GravityZone

GravityZone provides secure access to incident and endpoint data and enables remediation actions through its APIs.

Endpoint · GravityZone

Details

IDGravityZone
CategoryEndpoint
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10381435

README

GravityZone provides secure access to incident and endpoint data and enables remediation actions through its APIs.
This integration was integrated and tested with version 6.6 of GravityZone.

Configure GravityZone in Cortex

Parameter Description Required
Server URL The URL of your GravityZone Cloud instance. True
API key API key to access the service REST API. True
Trust any certificate (not secure) When selected, the server certificates are not verified. False
Use system proxy settings Use the system proxy settings for connecting to the server. False
Fetch incidents When selected, the integration will fetch incidents from the server. False
Maximum incidents to fetch Maximum number of incidents per fetch. The default value is 50. False
First fetch time The time period from which the first fetch will start. False
Mirroring Direction The mirroring direction in which to mirror the incident. You can mirror “Incoming” (from GravityZone to Cortex XSOAR), “Outgoing” (from Cortex XSOAR to GravityZone), or in both directions. False
Incident type   False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

fetch-incidents

Retrieves incidents from GravityZone Cloud.

Base Command

fetch-incidents

Context Output

There is no context output for this command.

gz-endpoint-list

Retrieves the list of managed endpoints.

Base Command

gz-endpoint-list

Input

Argument Name Description Required
limit The maximum number of endpoints to retrieve. Optional
name The endpoint name filter. Returns endpoints whose hostnames start with the specified value. The value must be at least 3 characters long. Supports an optional single leading ‘*’ wildcard pattern. Optional
node_id The ID of the target GravityZone company or network inventory group. If not specified, the default value is the ID of the company associated with the API key used to make the request. Optional

Context Output

Path Type Description
GravityZone.EndpointsList.ID String The endpoint ID.
GravityZone.EndpointsList.Hostname String The endpoint hostname.
GravityZone.EndpointsList.IP String The endpoint IP address.
GravityZone.EndpointsList.OS String The endpoint operating system version.
GravityZone.EndpointsList.MAC String The endpoint MAC address.
GravityZone.EndpointsList.Vendor String The endpoint vendor.
GravityZone.EndpointsList.FQDN String The endpoint’s fully qualified domain name (FQDN).
GravityZone.EndpointsList.CompanyID String The GravityZone company ID where the endpoint is located.
GravityZone.EndpointsList.GroupID String The GravityZone group ID where the endpoint is located.

