAME 2025-12-16T22:06:33Z 2025-12-16T22:06:33Z Success

gz-endpoint-deisolate

Restores an isolated endpoint to the network.

Base Command

gz-endpoint-deisolate

Input

Argument Name Description Required
id The ID of the endpoint to restore from isolation. Required

Context Output

Path Type Description
GravityZone.Command.Deisolate.TaskID String The task ID.
GravityZone.Command.Deisolate.TaskType String The task type.
GravityZone.Command.Deisolate.EndpointID String The endpoint ID.
GravityZone.Command.Deisolate.Hostname String The endpoint name.
GravityZone.Command.Deisolate.Status String The command status.
GravityZone.Command.Deisolate.ErrorCode String The command error code, or “Success”.
GravityZone.Command.Deisolate.Error String The command error message, or “Success”.
GravityZone.Command.Deisolate.StartDate Date The start date of the command execution.
GravityZone.Command.Deisolate.EndDate Date The end date of the command execution.

Command example

!gz-endpoint-deisolate id=6942a43afe8d4e463ca5c197

Context Example

{
    "GravityZone": {
        "Command" : {
            "Deisolate" : {
                "TaskID": "6941bbc98ba450a5c10e5a16",
                "TaskType": "Deisolate",
                "Status": "Processed",
                "EndDate": "2025-12-16T22:08:33Z",
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "Hostname": "ENDPOINT_NAME",
                "ErrorCode": "Success",
                "Error": "Success",
                "StartDate": "2025-12-16T22:08:33Z"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.Deisolate command on hosts ENDPOINT_ID

EndpointID Hostname StartDate EndDate Error
6942a43afe8d4e463ca5c197 ENDPOINT_NAME 2025-12-16T22:08:33Z 2025-12-16T22:08:33Z Success

gz-endpoint-kill-process

Terminates a process on an endpoint by process ID.

Base Command

gz-endpoint-kill-process

Input

Argument Name Description Required
id The endpoint ID. Required
pid The ID of the process to kill. Required

Context Output

Path Type Description
GravityZone.Command.KillProcess.TaskID String The task ID.
GravityZone.Command.KillProcess.TaskType String The task type.
GravityZone.Command.KillProcess.EndpointID String The endpoint ID.
GravityZone.Command.KillProcess.Hostname String The endpoint name.
GravityZone.Command.KillProcess.Status String The command status.
GravityZone.Command.KillProcess.ErrorCode String The command error code, or “Success”.
GravityZone.Command.KillProcess.Error String The command error message, or “Success”.
GravityZone.Command.KillProcess.StartDate Date The start date of the command execution.
GravityZone.Command.KillProcess.EndDate Date The end date of the command execution.
GravityZone.Command.KillProcess.ProcessID Number The process ID.
GravityZone.Command.KillProcess.ProcessPath String The process path.

Command example

!gz-endpoint-kill-process id=6942a43afe8d4e463ca5c197 pid=5876

Context Example

{
    "GravityZone": {
        "Command": {
            "KillProcess": {
                "TaskID": "6941b6ffa830c3132b0d63d8",
                "TaskType": "KillProcess",
                "Status": "Processed",
                "EndDate": "2025-12-16T21:46:08Z",
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "Hostname": "ENDPOINT_NAME",
                "ErrorCode": "Success",
                "Error": "Success",
                "StartDate": "2025-12-16T21:46:07Z",
                "ProcessID": 5876,
                "ProcessPath": ""
            }
        }
    }
}

Human Readable Output

GravityZone.Command.KillProcess command on hosts ENDPOINT_ID

EndpointID Hostname StartDate EndDate Error ProcessID
6942a43afe8d4e463ca5c197 ENDPOINT_NAME 2025-12-16T21:46:07Z 2025-12-16T21:46:08Z Success 5876

gz-endpoint-run-command

Runs a command on the endpoint. The applied policy must have Remote Shell enabled for this action to work.

Base Command

gz-endpoint-run-command

Input

Argument Name Description Required
id The ID of the endpoint on which to run the command. Required
command The command to run on the endpoint. Required

Context Output

Path Type Description
GravityZone.Command.RunCommand.ActivityID String The activity ID.
GravityZone.Command.RunCommand.ActivityType String The activity type.
GravityZone.Command.RunCommand.Status String The command status.
GravityZone.Command.RunCommand.EndpointID String The endpoint ID.
GravityZone.Command.RunCommand.ErrorCode String The command error code, or “Success”.
GravityZone.Command.RunCommand.Output String The command output.
GravityZone.Command.RunCommand.FileID String The stored file ID, when the command output cannot be extracted as an archive.
GravityZone.Command.RunCommand.FileName String The stored file name, when the command output cannot be extracted as an archive.

Command example

!gz-endpoint-run-command id=6942a43afe8d4e463ca5c197 command=whoami

Context Example

{
    "GravityZone": {
        "Command": {
            "RunCommand": {
                "ActivityID": "6943e3391e4fe5e8a40e51f6",
                "ActivityType": "RunCommand",
                "Status": "Success",
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "ErrorCode": null,
                "Command": "whoami",
                "Output": "root"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.RunCommand command on host 6942a43afe8d4e463ca5c197

EndpointID Status ErrorCode Command Output
6942a43afe8d4e463ca5c197 Success   whoami root

gz-endpoint-upload-file

Uploads a file to an endpoint.

Base Command

gz-endpoint-upload-file

Input

Argument Name Description Required
id The ID of the target endpoint for the file upload. Required
entry_id The entry ID of the file to upload. This file needs to exist in Cortex XSOAR. Required
remote_location The full folder path on the endpoint where the file will be uploaded. Required

Context Output

Path Type Description
GravityZone.Command.UploadFile.TaskID String The task ID.
GravityZone.Command.UploadFile.TaskType String The task type.
GravityZone.Command.UploadFile.EndpointID String The endpoint ID.
GravityZone.Command.UploadFile.Hostname String The endpoint name.
GravityZone.Command.UploadFile.Status String The command status.
GravityZone.Command.UploadFile.ErrorCode String The command error code, or “Success”.
GravityZone.Command.UploadFile.Error String The command error message, or “Success”.
GravityZone.Command.UploadFile.StartDate Date The start date of the command execution.
GravityZone.Command.UploadFile.EndDate Date The end date of the command execution.
GravityZone.Command.UploadFile.EntryID String The entry ID of the uploaded file.
GravityZone.Command.UploadFile.DestinationPath String The destination path of the uploaded file.

Command example

!gz-endpoint-upload-file id=6942a43afe8d4e463ca5c197 entry_id=LtvQ6B8eCFvTNo7bf3vDUD@25729aa7-7442-4231-8b98-ecb0fc29a642 remote_location=/root/test/

Context Example

{
    "GravityZone": {
        "Command": {
            "UploadFile": {
                "TaskID": "694447384f1ba9a2650ec75a",
                "TaskType": "UploadFile",
                "Status": "Processed",
                "EndDate": "2025-12-18T20:26:40Z",
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "Hostname": "ENDPOINT_NAME",
                "ErrorCode": "Success",
                "Error": "Success",
                "StartDate": "2025-12-18T20:26:00Z",
                "EntryID": "LtvQ6B8eCFvTNo7bf3vDUD@25729aa7-7442-4231-8b98-ecb0fc29a642",
                "DestinationPath": "/root/test/"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.UploadFile command on hosts 6942a43afe8d4e463ca5c197

EndpointID Hostname StartDate EndDate Error EntryID DestinationPath
6942a43afe8d4e463ca5c197 ENDPOINT_NAME 2025-12-18T20:26:00Z 2025-12-18T20:26:40Z Success LtvQ6B8eCFvTNo7bf3vDUD@25729aa7-7442-4231-8b98-ecb0fc29a642 /root/test/

gz-endpoint-list-by-running-process-hash

Retrieves endpoints that are running processes with a specified hash. The API key and the applied policy must allow Live Search. Endpoints must be online. The command waits up to five minutes for responses before timing out.

Base Command

gz-endpoint-list-by-running-process-hash

Input

Argument Name Description Required
process_hash Hash of the process. Required

Context Output

Path Type Description
GravityZone.Command.EndpointsRunningProcessHash.EndpointID String The endpoint ID.
GravityZone.Command.EndpointsRunningProcessHash.Path String The Live Search results.
GravityZone.Command.EndpointsRunningProcessHash.ProcessHash String The process hash.

Command example

!gz-endpoint-list-by-running-process-hash process_hash=b8412bcc6f47b2a11e4c39bc1bc9fab74969ff0648ba22db4c5254a0457af0c7

Context Example

{
    "GravityZone": {
        "Command": {
            "EndpointsRunningProcessHash": {
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "Path": "/opt/bitdefender-security-tools/bin/epagngd",
                "ProcessHash": "b8412bcc6f47b2a11e4c39bc1bc9fab74969ff0648ba22db4c5254a0457af0c7"
            }
        }
    }
}

Human Readable Output

Live Search Results

EndpointID ProcessHash Results
6942a43afe8d4e463ca5c197 b8412bcc6f47b2a11e4c39bc1bc9fab74969ff0648ba22db4c5254a0457af0c7 {“hostname”:”ENDPOINT_NAME”,”path”:”/opt/bitdefender-security-tools/bin/epagngd”}

gz-endpoint-get-process-tree-by-hash

Retrieves the process tree on an endpoint for a specified process hash. The applied policy must allow Live Search, and the endpoint must be online.

Base Command

gz-endpoint-get-process-tree-by-hash

Input

Argument Name Description Required
id The ID of the targeted endpoint. Required
process_hash The hash of the process to search for. Required

Context Output

Path Type Description
GravityZone.Command.ProcessTreeForHash.EndpointID String The endpoint ID.
GravityZone.Command.ProcessTreeForHash.PID Number The process ID.
GravityZone.Command.ProcessTreeForHash.Path String The process path.
GravityZone.Command.ProcessTreeForHash.Cmdline String The command line used to start the process.
GravityZone.Command.ProcessTreeForHash.ParentPID Number The parent process ID.

Command example

!gz-endpoint-get-process-tree-by-hash id=6942a43afe8d4e463ca5c197 process_hash=b8412bcc6f47b2a11e4c39bc1bc9fab74969ff0648ba22db4c5254a0457af0c7

Context Example

{
    "GravityZone": {
        "Command": {
            "ProcessTreeForHash": {
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "Cmdline": "/usr/lib/systemd/systemd --system --deserialize=73",
                "ParentPID": 0,
                "Path": "/usr/lib/systemd/systemd",
                "PID": 1
            }
        }
    }
}

Human Readable Output

Live Search Results

EndpointID ProcessHash Results
6942a43afe8d4e463ca5c197 b8412bcc6f47b2a11e4c39bc1bc9fab74969ff0648ba22db4c5254a0457af0c7 {“cmdline”:”/usr/lib/systemd/systemd –system –deserialize=73”,”parent”:”0”,”path”:”/usr/lib/systemd/systemd”,”pid”:”1”}

gz-incident-get

Retrieves incident details by ID.