Command example


#### Context Example

```json
{
    "GravityZone": {
        "EndpointsList": [
            {
                "CompanyID": "6909d1859866985b410b2969",
                "FQDN": "win",
                "GroupID": "6909d1869866985b410b296e",
                "Hostname": "WIN",
                "ID": "699d81cdab613e65696e452e",
                "IP": "IP1",
                "MAC": "005056b1b175",
                "OS": "Windows 10 Pro",
                "Vendor": "GravityZone"
            },
            {
                "CompanyID": "6909d1859866985b410b2969",
                "FQDN": "xdr-nsva",
                "GroupID": "6909d1869866985b410b296e",
                "Hostname": "xdr-nsva",
                "ID": "69fc10a547f2e985e6774a0f",
                "IP": "IP2",
                "MAC": "005056b156b1",
                "OS": "Linux Ubuntu 24.04.4 LTS",
                "Vendor": "GravityZone"
            },
            {
                "CompanyID": "6909d1859866985b410b2969",
                "FQDN": "ta349cf3rjt5",
                "GroupID": "6909d1869866985b410b296e",
                "Hostname": "TA349CF3RJT5",
                "ID": "6a6043865de62c6f81270b8d",
                "IP": "IP3",
                "MAC": "005056b8bfd3",
                "OS": "Windows 10 Enterprise",
                "Vendor": "GravityZone"
            }
        ]
    }
}

Human Readable Output

GravityZone Endpoints List

ID Hostname IP OS MAC Vendor FQDN CompanyID GroupID
699d81cdab613e65696e452e WIN IP1 Windows 10 Pro 005056b1b175 GravityZone win 6909d1859866985b410b2969 6909d1869866985b410b296e
69fc10a547f2e985e6774a0f xdr-nsva IP2 Linux Ubuntu 24.04.4 LTS 005056b156b1 GravityZone xdr-nsva 6909d1859866985b410b2969 6909d1869866985b410b296e
6a6043865de62c6f81270b8d TA349CF3RJT5 IP3 Windows 10 Enterprise 005056b8bfd3 GravityZone ta349cf3rjt5 6909d1859866985b410b2969 6909d1869866985b410b296e

Command example

!gz-endpoint-list name=TA66

Human Readable Output

GravityZone Endpoints List

No entries.

Command example

!gz-endpoint-list node_id=6909d1859866985b410b2969

Context Example

{
    "GravityZone": {
        "EndpointsList": [
            {
                "CompanyID": "6909d1859866985b410b2969",
                "FQDN": "win",
                "GroupID": "6909d1869866985b410b296e",
                "Hostname": "WIN",
                "ID": "699d81cdab613e65696e452e",
                "IP": "IP1",
                "MAC": "005056b1b175",
                "OS": "Windows 10 Pro",
                "Vendor": "GravityZone"
            },
            {
                "CompanyID": "6909d1859866985b410b2969",
                "FQDN": "xdr-nsva",
                "GroupID": "6909d1869866985b410b296e",
                "Hostname": "xdr-nsva",
                "ID": "69fc10a547f2e985e6774a0f",
                "IP": "IP2",
                "MAC": "005056b156b1",
                "OS": "Linux Ubuntu 24.04.4 LTS",
                "Vendor": "GravityZone"
            },
            {
                "CompanyID": "6909d1859866985b410b2969",
                "FQDN": "ta349cf3rjt5",
                "GroupID": "6909d1869866985b410b296e",
                "Hostname": "TA349CF3RJT5",
                "ID": "6a6043865de62c6f81270b8d",
                "IP": "IP3",
                "MAC": "005056b8bfd3",
                "OS": "Windows 10 Enterprise",
                "Vendor": "GravityZone"
            }
        ]
    }
}

Human Readable Output

GravityZone Endpoints List

ID Hostname IP OS MAC Vendor FQDN CompanyID GroupID
699d81cdab613e65696e452e WIN IP1 Windows 10 Pro 005056b1b175 GravityZone win 6909d1859866985b410b2969 6909d1869866985b410b296e
69fc10a547f2e985e6774a0f xdr-nsva IP2 Linux Ubuntu 24.04.4 LTS 005056b156b1 GravityZone xdr-nsva 6909d1859866985b410b2969 6909d1869866985b410b296e
6a6043865de62c6f81270b8d TA349CF3RJT5 IP3 Windows 10 Enterprise 005056b8bfd3 GravityZone ta349cf3rjt5 6909d1859866985b410b2969 6909d1869866985b410b296e

gz-endpoint-get

Retrieves endpoint details by endpoint ID.

Base Command

gz-endpoint-get

Input

Argument Name Description Required
id The ID of the endpoint to retrieve. Required

Context Output

Path Type Description
GravityZone.Endpoint.ID String The endpoint ID.
GravityZone.Endpoint.Hostname String The endpoint hostname.
GravityZone.Endpoint.IP String The endpoint IP address.
GravityZone.Endpoint.OS String The endpoint operating system version.
GravityZone.Endpoint.Status String The endpoint status.
GravityZone.Endpoint.Vendor String The endpoint vendor.
GravityZone.Endpoint.LastLoggedUsers String The last users who logged on the endpoint.
Endpoint.ID String The endpoint ID.
Endpoint.Hostname String The endpoint hostname.
Endpoint.IPAddress String The endpoint IP address.
Endpoint.OS String The endpoint operating system version.
Endpoint.Status String The endpoint status.
Endpoint.Vendor String The endpoint vendor.

Command example

!gz-endpoint-get id=6942a43afe8d4e463ca5c197

Context Example

{
    "Endpoint": {
        "Hostname": "bdvm",
        "ID": "6942a43afe8d4e463ca5c197",
        "IPAddress": "1.1.1.1",
        "OS": "Linux Ubuntu 24.04.2 LTS",
        "Status": "Online",
        "Vendor": "GravityZone"
    },
    "GravityZone": {
        "Endpoint": {
            "Hostname": "bdvm",
            "ID": "6942a43afe8d4e463ca5c197",
            "IP": "1.1.1.1",
            "LastLoggedUsers": "",
            "OS": "Linux Ubuntu 24.04.2 LTS",
            "Status": "Online",
            "Vendor": "GravityZone"
        }
    }
}

Human Readable Output

GravityZone Endpoint

ID Hostname IP OS Status Vendor LastLoggedUsers
6942a43afe8d4e463ca5c197 bdvm 1.1.1.1 Linux Ubuntu 24.04.2 LTS Online GravityZone  

gz-endpoint-download-investigation-package

Collects and downloads an investigation package from an endpoint.

Base Command

gz-endpoint-download-investigation-package

Input

Argument Name Description Required
id The ID of the endpoint from which to collect the investigation package. Required
output_file The output file name in Cortex XSOAR to save the collected package. For Windows and macOS use .zip, for Linux use .tgz. Required

Context Output

Path Type Description
GravityZone.Command.DownloadFile.EndpointID String The endpoint ID.
GravityZone.Command.DownloadFile.Status String The command status.
GravityZone.Command.DownloadFile.ErrorCode String The command error code.
GravityZone.Command.DownloadFile.OutputFile String The output file name.
GravityZone.Command.DownloadFile.RemoteFile String The remote file path.
GravityZone.Command.DownloadFile.FileID String The file ID.
File.SHA1 String The SHA1 hash of the downloaded file.
File.SHA256 String The SHA256 hash of the downloaded file.
File.SHA512 String The SHA512 hash of the downloaded file.
File.SSDeep String The SSDeep hash of the downloaded file.
File.EntryID String The EntryID hash of the downloaded file.
File.Info String Information about the downloaded file.
File.Type String The downloaded file type.
File.MD5 String The MD5 hash of the downloaded file.
File.Extension String The downloaded file extension.
File.Size Number The downloaded file size.
File.Name String The downloaded file name.

Command example

!gz-endpoint-download-investigation-package id=6942a43afe8d4e463ca5c197 output_file=investigation_package.zip

Context Example

{
    "GravityZone": {
        "Command": {
            "DownloadFile": {
                "ActivityID": "69443b020126750c1a0dbe2f",
                "ActivityType": "DownloadFile",
                "Status": "Success",
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "ErrorCode": null,
                "RemoteFile": null,
                "OutputFile": "investigation_package.zip",
                "FileID": "LtvQ6B8eCFvTNo7bf3vDUD@25729aa7-7442-4231-8b98-ecb0fc29a642",
                "FileName": "investigation_package.zip"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.DownloadFile command on host 6942a43afe8d4e463ca5c197

EndpointID Status ErrorCode OutputFile RemoteFile FileID