Base Command

gz-incident-get

Input

Argument Name Description Required
id The ID of the incident to fetch. Required

Context Output

Path Type Description
GravityZone.Incident.ID String The incident ID.
GravityZone.Incident.Type String The incident type (‘incident’ / ‘extendedIncident’).
GravityZone.Incident.Company.Name String The GravityZone company name where the incident is located.
GravityZone.Incident.Company.ID String The GravityZone company ID where the incident is located.
GravityZone.Incident.Number Number The incident number (specific to the company).
GravityZone.Incident.Severity.Score Number The incident severity score (0 - 100).
GravityZone.Incident.Status Number The incident status.
GravityZone.Incident.ActionTaken String The action taken by the detecting technology (‘reported’ / ‘blocked’ / ‘partially_blocked’).
GravityZone.Incident.Created Date The date when the incident was detected on the endpoint / sensor.
GravityZone.Incident.LastUpdated Date The date when the incident was last updated in GravityZone or by the endpoint / sensor.
GravityZone.Incident.LastProcessed Date The date when the incident was last processed by GravityZone services.
GravityZone.Incident.Permalink String The incident URL in the GravityZone Console.
GravityZone.Incident.AssignedPriority String The priority assigned to the incident (‘unknown’ / ‘low’ / ‘medium’ / ‘high’ / ‘critical’).
GravityZone.Incident.Notes.Text String The note contents.
GravityZone.Incident.Notes.User String The username (email) of the user who wrote the note.
GravityZone.Incident.Notes.Date Date The note creation date.
GravityZone.Incident.Alerts.Name String The alert name.
GravityZone.Incident.Alerts.Date Date The date of when the alert was generated.
GravityZone.Incident.Alerts.Sensors String The list of sensors that generated the alert. Available only for ‘extendedIncident’-type incidents.
GravityZone.Incident.Alerts.Tactic String The list of tactics that generated the alert. Available only for ‘extendedIncident’-type incidents.
GravityZone.Incident.Alerts.Resources Array The list of resources involved in the ‘incident’-type incidents.
GravityZone.Incident.RawJSON JSON The raw JSON response from the GravityZone API.
GravityZone.Incident.EndpointID String The endpoint ID. Available only for ‘incident’-type incidents.
GravityZone.Incident.EndpointHostname String The endpoint hostname. Available only for ‘incident’-type incidents.
GravityZone.Incident.EndpointIP String The endpoint IP address. Available only for ‘incident’-type incidents.

Command example

!gz-incident-get id=69415c9d5f5c8b75247c58d1

Context Example

{
    "GravityZone": {
        "Incident": {
            "ActionTaken": "blocked",
            "Alerts": [
                {
                    "Date": "2025-12-16T15:20:19+02:00",
                    "DetectedBy": {
                        "Class": "EDR Detection",
                        "Name": "KeyloggingAPICall"
                    },
                    "Name": "KeyloggingAPICall",
                    "Resources": [
                        {
                            "CommandLine": "\"C:\\Windows\\System32\\notepad.exe\" C:\\Users\\bdvm\\Desktop\\New Text Document.txt",
                            "ParentPid": 5212,
                            "ParentProcessAccessPrivileges": "elevated",
                            "ParentProcessIntegrityLevel": "high",
                            "ParentProcessPath": "c:\\windows\\explorer.exe",
                            "ParentProcessUser": "TA66H0I6F225\\bdvm",
                            "Pid": 2592,
                            "ProcessAccessPrivileges": "elevated",
                            "ProcessIntegrityLevel": "high",
                            "ProcessPath": "c:\\windows\\system32\\notepad.exe",
                            "Type": "process",
                            "User": "TA66H0I6F225\\bdvm"
                        }
                    ]
                }
            ],
            "AssignedPriority": "unknown",
            "AssignedUser": null,
            "Company": {
                "ID": "611717cb22a30cee251b03f3",
                "Name": "Company"
            },
            "Created": "2025-12-16T15:20:21+02:00",
            "ID": "69415c9d5f5c8b75247c58d1",
            "LastProcessed": "2025-12-16T15:21:48+02:00",
            "LastUpdated": "2025-12-16T15:21:38+02:00",
            "Notes": [
                {
                    "Date": "2026-02-23T13:27:53+02:00",
                    "Text": "InvestigationInProgress",
                    "User": "user email"
                }
            ],
            "Number": 473,
            "Permalink": "https://gravityzone.domain/#!/incidents/view/69415c9d5f5c8b75247c58d1",
            "EndpointID" : "694148bffe8d4e463ca5bd1e",
            "EndpointHostname": "TA66H0I6F225",
            "EndpointIP": "1.1.1.1",
            "RawJSON": {
                "assignee": null,
                "attackTypes": [
                    "Malware"
                ],
                "company": {
                    "id": "611717cb22a30cee251b03f3",
                    "name": "Company"
                },
                "created": "2025-12-16T15:20:21+02:00",
                "details": {
                    "alerts": [
                        {
                            "date": "2025-12-16T15:20:19+02:00",
                            "detectedBy": {
                                "class": "EDR Detection",
                                "name": "KeyloggingAPICall"
                            },
                            "extra": [
                                {
                                    "key": "hookedApiName",
                                    "value": "Key Logging"
                                },
                                {
                                    "key": "extraInfo1",
                                    "value": "\nProcess PE VersionInfo and Certification Information: \nOriginal File Name: NOTEPAD.EXE\nInternal Name: Notepad\nFile Description: Notepad\nCompany Name: Microsoft Corporation\nFile Version: 10.0.19041.1865 (WinBuild.160101.0800)\nProduct Name: MicrosoftR WindowsR Operating System\nProduct Version: 10.0.19041.1865\nLegal Copyright: C Microsoft Corporation. All rights reserved.\nCertificate Serial: 330000033b655faefadb75e9d600000000033b\nCertificate Signer: Microsoft Corporation\nCertificate Issuer: Microsoft Corporation\n\nWorking Directory: c:\\users\\bdvm\\desktop\\"
                                }
                            ],
                            "id": "69415ce1997e9c48ed12c360",
                            "name": "KeyloggingAPICall",
                            "resources": [
                                {
                                    "details": {
                                        "commandLine": "\"C:\\Windows\\System32\\notepad.exe\" C:\\Users\\bdvm\\Desktop\\New Text Document.txt",
                                        "loadedModule": null,
                                        "loadedModulePid": null,
                                        "parentPid": 5212,
                                        "parentProcessAccessPrivileges": "elevated",
                                        "parentProcessCmdline": null,
                                        "parentProcessIntegrityLevel": "high",
                                        "parentProcessPath": "c:\\windows\\explorer.exe",
                                        "parentProcessUser": "TA66H0I6F225\\bdvm",
                                        "pid": 2592,
                                        "processAccessPrivileges": "elevated",
                                        "processInjectionSizeofWrite": null,
                                        "processInjectionTarget": null,
                                        "processInjectionTargetPid": null,
                                        "processInjectionWriter": null,
                                        "processInjectionWriterPid": null,
                                        "processIntegrityLevel": "high",
                                        "processPackerName": null,
                                        "processPath": "c:\\windows\\system32\\notepad.exe",
                                        "processPathSize": null,
                                        "user": "TA66H0I6F225\\bdvm"
                                    },
                                    "type": "process"
                                }
                            ]
                        }
                    ],
                    "computerFqdn": "ta66h0i6f225",
                    "computerId": "694148bffe8d4e463ca5bd1e",
                    "computerIp": "1.1.1.1",
                    "computerMacAddresses": [
                        "005056a7862b"
                    ],
                    "computerName": "TA66H0I6F225",
                    "counters": {
                        "domains": 0,
                        "endpoints": 1,
                        "events": 17,
                        "files": 3,
                        "processes": 4,
                        "registries": 0,
                        "storages": 0
                    },
                    "detectionName": "BAT.Trojan.FormatC.Z",
                    "mitreTags": [
                        {
                            "category": "Execution",
                            "techniques": [
                                {
                                    "id": "T1059",
                                    "name": "Command and Scripting Interpreter",
                                    "subtechniques": null
                                }
                            ]
                        }
                    ],
                    "nodes": [
                        {
                            "alertIds": [
                                "69415ce1997e9c48ed12c361"
                            ],
                            "details": {
                                "file": {
                                    "isExecutable": true,
                                    "md5": null,
                                    "name": "<system>",
                                    "path": "<system>",
                                    "sha256": null,
                                    "size": 0
                                },
                                "killProcess": null,
                                "process": {
                                    "commandLine": "<did_not_receive>",
                                    "date": "2025-12-16T14:05:30+02:00",
                                    "name": "<system>",
                                    "parent": {
                                        "name": "<SYSTEM>",
                                        "path": null,
                                        "pid": 0
                                    },
                                    "pid": 0,
                                    "userId": null,
                                    "userName": "NT AUTHORITY\\SYSTEM"
                                },
                                "quarantine": null,
                                "sandbox": null
                            },
                            "id": "69415c9d5f5c8b75247c58e4",
                            "name": "<system>",
                            "type": "process_execution"
                        }
                    ],
                    "partOf": null,
                    "transitions": [
                        {
                            "date": "2025-12-16T15:19:59+02:00",
                            "from": "69415c9d5f5c8b75247c58e2",
                            "to": "69415c9d5f5c8b75247c58e5"
                        }
                    ],
                    "triggerNodeId": "69415c9d5f5c8b75247c58e5"
                },
                "incidentId": "69415c9d5f5c8b75247c58d1",
                "incidentLink": "https://gravityzone.domain/#!/incidents/view/69415c9d5f5c8b75247c58d1",
                "incidentNumber": 473,
                "incidentType": "incident",
                "lastProcessed": "2025-12-16T15:21:48+02:00",
                "lastUpdated": "2025-12-16T15:21:38+02:00",
                "mainAction": "blocked",
                "notes": [
                    {
                        "created": "2026-02-23T13:27:53+02:00",
                        "id": "699c39b9cf8645f670042eb0",
                        "text": "InvestigationInProgress",
                        "userId": "6941466eda1158ec9f0ecb5d",
                        "userName": "user email"
                    }
                ],
                "priority": "unknown",
                "severityScore": 43,
                "status": "open"
            },
            "Severity": {
                "Score": 43
            },
            "Status": 0,
            "Type": "incident"
        }
    }
}

Human Readable Output

GravityZone Incident

Action Taken Assigned Priority Assigned User Company Name Created Endpoint ID Endpoint IP Endpoint Name ID Last Processed Last Updated Number Permalink Severity Score Status Type
Blocked Unknown Unassigned Company 2025-12-16T15:20:21+02:00 694148bffe8d4e463ca5bd1e 1.1.1.1 TA66H0I6F225 69415c9d5f5c8b75247c58d1 2025-12-16T15:21:48+02:00 2025-12-16T15:21:38+02:00 473 https://gravityzone.domain/#!/incidents/view/69415c9d5f5c8b75247c58d1 43% 0 (Pending) Incident (EDR)

Incident Notes

Text User Date
InvestigationInProgress user email 2026-02-23T13:27:53+02:00

Incident Alerts

Date Detected By Name Resources
2025-12-16T15:20:19+02:00 KeyloggingAPICall (EDR Detection) KeyloggingAPICall [{“Pid”: 2592,”ProcessPath”: “c:\windows\system32\notepad.exe”,”CommandLine”: “"C:\Windows\System32\notepad.exe" C:\Users\bdvm\Desktop\New Text Document.txt”,”ParentPid”: 5212,”ParentProcessPath”: “c:\windows\explorer.exe”,”ParentProcessUser”: “TA66H0I6F225\bdvm”,”User”: “TA66H0I6F225\bdvm”,”ProcessAccessPrivileges”: “elevated”,”ParentProcessAccessPrivileges”: “elevated”,”ProcessIntegrityLevel”: “high”,”ParentProcessIntegrityLevel”: “high”,”Type”: “process”}]

gz-incident-list

Retrieves incidents within the last three days from all endpoints or a specific endpoint.