6942a43afe8d4e463ca5c197 Success   investigation_package.zip   LtvQ6B8eCFvTNo7bf3vDUD@25729aa7-7442-4231-8b98-ecb0fc29a642

gz-endpoint-download-file

Downloads a file from an endpoint.

Base Command

gz-endpoint-download-file

Input

Argument Name Description Required
id The ID of the endpoint to download the file from. Required
remote_file The full path of the remote file on the endpoint to download. Required
output_file The output file name in Cortex XSOAR to save the downloaded file to. Required

Context Output

Path Type Description
GravityZone.Command.DownloadFile.EndpointID String The endpoint ID.
GravityZone.Command.DownloadFile.Status String The command status.
GravityZone.Command.DownloadFile.ErrorCode String The command error code.
GravityZone.Command.DownloadFile.OutputFile String The output file name.
GravityZone.Command.DownloadFile.RemoteFile String The remote file path.
GravityZone.Command.DownloadFile.FileID String The file ID.
File.SHA1 String The SHA1 hash of the downloaded file.
File.SHA256 String The SHA256 hash of the downloaded file.
File.SHA512 String The SHA512 hash of the downloaded file.
File.SSDeep String The SSDeep hash of the downloaded file.
File.EntryID String The EntryID hash of the downloaded file.
File.Info String Information about the downloaded file.
File.Type String The downloaded file type.
File.MD5 String The MD5 hash of the downloaded file.
File.Extension String The downloaded file extension.
File.Size Number The downloaded file size.
File.Name String The downloaded file name.

Command example

!gz-endpoint-download-file id=6942a43afe8d4e463ca5c197 remote_file=/root/test/test.txt output_file=downloaded_file.gzip

Context Example

{
    "GravityZone": {
        "Command": {
            "DownloadFile": {
                "ActivityID": "6943fb82c1f339e18b0949a1",
                "ActivityType": "DownloadFile",
                "RemoteFile": "/root/test/test.txt",
                "Status": "Success",
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "ErrorCode": null,
                "OutputFile": "downloaded_file.gzip",
                "FileID": "LtvQ6B8eCFvTNo7bf3vDUD@25729aa7-7442-4231-8b98-ecb0fc29a642",
                "FileName": "downloaded_file.gzip"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.DownloadFile command on host 6942a43afe8d4e463ca5c197

EndpointID Status ErrorCode OutputFile RemoteFile FileID
6942a43afe8d4e463ca5c197 Success   downloaded_file.gzip /root/test/test.txt LtvQ6B8eCFvTNo7bf3vDUD@25729aa7-7442-4231-8b98-ecb0fc29a642

gz-endpoint-isolate

Isolates an endpoint from the network.

Base Command

gz-endpoint-isolate

Input

Argument Name Description Required
id The ID of the endpoint to isolate. Required

Context Output

Path Type Description
GravityZone.Command.Isolate.TaskID String The task ID.
GravityZone.Command.Isolate.TaskType String The task type.
GravityZone.Command.Isolate.EndpointID String The endpoint ID.
GravityZone.Command.Isolate.Hostname String The endpoint name.
GravityZone.Command.Isolate.Status String The command status.
GravityZone.Command.Isolate.ErrorCode String The command error code, or “Success”.
GravityZone.Command.Isolate.Error String The command error message, or “Success”.
GravityZone.Command.Isolate.StartDate Date The start date of the command execution.
GravityZone.Command.Isolate.EndDate Date The end date of the command execution.

Command example

!gz-endpoint-isolate id=6942a43afe8d4e463ca5c197

Context Example

{
    "GravityZone": {
        "Command" : {
            "Isolate" : {
                "TaskID": "6941bbc98ba450a5c10e5a16",
                "TaskType": "Isolate",
                "Status": "Processed",
                "EndDate": "2025-12-16T22:06:33Z",
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "Hostname": "ENDPOINT_NAME",
                "ErrorCode": "Success",
                "Error": "Success",
                "StartDate": "2025-12-16T22:06:33Z"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.Isolate command on hosts ENDPOINT_ID

EndpointID Hostname StartDate EndDate Error
6942a43afe8d4e463ca5c197 ENDPOINT_NAME 2025-12-16T22:06:33Z 2025-12-16T22:06:33Z Success

gz-endpoint-deisolate

Restores an isolated endpoint to the network.

Base Command

gz-endpoint-deisolate

Input

Argument Name Description Required
id The ID of the endpoint to restore from isolation. Required

Context Output

Path Type Description
GravityZone.Command.Deisolate.TaskID String The task ID.
GravityZone.Command.Deisolate.TaskType String The task type.
GravityZone.Command.Deisolate.EndpointID String The endpoint ID.
GravityZone.Command.Deisolate.Hostname String The endpoint name.
GravityZone.Command.Deisolate.Status String The command status.
GravityZone.Command.Deisolate.ErrorCode String The command error code, or “Success”.
GravityZone.Command.Deisolate.Error String The command error message, or “Success”.
GravityZone.Command.Deisolate.StartDate Date The start date of the command execution.
GravityZone.Command.Deisolate.EndDate Date The end date of the command execution.

Command example

!gz-endpoint-deisolate id=6942a43afe8d4e463ca5c197

Context Example

{
    "GravityZone": {
        "Command" : {
            "Deisolate" : {
                "TaskID": "6941bbc98ba450a5c10e5a16",
                "TaskType": "Deisolate",
                "Status": "Processed",
                "EndDate": "2025-12-16T22:08:33Z",
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "Hostname": "ENDPOINT_NAME",
                "ErrorCode": "Success",
                "Error": "Success",
                "StartDate": "2025-12-16T22:08:33Z"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.Deisolate command on hosts ENDPOINT_ID

EndpointID Hostname StartDate EndDate Error
6942a43afe8d4e463ca5c197 ENDPOINT_NAME 2025-12-16T22:08:33Z 2025-12-16T22:08:33Z Success

gz-endpoint-kill-process

Terminates a process on an endpoint by process ID.

Base Command

gz-endpoint-kill-process

Input

Argument Name Description Required
id The endpoint ID. Required
pid The ID of the process to kill. Required

Context Output

Path Type Description
GravityZone.Command.KillProcess.TaskID String The task ID.
GravityZone.Command.KillProcess.TaskType String The task type.
GravityZone.Command.KillProcess.EndpointID String The endpoint ID.
GravityZone.Command.KillProcess.Hostname String The endpoint name.
GravityZone.Command.KillProcess.Status String The command status.
GravityZone.Command.KillProcess.ErrorCode String The command error code, or “Success”.
GravityZone.Command.KillProcess.Error String The command error message, or “Success”.
GravityZone.Command.KillProcess.StartDate Date The start date of the command execution.
GravityZone.Command.KillProcess.EndDate Date The end date of the command execution.
GravityZone.Command.KillProcess.ProcessID Number The process ID.
GravityZone.Command.KillProcess.ProcessPath String The process path.

Command example

!gz-endpoint-kill-process id=6942a43afe8d4e463ca5c197 pid=5876

Context Example

{
    "GravityZone": {
        "Command": {
            "KillProcess": {
                "TaskID": "6941b6ffa830c3132b0d63d8",
                "TaskType": "KillProcess",
                "Status": "Processed",
                "EndDate": "2025-12-16T21:46:08Z",
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "Hostname": "ENDPOINT_NAME",
                "ErrorCode": "Success",
                "Error": "Success",
                "StartDate": "2025-12-16T21:46:07Z",
                "ProcessID": 5876,
                "ProcessPath": ""
            }
        }
    }
}

Human Readable Output

GravityZone.Command.KillProcess command on hosts ENDPOINT_ID

EndpointID Hostname StartDate EndDate Error ProcessID
6942a43afe8d4e463ca5c197 ENDPOINT_NAME 2025-12-16T21:46:07Z 2025-12-16T21:46:08Z Success 5876

gz-endpoint-run-command

Runs a command on the endpoint. The applied policy must have Remote Shell enabled for this action to work.

Base Command