Base Command

gz-incident-list

Input

Argument Name Description Required
from_date The start date to retrieve incidents from. The default value is the current date minus three days. Optional
to_date The end date to retrieve incidents until. The default value is the current date and time. Optional
limit The maximum number of incidents to retrieve. Optional
endpoint_id The ID of the endpoint to list incidents for. Optional

Context Output

Path Type Description
GravityZone.IncidentsList.ID String The incident ID.
GravityZone.IncidentsList.Type String The incident type (‘incident’ / ‘extendedIncident’).
GravityZone.IncidentsList.CompanyName String The GravityZone company name where the incident is located.
GravityZone.IncidentsList.Number Number The incident number (specific to the company).
GravityZone.IncidentsList.SeverityScore Number The incident severity score (0 - 100).
GravityZone.IncidentsList.Status Number The incident status.
GravityZone.IncidentsList.ActionTaken String The action taken by the detecting technology (‘reported’ / ‘blocked’ / ‘partially_blocked’).
GravityZone.IncidentsList.Created Date The date when the incident was detected on the endpoint / sensor.
GravityZone.IncidentsList.LastUpdated Date The date when the incident was last updated in GravityZone or by the endpoint / sensor.
GravityZone.IncidentsList.LastProcessed Date The incident last processed date by GravityZone services.
GravityZone.IncidentsList.Permalink String The incident URL in the GravityZone Console.
GravityZone.IncidentsList.AssignedPriority String The priority assigned to the incident (‘unknown’ / ‘low’ / ‘medium’ / ‘high’ / ‘critical’).
GravityZone.IncidentsList.AssignedUserId String The ID of the user assigned to the incident.
GravityZone.IncidentsList.RawJSON JSON The raw JSON response from the GravityZone API.
GravityZone.IncidentsList.EndpointID String The endpoint ID. Available only for ‘incident’-type incidents.
GravityZone.IncidentsList.EndpointHostname String The endpoint hostname. Available only for ‘incident’-type incidents.
GravityZone.IncidentsList.EndpointIP String The endpoint IP address. Available only for ‘incident’-type incidents.

Command example


#### Context Example

```json
{
    "GravityZone": {
        "IncidentsList": [
            {
                "ActionTaken": "reported",
                "AssignedPriority": "unknown",
                "AssignedUserId": null,
                "AttackTypes": [
                    "Persistence"
                ],
                "CompanyID": "611717cb22a30cee251b03f3",
                "CompanyName": "Company",
                "Created": "2026-02-23T13:09:34+02:00",
                "ID": "699c367136732459d7d3b1af",
                "LastProcessed": "2026-02-23T13:13:53+02:00",
                "LastUpdated": "2026-02-23T13:09:34+02:00",
                "Number": 1017,
                "Permalink": "https://gravityzone.domain/#!/incidents/view/699c367136732459d7d3b1af",
                "RawJSON": {
                    "assignee": null,
                    "attackTypes": [
                        "Persistence"
                    ],
                    "company": {
                        "id": "611717cb22a30cee251b03f3",
                        "name": "Company"
                    },
                    "created": "2026-02-23T13:09:34+02:00",
                    "details": {
                        "contains": null,
                        "counters": {
                            "ADInstances": 0,
                            "AWSInstances": 0,
                            "DGAs": 0,
                            "DNSs": 0,
                            "GCPInstances": 0,
                            "IPs": 0,
                            "IoTs": 0,
                            "atlassianBitbucketProducts": 0,
                            "atlassianConfluenceProducts": 0,
                            "atlassianInstances": 0,
                            "atlassianJiraProducts": 0,
                            "azureADInstances": 1,
                            "bitbucketProjects": 0,
                            "cloudStorages": 0,
                            "confluenceSpaces": 0,
                            "containers": 0,
                            "databases": 0,
                            "domains": 0,
                            "emails": 0,
                            "endpoints": 0,
                            "exfiltratedFiles": 0,
                            "externalDrives": 0,
                            "externalSources": 0,
                            "googleWorkspaceInstances": 0,
                            "identities": 1,
                            "internalEmails": 0,
                            "internalIPs": 0,
                            "mobileDevices": 0,
                            "office365Instances": 0,
                            "printers": 0,
                            "routers": 0,
                            "servers": 0,
                            "storages": 0,
                            "torNodes": 0,
                            "users": 1,
                            "virtualDesktops": 0
                        },
                        "partOf": null
                    },
                    "incidentId": "699c367136732459d7d3b1af",
                    "incidentLink": "https://gravityzone.domain/#!/incidents/view/699c367136732459d7d3b1af",
                    "incidentNumber": 1017,
                    "incidentType": "extendedIncident",
                    "lastProcessed": "2026-02-23T13:13:53+02:00",
                    "lastUpdated": "2026-02-23T13:09:34+02:00",
                    "mainAction": "reported",
                    "priority": "unknown",
                    "severityScore": 71,
                    "status": "in_progress"
                },
                "SeverityScore": 71,
                "Status": 1,
                "Type": "extendedIncident"
            }
        ]
    }
}

Human Readable Output

GravityZone Incidents List

ActionTaken Assigned Priority Assigned User ID Attack Types Company Name Created ID Last Processed Last Updated Number Permalink Severity Score Status Type
Reported Unknown Unassigned Persistence Company 2026-02-23T13:09:34+02:00 699c367136732459d7d3b1af 2026-02-23T13:13:53+02:00 2026-02-23T13:09:34+02:00 1017 https://gravityzone.domain/#!/incidents/view/699c367136732459d7d3b1af 71% 1 (Active) Extended Incident (XDR)

Command example

!gz-incident-list from_date="2026-02-20" to_date="2026-02-21" limit="1"

Context Example

{
    "GravityZone": {
        "IncidentsList": [
            {
                "ActionTaken": "reported",
                "AssignedPriority": "unknown",
                "AssignedUserId": null,
                "AttackTypes": [
                    "Persistence"
                ],
                "CompanyID": "611717cb22a30cee251b03f3",
                "CompanyName": "Company",
                "Created": "2026-02-20T20:58:17+02:00",
                "ID": "6998b40f36732459d7d3aa58",
                "LastProcessed": "2026-02-20T21:20:47+02:00",
                "LastUpdated": "2026-02-20T20:58:17+02:00",
                "Number": 998,
                "Permalink": "https://gravityzone.domain/#!/incidents/view/6998b40f36732459d7d3aa58",
                "RawJSON": {
                    "assignee": null,
                    "attackTypes": [
                        "Persistence"
                    ],
                    "company": {
                        "id": "611717cb22a30cee251b03f3",
                        "name": "Company"
                    },
                    "created": "2026-02-20T20:58:17+02:00",
                    "details": {
                        "contains": null,
                        "counters": {
                            "ADInstances": 0,
                            "AWSInstances": 0,
                            "DGAs": 0,
                            "DNSs": 0,
                            "GCPInstances": 0,
                            "IPs": 0,
                            "IoTs": 0,
                            "atlassianBitbucketProducts": 0,
                            "atlassianConfluenceProducts": 0,
                            "atlassianInstances": 0,
                            "atlassianJiraProducts": 0,
                            "azureADInstances": 1,
                            "bitbucketProjects": 0,
                            "cloudStorages": 0,
                            "confluenceSpaces": 0,
                            "containers": 0,
                            "databases": 0,
                            "domains": 0,
                            "emails": 0,
                            "endpoints": 0,
                            "exfiltratedFiles": 0,
                            "externalDrives": 0,
                            "externalSources": 0,
                            "googleWorkspaceInstances": 0,
                            "identities": 1,
                            "internalEmails": 0,
                            "internalIPs": 0,
                            "mobileDevices": 0,
                            "office365Instances": 0,
                            "printers": 0,
                            "routers": 0,
                            "servers": 0,
                            "storages": 0,
                            "torNodes": 0,
                            "users": 1,
                            "virtualDesktops": 0
                        },
                        "partOf": null
                    },
                    "incidentId": "6998b40f36732459d7d3aa58",
                    "incidentLink": "https://gravityzone.domain/#!/incidents/view/6998b40f36732459d7d3aa58",
                    "incidentNumber": 998,
                    "incidentType": "extendedIncident",
                    "lastProcessed": "2026-02-20T21:20:47+02:00",
                    "lastUpdated": "2026-02-20T20:58:17+02:00",
                    "mainAction": "reported",
                    "priority": "unknown",
                    "severityScore": 71,
                    "status": "open"
                },
                "SeverityScore": 71,
                "Status": 0,
                "Type": "extendedIncident"
            }
        ]
    }
}

Human Readable Output

GravityZone Incidents List

ActionTaken Assigned Priority Assigned User ID Attack Types Company Name Created ID Last Processed Last Updated Number Permalink Severity Score Status Type
Reported Unknown Unassigned Persistence Company 2026-02-20T20:58:17+02:00 6998b40f36732459d7d3aa58 2026-02-20T21:20:47+02:00 2026-02-20T20:58:17+02:00 998 http://gravityzone.domain/#!/incidents/view/6998b40f36732459d7d3aa58 71% 0 (Pending) Extended Incident (XDR)

Command example

!gz-incident-list endpoint_id=694148bffe8d4e463ca5bd1e from_date="2025-11-20"

Context Example

{
    "GravityZone": {
        "IncidentsList": [
            {
                "ActionTaken": "reported",
                "AssignedPriority": "critical",
                "AssignedUserId": "6540b72b1ffbc14e1808bc00",
                "AttackTypes": [
                    "Malware"
                ],
                "CompanyID": "611717cb22a30cee251b03f3",
                "CompanyName": "Company",
                "Created": "2025-12-17T09:02:03+02:00",
                "ID": "694255755f5c8b75247c7ce2",
                "LastProcessed": "2025-12-17T09:02:13+02:00",
                "LastUpdated": "2025-12-17T09:02:03+02:00",
                "Number": 477,
                "Permalink": "https://gravityzone.domain/#!/incidents/view/694255755f5c8b75247c7ce2",
                "EndpointID" : "694148bffe8d4e463ca5bd1e",
                "EndpointHostname": "TA66H0I6F225",
                "EndpointIP": "1.1.1.1",
                "RawJSON": {
                    "assignee": "6540b72b1ffbc14e1808bc00",
                    "attackTypes": [
                        "Malware"
                    ],
                    "company": {
                        "id": "611717cb22a30cee251b03f3",
                        "name": "Company"
                    },
                    "created": "2025-12-17T09:02:03+02:00",
                    "details": {
                        "computerFqdn": "ta66h0i6f225",
                        "computerId": "694148bffe8d4e463ca5bd1e",
                        "computerIp": "1.1.1.1",
                        "computerMacAddresses": [
                            "005056a7862b"
                        ],
                        "computerName": "TA66H0I6F225",
                        "counters": {
                            "domains": 0,
                            "endpoints": 1,
                            "events": 6,
                            "files": 0,
                            "processes": 2,
                            "registries": 0,
                            "storages": 0
                        },
                        "detectionName": "RegSecurityDump",
                        "partOf": null
                    },
                    "incidentId": "694255755f5c8b75247c7ce2",
                    "incidentLink": "https://gravityzone.domain/#!/incidents/view/694255755f5c8b75247c7ce2",
                    "incidentNumber": 477,
                    "incidentType": "incident",
                    "lastProcessed": "2025-12-17T09:02:13+02:00",
                    "lastUpdated": "2025-12-17T09:02:03+02:00",
                    "mainAction": "reported",
                    "priority": "critical",
                    "severityScore": 33,
                    "status": "closed"
                },
                "SeverityScore": 33,
                "Status": 2,
                "Type": "incident"
            }
        ]
    }
}

Human Readable Output

GravityZone Incidents List

ActionTaken Assigned Priority Assigned User ID Attack Types Company Name Created Endpoint ID Endpoint IP Endpoint Name ID Last Processed Last Updated Number Permalink Severity Score Status Type
Reported Critical 6540b72b1ffbc14e1808bc00 Malware Company 2025-12-17T09:02:03+02:00 694148bffe8d4e463ca5bd1e 1.1.1.1 TA66H0I6F225 694255755f5c8b75247c7ce2 2025-12-17T09:02:13+02:00 2025-12-17T09:02:03+02:00 477 https://gravityzone.domain/#!/incidents/view/694255755f5c8b75247c7ce2 33% 2 (Done) Incident (EDR)

gz-incident-add-note

Adds a note to one or more incidents.

Base Command

gz-incident-add-note

Input

Argument Name Description Required
id The IDs of the incidents to add a note to. Supports comma separated values. Required
note The note to add to the incidents. Required

Context Output

Path Type Description
GravityZone.Command.AddIncidentNote.IncidentID String The incident ID.
GravityZone.Command.AddIncidentNote.Note String The requested note.
GravityZone.Command.AddIncidentNote.CommandStatus String The command status.

Command example

!gz-incident-add-note id=69415c9d5f5c8b75247c58d1 note=InvestigationInProgress

Context Example

{
    "GravityZone": {
        "Command": {
            "AddIncidentNote": {
                "CommandStatus": "Success",
                "IncidentID": "69415c9d5f5c8b75247c58d1",
                "Note": "InvestigationInProgress"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.AddIncidentNote command on incidents 69415c9d5f5c8b75247c58d1

IncidentID Note CommandStatus
69415c9d5f5c8b75247c58d1 InvestigationInProgress Success

gz-incident-change-status

Changes the status of one or more incidents.

Base Command

gz-incident-change-status

Input

Argument Name Description Required
id The IDs of the incidents to update. Supports comma separated values. Required
status The new status of the incidents. Possible values are: PENDING, ACTIVE, DONE, ARCHIVE. Required

Context Output

Path Type Description
GravityZone.Command.ChangeIncidentStatus.IncidentID String The incident ID.
GravityZone.Command.ChangeIncidentStatus.IncidentStatus String The requested status of the incident.
GravityZone.Command.ChangeIncidentStatus.CommandStatus String The command status.

Command example

!gz-incident-change-status id=69415c9d5f5c8b75247c58d1 status=ACTIVE

Context Example

{
    "GravityZone": {
        "Command": {
            "ChangeIncidentStatus": {
                "CommandStatus": "Success",
                "IncidentID": "69415c9d5f5c8b75247c58d1",
                "IncidentStatus": "ACTIVE"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.ChangeIncidentStatus command on incidents 69415c9d5f5c8b75247c58d1

IncidentID IncidentStatus CommandStatus
69415c9d5f5c8b75247c58d1 ACTIVE Success

gz-poll-investigation-activity-status

Checks the status of an investigation activity. This command is not intended for direct use.

Base Command

gz-poll-investigation-activity-status

Input

Argument Name Description Required
target_id The endpoint ID. Required
activity_id The activity ID. Required
output_file The path of the output file. Optional
metadata The metadata to pass to the task. Optional

Context Output

There is no context output for this command.

gz-poll-live-search-status

Checks the status of a Live Search query. This command is not intended for direct use.

Base Command

gz-poll-live-search-status

Input

Argument Name Description Required
task_id The task ID. Required
search_type The Live Search query type. Optional
metadata The metadata to pass to the task. Optional

Context Output

There is no context output for this command.

gz-poll-task-status

Checks the status of a task. This command is not intended for direct use.

Base Command

gz-poll-task-status

Input

Argument Name Description Required
task_id The task ID. Required
metadata The metadata to pass to the task. Optional

Context Output

There is no context output for this command.

get-modified-remote-data

Retrieves incidents that were modified since the last data sync. This command is intended for debugging purposes.

Base Command

get-modified-remote-data

Input

Argument Name Description Required
lastUpdate The time when the incident was last updated. Required

Context Output

There is no context output for this command.

get-remote-data

Retrieves data from a remote incident without updating the current incident. This command is intended for debugging purposes.

Base Command

get-remote-data

Input

Argument Name Description Required
id The ID of the incident to fetch. Required
lastUpdate The time when the incident was last updated. Required

Context Output

There is no context output for this command.

update-remote-system

Updates the remote incident with local incident changes without updating the current incident. This command is intended for debugging purposes.

Base Command

update-remote-system

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

get-mapping-fields

Returns the list of fields available for outgoing mirroring. This command is intended for debugging purposes only.

Base Command

get-mapping-fields

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and GravityZone corresponding incidents (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

  1. Enable Fetching incidents in your instance configuration.

  2. In the Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:

    Option Description
    None Disables incident mirroring.
    Incoming Reflects status changes from GravityZone incidents in Cortex XSOAR incidents.
    Outgoing Reflects status changes from Cortex XSOAR incidents in GravityZone incidents.
    Both Synchronizes status changes bidirectionally between Cortex XSOAR and GravityZone incidents.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.

gz-endpoint-users-loggedin

Retrieves details of all active user sessions on a specific managed endpoint.

Base Command

gz-endpoint-users-loggedin

Input

Argument Name Description Required
id The target endpoint ID. The endpoint must be accessible to you. Required

Context Output

Path Type Description
GravityZone.Endpoint.ID String The endpoint ID.
GravityZone.Endpoint.Hostname String The endpoint hostname.
GravityZone.Endpoint.ActiveSessions.Username String The username of the currently logged-in user.
GravityZone.Endpoint.ActiveSessions.ConnectionType String The connection type for the session.
GravityZone.Endpoint.ActiveSessions.StartTime Date The session start time, if available (e.g., “2021-05-19T10:37:56Z”).
GravityZone.Endpoint.ActiveSessions.UserSID String The Security Identifier (SID) of the logged-in user, if available.
GravityZone.Endpoint.ActiveSessions.DomainSID String The Security Identifier (SID) of the logged-in user’s domain, if available.
GravityZone.Endpoint.ActiveSessions.OrganizationalUnitDN String The full distinguished name (DN) of the organizational unit, if available.
GravityZone.Endpoint.ActiveSessions.MemberOfSIDs Array The SIDs for the groups to which the logged-in user belongs, if available.

Command example

!gz-endpoint-users-loggedin id=6942a43afe8d4e463ca5c197

Context Example

{
    "GravityZone": {
        "Endpoint": {
            "ID": "6942a43afe8d4e463ca5c197",
            "Hostname": "bdvm",
            "ActiveSessions": [
                {
                    "Username": "user@example.com",
                    "ConnectionType": "local",
                    "StartTime": "2021-05-19T10:37:56Z",
                    "UserSID": "S-1-5-21-1111111111-1111111111-1111111111-1001",
                    "DomainSID": "S-1-5-21-1111111111-1111111111-1111111111",
                    "OrganizationalUnitDN": "OU=Users,DC=example,DC=com",
                    "MemberOfSIDs": [
                        "S-1-5-32-544",
                        "S-1-5-32-545"
                    ]
                }
            ]
        }
    }
}

Human Readable Output

Active sessions on endpoint 6942a43afe8d4e463ca5c197

Username ConnectionType StartTime UserSID DomainSID OrganizationalUnitDN MemberOfSIDs
TESTDOMAIN\full.user local 2021-05-19T10:37:56Z S-1-2-25-33 S-1-23-131231 OU=office,OU=Developers,OU=Users,DC=microsoft,DC=com S-1-5-32-450
basic.user remote 2021-05-19T11:00:00Z        

gz-endpoint-create-memory-dump

Initiates the creation of a memory dump for the specified endpoint. Once the dump is successfully generated, the resulting archive is uploaded to the Bitdefender cloud.

Important:

  • Please contact Bitdefender Enterprise Support to configure this feature.
  • The resulting memory dump archive is automatically deleted from the Bitdefender cloud after 24 hours.
  • The memory dump creation task completes successfully only when the generated memory dump archive is 16 GB or smaller.

Base Command

gz-endpoint-create-memory-dump

Input

Argument Name Description Required
id The target endpoint ID. The endpoint must be accessible and run a Windows operating system. Required
path The full path to the destination folder on the specified endpoint where the memory dump archive will be created. Required
password The password used to secure the memory dump archive after it is created. It must contain at least 12 characters, including one uppercase letter, one lowercase letter, one digit, and one special character. Required
polling Whether the command waits for the memory dump task completion. If set to true, the command returns the final result after the task completes. If set to false, the command returns only the endpoint ID and task ID immediately after the task is initiated. Optional

Context Output

Path Type Description
GravityZone.MemoryDump.TaskID String The memory dump task ID.
GravityZone.MemoryDump.TaskType String The task type.
GravityZone.MemoryDump.Status String The memory dump task status.
GravityZone.MemoryDump.EndpointID String The endpoint ID.
GravityZone.MemoryDump.Hostname String The endpoint hostname.
GravityZone.MemoryDump.StartDate Date The date and time when the memory dump task started (e.g., “2026-05-25T10:00:00Z”).
GravityZone.MemoryDump.EndDate Date The date and time when the memory dump task ended, if available (e.g., “2026-05-25T10:01:00Z”).
GravityZone.MemoryDump.ErrorCode String An error code if the memory dump task fails, or “Success” if the task completes successfully.
GravityZone.MemoryDump.Error String An error message if the memory dump task fails, or “Success” if the task completes successfully.
GravityZone.MemoryDump.DownloadURL String The memory dump download URL, available after the task completes successfully.

Command example

!gz-endpoint-create-memory-dump id=6942a43afe8d4e463ca5c197 password="ComplexPass123!" path=C:\\test2

Context Example

{
    "GravityZone": {
        "MemoryDump": {
            "TaskID": "6836f4a01a2b3c4d5e6f7a8b",
            "TaskType": "CreateMemoryDump",
            "Status": "Processed",
            "EndpointID": "6942a43afe8d4e463ca5c197",
            "Hostname": "bdvm",
            "StartDate": "2026-05-25T10:00:00Z",
            "EndDate": "2026-05-25T10:01:00Z",
            "ErrorCode": "Success",
            "Error": "Success",
            "DownloadURL": "https://example.com/memory-dump.zip"
        }
    }
}

Human Readable Output

This example illustrates the human-readable output when polling is set to true. When polling is false, the table contains only the task ID and endpoint ID.

Memory dump for endpoint 6942a43afe8d4e463ca5c197

EndpointID Hostname StartDate EndDate Error DownloadURL
6942a43afe8d4e463ca5c197 bdvm 2026-05-25T10:00:00Z 2026-05-25T10:01:00Z Success https://example.com/memory-dump.zip

gz-endpoint-memory-dump-status

Verifies the status of a task initiated via gz-endpoint-create-memory-dump.

Base Command

gz-endpoint-memory-dump-status

Input

Argument Name Description Required
task_id The ID of the task started through gz-endpoint-create-memory-dump. This ID is returned upon task initiation. Required
endpoint_id The ID of the endpoint for which the specified task was initiated. Required
polling Whether the command waits for the gz-endpoint-create-memory-dump task completion. If set to true, the command returns the final result after the task completes successfully or fails. If set to false, the command returns immediately, providing only the task status. Optional

Context Output

Path Type Description
GravityZone.MemoryDump.TaskID String The ID of the task started through gz-endpoint-create-memory-dump.
GravityZone.MemoryDump.TaskType String The task type.
GravityZone.MemoryDump.Status String The status of the task started through gz-endpoint-create-memory-dump.
GravityZone.MemoryDump.EndpointID String The endpoint ID.
GravityZone.MemoryDump.Hostname String The endpoint hostname.
GravityZone.MemoryDump.StartDate Date The date and time when the memory dump task started (e.g., “2026-05-25T10:00:00Z”).
GravityZone.MemoryDump.EndDate Date The date and time when the memory dump task ended, if available (e.g., “2026-05-25T10:01:00Z”).
GravityZone.MemoryDump.ErrorCode String An error code if the task started through gz-endpoint-create-memory-dump fails, or “Success” if the task completes successfully.
GravityZone.MemoryDump.Error String An error message if the task started through gz-endpoint-create-memory-dump fails, or “Success” if the task completes successfully.
GravityZone.MemoryDump.DownloadURL String The memory dump download URL, available after the memory dump creation task completes successfully.

Command example

!gz-endpoint-memory-dump-status task_id=6836f4a01a2b3c4d5e6f7a8b endpoint_id=6942a43afe8d4e463ca5c197

Context Example

{
    "GravityZone": {
        "MemoryDump": {
            "TaskID": "6836f4a01a2b3c4d5e6f7a8b",
            "TaskType": "CreateMemoryDump",
            "Status": "Processed",
            "EndpointID": "6942a43afe8d4e463ca5c197",
            "Hostname": "bdvm",
            "StartDate": "2026-05-25T10:00:00Z",
            "EndDate": "2026-05-25T10:01:00Z",
            "ErrorCode": "Success",
            "Error": "Success",
            "DownloadURL": "https://example.com/memory-dump.zip"
        }
    }
}

Human Readable Output

This example illustrates the human-readable output when polling is set to true. When polling is false, only the status of the memory dump creation task is displayed.

Memory dump for endpoint 6942a43afe8d4e463ca5c197

EndpointID Hostname StartDate EndDate Error DownloadURL
6942a43afe8d4e463ca5c197 bdvm 2026-05-25T10:00:00Z 2026-05-25T10:01:00Z Success https://example.com/memory-dump.zip

gz-poll-endpoint-users-loggedin-status

Verifies the status of a task initiated via gz-endpoint-users-loggedin. This command is invoked automatically and is not intended for direct use.

Base Command

gz-poll-endpoint-users-loggedin-status

Input

Argument Name Description Required
task_id The ID of the task started through gz-endpoint-users-loggedin. Required
endpoint_id The ID of the managed endpoint associated with the specified task. Required

Context Output

There is no context output for this command.

Configuration parameters

  • url — Server URL (required)
  • credentials — (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • max_fetch — Maximum incidents to fetch
  • first_fetch — First fetch time
  • mirror_direction — Mirroring Direction
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval

Commands (27)

  • fetch-incidents

    Retrieves incidents from GravityZone Cloud.

  • get-mapping-fields

    Returns the list of fields available for outgoing mirroring. This command is intended for debugging purposes only.

  • get-modified-remote-data

    Retrieves incidents that were modified since the last data sync. This command is intended for debugging purposes.

  • get-remote-data

    Retrieves data from a remote incident without updating the current incident. This command is intended for debugging purposes.

  • gz-endpoint-create-memory-dump

    Initiates the creation of a memory dump for the specified endpoint. Once the dump is successfully generated, the resulting archive is uploaded to the Bitdefender cloud.

  • gz-endpoint-deisolate

    Restores an isolated endpoint to the network.

  • gz-endpoint-download-file

    Downloads a file from an endpoint.

  • gz-endpoint-download-investigation-package

    Collects and downloads an investigation package from an endpoint.

  • gz-endpoint-get

    Retrieves endpoint details by endpoint ID.

  • gz-endpoint-get-process-tree-by-hash

    Retrieves the process tree on an endpoint for a specified process hash. The applied policy must allow Live Search and the endpoint must be online.

  • gz-endpoint-isolate

    Isolates an endpoint from the network.

  • gz-endpoint-kill-process

    Terminates a process on an endpoint by process ID.

  • gz-endpoint-list

    Retrieves the list of managed endpoints.

  • gz-endpoint-list-by-running-process-hash

    Retrieves endpoints that are running processes with a specified hash. The API key and the applied policy must allow Live Search and endpoints must be online. The command waits up to five minutes for responses before timing out.

  • gz-endpoint-memory-dump-status

    Verifies the status of a task initiated via gz-endpoint-create-memory-dump.

  • gz-endpoint-run-command

    Runs a command on the endpoint. The applied policy must have remote shell enabled for this action to work.

  • gz-endpoint-upload-file

    Uploads a file to an endpoint.

  • gz-endpoint-users-loggedin

    Retrieves details of all active user sessions on a specific managed endpoint.

  • gz-incident-add-note

    Adds a note to one or more incidents.

  • gz-incident-change-status

    Changes the status of one or more incidents.

  • gz-incident-get

    Retrieves incident details by ID.

  • gz-incident-list

    Retrieves incidents from the last three days for all endpoints or for a specific endpoint.

  • gz-poll-endpoint-users-loggedin-status

    Verifies the status of a task initiated via gz-endpoint-users-loggedin. This command is invoked automatically and is not intended for direct use.

  • gz-poll-investigation-activity-status

    Checks the status of an investigation activity. This command is not intended for direct use.

  • gz-poll-live-search-status

    Checks the status of a Live Search query. This command is not intended for direct use.

  • gz-poll-task-status

    Checks the task status. This command is not intended for direct use.

  • update-remote-system

    Updates the remote incident with local incident changes without updating the current incident. This command is intended for debugging purposes.

Source

GravityZone.py GravityZone_test.py GravityZone.yml GravityZone_description.md command_examples.txt
Download History Raw 
category: Endpoint
sectionorder:
- Connect
- Collect
commonfields:
  id: GravityZone
  version: -1
configuration:

- name: url
  display: Server URL
  type: 0
  required: true
  section: Connect
  options:
  - https://cloud.gravityzone.bitdefender.com/
  - https://cloudgz.gravityzone.bitdefender.com/
  - https://cloudap.gravityzone.bitdefender.com/
  additionalinfo: The URL of your GravityZone Cloud instance.

- name: credentials
  type: 9
  required: true
  displaypassword: API key
  hiddenusername: true
  section: Connect
  additionalinfo: API key to access the service REST API.

- name: insecure
  display: Trust any certificate (not secure)
  required: false
  advanced: true
  type: 8
  section: Connect
  additionalinfo: When selected, the server certificates are not verified.

- name: proxy
  display: Use system proxy settings
  required: false
  advanced: true
  type: 8
  section: Connect
  additionalinfo: Use the system proxy settings for connecting to the server.

- name: isFetch
  display: Fetch incidents
  type: 8
  required: false
  section: Collect
  additionalinfo: When selected, the integration will fetch incidents from the server.

- additionalinfo: The maximum number of incidents per fetch. Default is 50.
  defaultvalue: '50'
  display: Maximum incidents to fetch
  name: max_fetch
  section: Collect
  type: 0
  required: false

- name: first_fetch
  display: First fetch time
  type: 0
  required: false
  defaultvalue: 3 days
  section: Collect
  additionalinfo: The time period from which the first fetch starts. Default is three days.

- name: mirror_direction
  additionalinfo: The incident mirroring direction. You can mirror "Incoming" (from GravityZone to Cortex XSOAR), "Outgoing" (from Cortex XSOAR to GravityZone), or in both directions.
  display: Mirroring Direction
  type: 15
  options:
  - None
  - Incoming
  - Outgoing
  - Both
  section: Collect
  required: false

- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
defaultmapperin: GravityZone - Incoming Mapper
defaultclassifier: GravityZone - Classifier
description: GravityZone provides secure access to incident and endpoint data and enables remediation actions through its APIs.
display: GravityZone
name: GravityZone
script:
  commands:

  - name: fetch-incidents
    description: Retrieves incidents from GravityZone Cloud.
    arguments: []

  - name: gz-endpoint-list
    description: Retrieves the list of managed endpoints.
    arguments:
    - name: limit
      isArray: false
      description: The maximum number of endpoints to retrieve.
      required: false
      secret: false
      default: false
    - name: name
      isArray: false
      description: The endpoint name filter. Returns endpoints whose hostnames start with the specified value. The value must be at least 3 characters long. Supports an optional single leading '*' wildcard pattern.
      required: false
      secret: false
      default: false
    - name: node_id
      isArray: false
      description: The ID of the target GravityZone company or network inventory group. If not specified, the default value is the ID of the company associated with the API key used to make the request.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: GravityZone.EndpointsList.ID
      description: The endpoint ID.
      type: String
    - contextPath: GravityZone.EndpointsList.Hostname
      description: The endpoint hostname.
      type: String
    - contextPath: GravityZone.EndpointsList.IP
      description: The endpoint IP address.
      type: String
    - contextPath: GravityZone.EndpointsList.OS
      description: The endpoint operating system version.
      type: String
    - contextPath: GravityZone.EndpointsList.MAC
      description: The endpoint MAC address.
      type: String
    - contextPath: GravityZone.EndpointsList.Vendor
      description: The endpoint vendor.
      type: String
    - contextPath: GravityZone.EndpointsList.FQDN
      description: The endpoint's fully qualified domain name (FQDN).
      type: String
    - contextPath: GravityZone.EndpointsList.CompanyID
      description: The GravityZone company ID where the endpoint is located.
      type: String
    - contextPath: GravityZone.EndpointsList.GroupID
      description: The GravityZone group ID where the endpoint is located.
      type: String

  - name: gz-endpoint-get
    description: Retrieves endpoint details by endpoint ID.
    compliantpolicies:
    - EndPoint Isolation
    - User Hard Remediation
    arguments:
    - name: id
      isArray: false
      description: The ID of the endpoint to retrieve.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: GravityZone.Endpoint.ID
      description: The endpoint ID.
      type: String
    - contextPath: GravityZone.Endpoint.Hostname
      description: The endpoint hostname.
      type: String
    - contextPath: GravityZone.Endpoint.IP
      description: The endpoint IP address.
      type: String
    - contextPath: GravityZone.Endpoint.OS
      description: The endpoint operating system version.
      type: String
    - contextPath: GravityZone.Endpoint.Status
      description: The endpoint status.
      type: String
    - contextPath: GravityZone.Endpoint.Vendor
      description: The endpoint vendor.
      type: String
    - contextPath: GravityZone.Endpoint.LastLoggedUsers
      description: The last users who logged in to the endpoint.
      type: String
    - contextPath: Endpoint.ID
      description: The endpoint ID.
      type: String
    - contextPath: Endpoint.Hostname
      description: The endpoint hostname.
      type: String
    - contextPath: Endpoint.IPAddress
      description: The endpoint IP address.
      type: String
    - contextPath: Endpoint.OS
      description: The endpoint operating system version.
      type: String
    - contextPath: Endpoint.Status
      description: The endpoint status.
      type: String
    - contextPath: Endpoint.Vendor
      description: The endpoint vendor.
      type: String

  - name: gz-endpoint-users-loggedin
    description: Retrieves details of all active user sessions on a specific managed endpoint.
    polling: true
    arguments:
    - name: id
      isArray: false
      description: The target endpoint ID. The endpoint must be accessible to you.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: GravityZone.Endpoint.ID
      description: The endpoint ID.
      type: String
    - contextPath: GravityZone.Endpoint.Hostname
      description: The endpoint hostname.
      type: String
    - contextPath: GravityZone.Endpoint.ActiveSessions.Username
      description: The username of the currently logged-in user.
      type: String
    - contextPath: GravityZone.Endpoint.ActiveSessions.ConnectionType
      description: The connection type for the session.
      type: String
    - contextPath: GravityZone.Endpoint.ActiveSessions.StartTime
      description: The session start time, if available (e.g., "2021-05-19T10:37:56Z").
      type: Date
    - contextPath: GravityZone.Endpoint.ActiveSessions.UserSID
      description: The Security Identifier (SID) of the logged-in user, if available.
      type: String
    - contextPath: GravityZone.Endpoint.ActiveSessions.DomainSID
      description: The Security Identifier (SID) of the logged-in user's domain, if available.
      type: String
    - contextPath: GravityZone.Endpoint.ActiveSessions.OrganizationalUnitDN
      description: The full distinguished name (DN) of the organizational unit, if available.
      type: String
    - contextPath: GravityZone.Endpoint.ActiveSessions.MemberOfSIDs
      description: The SIDs for the groups to which the logged-in user belongs, if available.
      type: Array

  - name: gz-endpoint-create-memory-dump
    description: Initiates the creation of a memory dump for the specified endpoint. Once the dump is successfully generated, the resulting archive is uploaded to the Bitdefender cloud.
    polling: true
    arguments:
    - name: id
      isArray: false
      description: The target endpoint ID. The endpoint must be accessible and run a Windows operating system.
      required: true
      secret: false
      default: false
    - name: path
      isArray: false
      description: The full path to the destination folder on the specified endpoint where the memory dump archive will be created.
      required: true
      secret: false
      default: false
    - name: password
      isArray: false
      description: The password used to secure the memory dump archive after it is created. It must contain at least 12 characters, including one uppercase letter, one lowercase letter, one digit, and one special character.
      required: true
      secret: true
      default: false
    - name: polling
      isArray: false
      description: "Whether the command waits for the memory dump task completion. If set to true, the command returns the final result after the task completes. If set to false, the command returns only the endpoint ID and task ID immediately after the task is initiated."
      required: false
      secret: false
      default: false
      defaultValue: true
    outputs:
    - contextPath: GravityZone.MemoryDump.TaskID
      description: The memory dump task ID.
      type: String
    - contextPath: GravityZone.MemoryDump.TaskType
      description: The task type.
      type: String
    - contextPath: GravityZone.MemoryDump.Status
      description: The memory dump task status.
      type: String
    - contextPath: GravityZone.MemoryDump.EndpointID
      description: The endpoint ID.
      type: String
    - contextPath: GravityZone.MemoryDump.Hostname
      description: The endpoint hostname.
      type: String
    - contextPath: GravityZone.MemoryDump.StartDate
      description: The date and time when the memory dump task started (e.g., "2026-05-25T10:00:00Z").
      type: Date
    - contextPath: GravityZone.MemoryDump.EndDate
      description: The date and time when the memory dump task ended, if available (e.g., "2026-05-25T10:01:00Z").
      type: Date
    - contextPath: GravityZone.MemoryDump.ErrorCode
      description: An error code if the memory dump task fails, or Success if the task completes successfully.
      type: String
    - contextPath: GravityZone.MemoryDump.Error
      description: An error message if the memory dump task fails, or Success if the task completes successfully.
      type: String
    - contextPath: GravityZone.MemoryDump.DownloadURL
      description: The memory dump download URL, available after the task completes successfully.
      type: String

  - name: gz-endpoint-download-investigation-package
    description: Collects and downloads an investigation package from an endpoint.
    compliantpolicies:
    - EndPoint Isolation
    - User Hard Remediation
    polling: true
    arguments:
    - name: id
      isArray: false
      description: The ID of the endpoint from which to collect the investigation package.
      required: true
      secret: false
      default: false
    - name: output_file
      isArray: false
      description: The output file name in Cortex XSOAR to save the collected package. For Windows and macOS use .zip, for Linux use .tgz.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: GravityZone.Command.DownloadFile.EndpointID
      description: The endpoint ID.
      type: String
    - contextPath: GravityZone.Command.DownloadFile.Status
      description: The command status.
      type: String
    - contextPath: GravityZone.Command.DownloadFile.ErrorCode
      description: The command error code.
      type: String
    - contextPath: GravityZone.Command.DownloadFile.OutputFile
      description: The output file name.
      type: String
    - contextPath: GravityZone.Command.DownloadFile.RemoteFile
      description: The remote file path.
      type: String
    - contextPath: GravityZone.Command.DownloadFile.FileID
      description: The file ID.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the downloaded file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the downloaded file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the downloaded file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the downloaded file.
      type: String
    - contextPath: File.EntryID
      description: The EntryID hash of the downloaded file.
      type: String
    - contextPath: File.Info
      description: Information about the downloaded file.
      type: String
    - contextPath: File.Type
      description: The downloaded file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the downloaded file.
      type: String
    - contextPath: File.Extension
      description: The downloaded file extension.
      type: String
    - contextPath: File.Size
      description: The downloaded file size.
      type: Number
    - contextPath: File.Name
      description: The downloaded file name.
      type: String

  - name: gz-endpoint-download-file
    description: Downloads a file from an endpoint.
    compliantpolicies:
    - EndPoint Isolation
    - User Hard Remediation
    polling: true
    arguments:
    - name: id
      isArray: false
      description: The ID of the endpoint to download the file from.
      required: true
      secret: false
      default: false
    - name: remote_file
      isArray: false
      description: The full path of the remote file on the endpoint to download.
      required: true
      secret: false
      default: false
    - name: output_file
      isArray: false
      description: The output file name in Cortex XSOAR to save the downloaded file to.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: GravityZone.Command.DownloadFile.EndpointID
      description: The endpoint ID.
      type: String
    - contextPath: GravityZone.Command.DownloadFile.Status
      description: The command status.
      type: String
    - contextPath: GravityZone.Command.DownloadFile.ErrorCode
      description: The command error code.
      type: String
    - contextPath: GravityZone.Command.DownloadFile.OutputFile
      description: The output file name.
      type: String
    - contextPath: GravityZone.Command.DownloadFile.RemoteFile
      description: The remote file path.
      type: String
    - contextPath: GravityZone.Command.DownloadFile.FileID
      description: The file ID.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the downloaded file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the downloaded file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the downloaded file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the downloaded file.
      type: String
    - contextPath: File.EntryID
      description: The EntryID hash of the downloaded file.
      type: String
    - contextPath: File.Info
      description: Information about the downloaded file.
      type: String
    - contextPath: File.Type
      description: The downloaded file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the downloaded file.
      type: String
    - contextPath: File.Extension
      description: The downloaded file extension.
      type: String
    - contextPath: File.Size
      description: The downloaded file size.
      type: Number
    - contextPath: File.Name
      description: The downloaded file name.
      type: String

  - name: gz-endpoint-isolate
    description: Isolates an endpoint from the network.
    compliantpolicies:
    - EndPoint Isolation
    - User Hard Remediation
    polling: true
    arguments:
    - name: id
      isArray: false
      description: The ID of the endpoint to isolate.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: GravityZone.Command.Isolate.TaskID
      description: The task ID.
      type: String
    - contextPath: GravityZone.Command.Isolate.TaskType
      description: The task type.
      type: String
    - contextPath: GravityZone.Command.Isolate.EndpointID
      description: The endpoint ID.
      type: String
    - contextPath: GravityZone.Command.Isolate.Hostname
      description: The endpoint name.
      type: String
    - contextPath: GravityZone.Command.Isolate.Status
      description: The command status.
      type: String
    - contextPath: GravityZone.Command.Isolate.ErrorCode
      description: The command error code, or "Success".
      type: String
    - contextPath: GravityZone.Command.Isolate.Error
      description: The command error message, or "Success".
      type: String
    - contextPath: GravityZone.Command.Isolate.StartDate
      description: The start date of the command execution.
      type: Date
    - contextPath: GravityZone.Command.Isolate.EndDate
      description: The end date of the command execution.
      type: Date

  - name: gz-endpoint-deisolate
    description: Restores an isolated endpoint to the network.
    compliantpolicies:
    - EndPoint Isolation
    - User Hard Remediation
    polling: true
    arguments:
    - name: id
      isArray: false
      description: The ID of the endpoint to restore from isolation.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: GravityZone.Command.Deisolate.TaskID
      description: The task ID.
      type: String
    - contextPath: GravityZone.Command.Deisolate.TaskType
      description: The task type.
      type: String
    - contextPath: GravityZone.Command.Deisolate.EndpointID
      description: The endpoint ID.
      type: String
    - contextPath: GravityZone.Command.Deisolate.Hostname
      description: The endpoint name.
      type: String
    - contextPath: GravityZone.Command.Deisolate.Status
      description: The command status.
      type: String
    - contextPath: GravityZone.Command.Deisolate.ErrorCode
      description: The command error code, or "Success".
      type: String
    - contextPath: GravityZone.Command.Deisolate.Error
      description: The command error message, or "Success".
      type: String
    - contextPath: GravityZone.Command.Deisolate.StartDate
      description: The start date of the command execution.
      type: Date
    - contextPath: GravityZone.Command.Deisolate.EndDate
      description: The end date of the command execution.
      type: Date

  - name: gz-endpoint-kill-process
    description: Terminates a process on an endpoint by process ID.
    compliantpolicies:
    - EndPoint Isolation
    - User Hard Remediation
    polling: true
    arguments:
    - name: id
      isArray: false
      description: The endpoint ID.
      required: true
      secret: false
      default: false
    - name: pid
      isArray: false
      description: The ID of the process to kill.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: GravityZone.Command.KillProcess.TaskID
      description: The task ID.
      type: String
    - contextPath: GravityZone.Command.KillProcess.TaskType
      description: The task type.
      type: String
    - contextPath: GravityZone.Command.KillProcess.EndpointID
      description: The endpoint ID.
      type: String
    - contextPath: GravityZone.Command.KillProcess.Hostname
      description: The endpoint name.
      type: String
    - contextPath: GravityZone.Command.KillProcess.Status
      description: The command status.
      type: String
    - contextPath: GravityZone.Command.KillProcess.ErrorCode
      description: The command error code, or "Success".
      type: String
    - contextPath: GravityZone.Command.KillProcess.Error
      description: The command error message, or "Success".
      type: String
    - contextPath: GravityZone.Command.KillProcess.StartDate
      description: The start date of the command execution.
      type: Date
    - contextPath: GravityZone.Command.KillProcess.EndDate
      description: The end date of the command execution.
      type: Date
    - contextPath: GravityZone.Command.KillProcess.ProcessID
      description: The process ID.
      type: Number
    - contextPath: GravityZone.Command.KillProcess.ProcessPath
      description: The process path.
      type: String

  - name: gz-endpoint-run-command
    description: Runs a command on the endpoint. The applied policy must have remote shell enabled for this action to work.
    compliantpolicies:
    - EndPoint Isolation
    - User Hard Remediation
    execution: true
    polling: true
    arguments:
    - name: id
      isArray: false
      description: The ID of the endpoint on which to run the command.
      required: true
      secret: false
      default: false
    - name: command
      isArray: false
      description: The command to run on the endpoint.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: GravityZone.Command.RunCommand.ActivityID
      description: The activity ID.
      type: String
    - contextPath: GravityZone.Command.RunCommand.ActivityType
      description: The activity type.
      type: String
    - contextPath: GravityZone.Command.RunCommand.Status
      description: The command status.
      type: String
    - contextPath: GravityZone.Command.RunCommand.EndpointID
      description: The endpoint ID.
      type: String
    - contextPath: GravityZone.Command.RunCommand.ErrorCode
      description: The command error code, or "Success".
      type: String
    - contextPath: GravityZone.Command.RunCommand.Output
      description: The command output.
      type: String
    - contextPath: GravityZone.Command.RunCommand.FileID
      description: The stored file ID, when the command output cannot be extracted as an archive.
      type: String
    - contextPath: GravityZone.Command.RunCommand.FileName
      description: The stored file name, when the command output cannot be extracted as an archive.
      type: String

  - name: gz-endpoint-upload-file
    description: Uploads a file to an endpoint.
    compliantpolicies:
    - EndPoint Isolation
    - User Hard Remediation
    polling: true
    arguments:
    - name: id
      isArray: false
      description: The ID of the target endpoint for the file upload.
      required: true
      secret: false
      default: false
    - name: entry_id
      isArray: false
      description: The entry ID of the file to upload. This file must exist in Cortex XSOAR.
      required: true
      secret: false
      default: false
    - name: remote_location
      isArray: false
      description: The full folder path on the endpoint where the file will be uploaded.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: GravityZone.Command.UploadFile.TaskID
      description: The task ID.
      type: String
    - contextPath: GravityZone.Command.UploadFile.TaskType
      description: The task type.
      type: String
    - contextPath: GravityZone.Command.UploadFile.EndpointID
      description: The endpoint ID.
      type: String
    - contextPath: GravityZone.Command.UploadFile.Hostname
      description: The endpoint name.
      type: String
    - contextPath: GravityZone.Command.UploadFile.Status
      description: The command status.
      type: String
    - contextPath: GravityZone.Command.UploadFile.ErrorCode
      description: The command error code, or "Success".
      type: String
    - contextPath: GravityZone.Command.UploadFile.Error
      description: The command error message, or "Success".
      type: String
    - contextPath: GravityZone.Command.UploadFile.StartDate
      description: The start date of the command execution.
      type: Date
    - contextPath: GravityZone.Command.UploadFile.EndDate
      description: The end date of the command execution.
      type: Date
    - contextPath: GravityZone.Command.UploadFile.EntryID
      description: The entry ID of the uploaded file.
      type: String
    - contextPath: GravityZone.Command.UploadFile.DestinationPath
      description: The destination path of the uploaded file.
      type: String

  - name: gz-endpoint-list-by-running-process-hash
    description: Retrieves endpoints that are running processes with a specified hash. The API key and the applied policy must allow Live Search and endpoints must be online. The command waits up to five minutes for responses before timing out.
    polling: true
    arguments:
    - name: process_hash
      isArray: false
      description: The process hash.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: GravityZone.Command.EndpointsRunningProcessHash.EndpointID
      description: The endpoint ID.
      type: String
    - contextPath: GravityZone.Command.EndpointsRunningProcessHash.Path
      description: The Live Search results.
      type: String
    - contextPath: GravityZone.Command.EndpointsRunningProcessHash.ProcessHash
      description: The process hash.
      type: String

  - name: gz-endpoint-get-process-tree-by-hash
    description: Retrieves the process tree on an endpoint for a specified process hash. The applied policy must allow Live Search and the endpoint must be online.
    compliantpolicies:
    - EndPoint Isolation
    - User Hard Remediation
    polling: true
    arguments:
    - name: id
      isArray: false
      description: The ID of the targeted endpoint.
      required: true
      secret: false
      default: false
    - name: process_hash
      isArray: false
      description: The process hash to search for.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: GravityZone.Command.ProcessTreeForHash.EndpointID
      description: The endpoint ID.
      type: String
    - contextPath: GravityZone.Command.ProcessTreeForHash.PID
      description: The process ID.
      type: Number
    - contextPath: GravityZone.Command.ProcessTreeForHash.Path
      description: The process path.
      type: String
    - contextPath: GravityZone.Command.ProcessTreeForHash.Cmdline
      description: The command line used to start the process.
      type: String
    - contextPath: GravityZone.Command.ProcessTreeForHash.ParentPID
      description: The parent process ID.
      type: Number

  - name: gz-incident-get
    description: Retrieves incident details by ID.
    compliantpolicies:
    - EndPoint Isolation
    - User Hard Remediation
    arguments:
    - name: id
      isArray: false
      description: The incident ID to fetch.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: GravityZone.Incident.ID
      description: The incident ID.
      type: String
    - contextPath: GravityZone.Incident.Type
      description: The incident type ('incident' / 'extendedIncident').
      type: String
    - contextPath: GravityZone.Incident.Company.Name
      description: The GravityZone company name where the incident is located.
      type: String
    - contextPath: GravityZone.Incident.Company.ID
      description: The GravityZone company ID where the incident is located.
      type: String
    - contextPath: GravityZone.Incident.Number
      description: The incident number (specific to the company).
      type: Number
    - contextPath: GravityZone.Incident.Severity.Score
      description: The incident severity score (0 - 100).
      type: Number
    - contextPath: GravityZone.Incident.Status
      description: The incident status.
      type: Number
    - contextPath: GravityZone.Incident.ActionTaken
      description: The action taken by the detection logic ('reported' / 'blocked' / 'partially_blocked').
      type: String
    - contextPath: GravityZone.Incident.Created
      description: The date the incident was detected on the endpoint / sensor.
      type: Date
    - contextPath: GravityZone.Incident.LastUpdated
      description: The date the incident was last updated in GravityZone or by the endpoint / sensor.
      type: Date
    - contextPath: GravityZone.Incident.LastProcessed
      description: The date the incident was last processed by GravityZone services.
      type: Date
    - contextPath: GravityZone.Incident.Permalink
      description: The incident URL in the GravityZone console.
      type: String
    - contextPath: GravityZone.Incident.AssignedPriority
      description: The priority assigned to the incident ('unknown' / 'low' / 'medium' / 'high' / 'critical').
      type: String
    - contextPath: GravityZone.Incident.Notes.Text
      description: The note contents.
      type: String
    - contextPath: GravityZone.Incident.Notes.User
      description: The username (email) of the user who wrote the note.
      type: String
    - contextPath: GravityZone.Incident.Notes.Date
      description: The note creation date.
      type: Date
    - contextPath: GravityZone.Incident.Alerts.Name
      description: The alert name.
      type: String
    - contextPath: GravityZone.Incident.Alerts.Date
      description: The date the alert was generated.
      type: Date
    - contextPath: GravityZone.Incident.Alerts.Sensors
      description: The list of sensors that generated the alert. Available only for 'extendedIncident'-type incidents.
      type: String
    - contextPath: GravityZone.Incident.Alerts.Tactic
      description: The list of tactics that generated the alert. Available only for 'extendedIncident'-type incidents.
      type: String
    - contextPath: GravityZone.Incident.Alerts.Resources
      description: A comma-separated list of resources involved in the 'incident'-type incidents.
      type: Array
    - contextPath: GravityZone.Incident.RawJSON
      description: The raw JSON response from the GravityZone API.
      type: JSON
    - contextPath: GravityZone.Incident.EndpointID
      description: The endpoint ID. Available only for 'incident'-type incidents.
      type: String
    - contextPath: GravityZone.Incident.EndpointHostname
      description: The endpoint hostname. Available only for 'incident'-type incidents.
      type: String
    - contextPath: GravityZone.Incident.EndpointIP
      description: The endpoint IP address. Available only for 'incident'-type incidents.
      type: String

  - name: gz-incident-list
    description: Retrieves incidents from the last three days for all endpoints or for a specific endpoint.
    compliantpolicies:
    - EndPoint Isolation
    arguments:
    - name: from_date
      isArray: false
      description: The start date to retrieve incidents from. Default is three days ago.
      required: false
      secret: false
      default: false
    - name: to_date
      isArray: false
      description: The end date to retrieve incidents until. Default is the current date and time.
      required: false
      secret: false
      default: false
    - name: limit
      isArray: false
      description: The maximum number of incidents to retrieve.
      required: false
      secret: false
      default: false
    - name: endpoint_id
      isArray: false
      description: The ID of the endpoint to list incidents for.
      required: false
      secret: false
      default: false
    outputs:
    - contextPath: GravityZone.IncidentsList.ID
      description: The incident ID.
      type: String
    - contextPath: GravityZone.IncidentsList.Type
      description: The incident type ('incident' / 'extendedIncident').
      type: String
    - contextPath: GravityZone.IncidentsList.CompanyName
      description: The GravityZone company name where the incident is located.
      type: String
    - contextPath: GravityZone.IncidentsList.Number
      description: The incident number (specific to the company).
      type: Number
    - contextPath: GravityZone.IncidentsList.SeverityScore
      description: The incident severity score (0 - 100).
      type: Number
    - contextPath: GravityZone.IncidentsList.Status
      description: The incident status.
      type: Number
    - contextPath: GravityZone.IncidentsList.ActionTaken
      description: The action taken by the detecting technology ('reported' / 'blocked' / 'partially_blocked').
      type: String
    - contextPath: GravityZone.IncidentsList.Created
      description: The date the incident was detected on the endpoint / sensor.
      type: Date
    - contextPath: GravityZone.IncidentsList.LastUpdated
      description: The date the incident was last updated in GravityZone or by the endpoint / sensor.
      type: Date
    - contextPath: GravityZone.IncidentsList.LastProcessed
      description: The incident last processed date by GravityZone services.
      type: Date
    - contextPath: GravityZone.IncidentsList.Permalink
      description: The incident URL in the GravityZone Console.
      type: String
    - contextPath: GravityZone.IncidentsList.AssignedPriority
      description: The priority assigned to the incident ('unknown' / 'low' / 'medium' / 'high' / 'critical').
      type: String
    - contextPath: GravityZone.IncidentsList.AssignedUserId
      description: The ID of the user assigned to the incident.
      type: String
    - contextPath: GravityZone.IncidentsList.RawJSON
      description: The raw JSON response from the GravityZone API.
      type: JSON
    - contextPath: GravityZone.IncidentsList.EndpointID
      description: The endpoint ID. Available only for 'incident'-type incidents.
      type: String
    - contextPath: GravityZone.IncidentsList.EndpointHostname
      description: The endpoint hostname. Available only for 'incident'-type incidents.
      type: String
    - contextPath: GravityZone.IncidentsList.EndpointIP
      description: The endpoint IP address. Available only for 'incident'-type incidents.
      type: String

  - name: gz-incident-add-note
    description: Adds a note to one or more incidents.
    compliantpolicies:
    - EndPoint Isolation
    - User Hard Remediation
    arguments:
    - name: id
      isArray: true
      description: A comma-separated list of incident IDs to add a note to.
      required: true
      secret: false
      default: false
    - name: note
      isArray: false
      description: The note to add to the incidents.
      required: true
      secret: false
      default: false
    outputs:
    - contextPath: GravityZone.Command.AddIncidentNote.IncidentID
      description: The incident ID.
      type: String
    - contextPath: GravityZone.Command.AddIncidentNote.Note
      description: The requested note.
      type: String
    - contextPath: GravityZone.Command.AddIncidentNote.CommandStatus
      description: The command status.
      type: String

  - name: gz-incident-change-status
    description: Changes the status of one or more incidents.
    compliantpolicies:
    - EndPoint Isolation
    - User Hard Remediation
    arguments:
    - name: id
      isArray: true
      description: A comma-separated list of incident IDs to update.
      required: true
      secret: false
      default: false
    - name: status
      isArray: false
      description: The new status of the incidents.
      required: true
      secret: false
      default: false
      predefined:
      - PENDING
      - ACTIVE
      - DONE
      - ARCHIVE
      auto: PREDEFINED
    outputs:
    - contextPath: GravityZone.Command.ChangeIncidentStatus.IncidentID
      description: The incident ID.
      type: String
    - contextPath: GravityZone.Command.ChangeIncidentStatus.IncidentStatus
      description: The requested status of the incident.
      type: String
    - contextPath: GravityZone.Command.ChangeIncidentStatus.CommandStatus
      description: The command status.
      type: String

  - name: gz-poll-investigation-activity-status
    description: Checks the status of an investigation activity. This command is not intended for direct use.
    polling: true
    arguments:
    - name: target_id
      isArray: false
      description: The endpoint ID.
      required: true
      secret: false
      default: false
    - name: activity_id
      isArray: false
      description: The activity ID.
      required: true
      secret: false
      default: false
    - name: output_file
      isArray: false
      description: The output file path.
      required: false
      secret: false
      default: false
    - name: metadata
      isArray: false
      description: The metadata to pass to the task.
      required: false
      secret: false
      default: false
    outputs: []

  - name: gz-poll-live-search-status
    description: Checks the status of a Live Search query. This command is not intended for direct use.
    polling: true
    arguments:
    - name: task_id
      isArray: false
      description: The task ID.
      required: true
      secret: false
      default: false
    - name: search_type
      isArray: false
      description: The Live Search query type.
      required: false
      secret: false
      default: false
    - name: metadata
      isArray: false
      description: The metadata to pass to the task.
      required: false
      secret: false
      default: false
    outputs: []
  - name: gz-poll-task-status
    description: Checks the task status. This command is not intended for direct use.
    polling: true
    arguments:
    - name: task_id
      isArray: false
      description: The task ID.
      required: true
      secret: false
      default: false
    - name: metadata
      isArray: false
      description: The metadata to pass to the task.
      required: false
      secret: false
      default: false
    outputs: []
  - name: gz-poll-endpoint-users-loggedin-status
    description: Verifies the status of a task initiated via gz-endpoint-users-loggedin. This command is invoked automatically and is not intended for direct use.
    polling: true
    arguments:
    - name: task_id
      isArray: false
      description: The ID of the task started through gz-endpoint-users-loggedin.
      required: true
      secret: false
      default: false
    - name: endpoint_id
      isArray: false
      description: The ID of the managed endpoint associated with the specified task.
      required: true
      secret: false
      default: false
    outputs: []
  - name: gz-endpoint-memory-dump-status
    description: Verifies the status of a task initiated via gz-endpoint-create-memory-dump.
    polling: true
    arguments:
    - name: task_id
      isArray: false
      description: The ID of the task started through gz-endpoint-create-memory-dump. This ID is returned upon task initiation.
      required: true
      secret: false
      default: false
    - name: endpoint_id
      isArray: false
      description: The ID of the endpoint for which the specified task was initiated.
      required: true
      secret: false
      default: false
    - name: polling
      isArray: false
      description: "Whether the command waits for the gz-endpoint-create-memory-dump task completion. If set to true, the command returns the final result after the task completes successfully or fails. If set to false, the command returns immediately, providing only the task status."
      required: false
      secret: false
      default: false
      defaultValue: true
    outputs:
    - contextPath: GravityZone.MemoryDump.TaskID
      description: The ID of the task started through gz-endpoint-create-memory-dump.
      type: String
    - contextPath: GravityZone.MemoryDump.TaskType
      description: The task type.
      type: String
    - contextPath: GravityZone.MemoryDump.Status
      description: The status of the task started through gz-endpoint-create-memory-dump.
      type: String
    - contextPath: GravityZone.MemoryDump.EndpointID
      description: The endpoint ID.
      type: String
    - contextPath: GravityZone.MemoryDump.Hostname
      description: The endpoint hostname.
      type: String
    - contextPath: GravityZone.MemoryDump.StartDate
      description: The date and time when the memory dump task started (e.g., "2026-05-25T10:00:00Z").
      type: Date
    - contextPath: GravityZone.MemoryDump.EndDate
      description: The date and time when the memory dump task ended, if available (e.g., "2026-05-25T10:01:00Z").
      type: Date
    - contextPath: GravityZone.MemoryDump.ErrorCode
      description: An error code if the task started through gz-endpoint-create-memory-dump fails, or Success if the task completes successfully.
      type: String
    - contextPath: GravityZone.MemoryDump.Error
      description: An error message if the task started through gz-endpoint-create-memory-dump fails, or Success if the task completes successfully.
      type: String
    - contextPath: GravityZone.MemoryDump.DownloadURL
      description: The memory dump download URL, available after the memory dump creation task completes successfully.
      type: String
  - name: get-modified-remote-data
    description: Retrieves incidents that were modified since the last data sync. This command is intended for debugging purposes.
    arguments:
    - name: lastUpdate
      isArray: false
      description: The time the incident was last updated.
      required: true
      secret: false
      default: false
    outputs: []

  - name: get-remote-data
    description: Retrieves data from a remote incident without updating the current incident. This command is intended for debugging purposes.
    compliantpolicies:
    - EndPoint Isolation
    - User Hard Remediation
    arguments:
    - name: id
      isArray: false
      description: The ID of the incident to fetch.
      required: true
      secret: false
      default: false
    - name: lastUpdate
      isArray: false
      description: The time the incident was last updated.
      required: true
      secret: false
      default: false
    outputs: []

  - name: update-remote-system
    description: Updates the remote incident with local incident changes without updating the current incident. This command is intended for debugging purposes.

  - name: get-mapping-fields
    description: Returns the list of fields available for outgoing mirroring. This command is intended for debugging purposes only.
    arguments: []
    outputs: []

  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10381435
  feed: false
  isfetch: true
  runonce: false
  longRunning: false
  longRunningPort: false
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
fromversion: 6.10.0
marketplaces:
- xsoar
tests:
- GravityZone - Test