gz-endpoint-run-command

Input

Argument Name Description Required
id The ID of the endpoint on which to run the command. Required
command The command to run on the endpoint. Required

Context Output

Path Type Description
GravityZone.Command.RunCommand.ActivityID String The activity ID.
GravityZone.Command.RunCommand.ActivityType String The activity type.
GravityZone.Command.RunCommand.Status String The command status.
GravityZone.Command.RunCommand.EndpointID String The endpoint ID.
GravityZone.Command.RunCommand.ErrorCode String The command error code, or “Success”.
GravityZone.Command.RunCommand.Output String The command output.
GravityZone.Command.RunCommand.FileID String The stored file ID, when the command output cannot be extracted as an archive.
GravityZone.Command.RunCommand.FileName String The stored file name, when the command output cannot be extracted as an archive.

Command example

!gz-endpoint-run-command id=6942a43afe8d4e463ca5c197 command=whoami

Context Example

{
    "GravityZone": {
        "Command": {
            "RunCommand": {
                "ActivityID": "6943e3391e4fe5e8a40e51f6",
                "ActivityType": "RunCommand",
                "Status": "Success",
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "ErrorCode": null,
                "Command": "whoami",
                "Output": "root"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.RunCommand command on host 6942a43afe8d4e463ca5c197

EndpointID Status ErrorCode Command Output
6942a43afe8d4e463ca5c197 Success   whoami root

gz-endpoint-upload-file

Uploads a file to an endpoint.

Base Command

gz-endpoint-upload-file

Input

Argument Name Description Required
id The ID of the target endpoint for the file upload. Required
entry_id The entry ID of the file to upload. This file needs to exist in Cortex XSOAR. Required
remote_location The full folder path on the endpoint where the file will be uploaded. Required

Context Output

Path Type Description
GravityZone.Command.UploadFile.TaskID String The task ID.
GravityZone.Command.UploadFile.TaskType String The task type.
GravityZone.Command.UploadFile.EndpointID String The endpoint ID.
GravityZone.Command.UploadFile.Hostname String The endpoint name.
GravityZone.Command.UploadFile.Status String The command status.
GravityZone.Command.UploadFile.ErrorCode String The command error code, or “Success”.
GravityZone.Command.UploadFile.Error String The command error message, or “Success”.
GravityZone.Command.UploadFile.StartDate Date The start date of the command execution.
GravityZone.Command.UploadFile.EndDate Date The end date of the command execution.
GravityZone.Command.UploadFile.EntryID String The entry ID of the uploaded file.
GravityZone.Command.UploadFile.DestinationPath String The destination path of the uploaded file.

Command example

!gz-endpoint-upload-file id=6942a43afe8d4e463ca5c197 entry_id=LtvQ6B8eCFvTNo7bf3vDUD@25729aa7-7442-4231-8b98-ecb0fc29a642 remote_location=/root/test/

Context Example

{
    "GravityZone": {
        "Command": {
            "UploadFile": {
                "TaskID": "694447384f1ba9a2650ec75a",
                "TaskType": "UploadFile",
                "Status": "Processed",
                "EndDate": "2025-12-18T20:26:40Z",
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "Hostname": "ENDPOINT_NAME",
                "ErrorCode": "Success",
                "Error": "Success",
                "StartDate": "2025-12-18T20:26:00Z",
                "EntryID": "LtvQ6B8eCFvTNo7bf3vDUD@25729aa7-7442-4231-8b98-ecb0fc29a642",
                "DestinationPath": "/root/test/"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.UploadFile command on hosts 6942a43afe8d4e463ca5c197

EndpointID Hostname StartDate EndDate Error EntryID DestinationPath
6942a43afe8d4e463ca5c197 ENDPOINT_NAME 2025-12-18T20:26:00Z 2025-12-18T20:26:40Z Success LtvQ6B8eCFvTNo7bf3vDUD@25729aa7-7442-4231-8b98-ecb0fc29a642 /root/test/

gz-endpoint-list-by-running-process-hash

Retrieves endpoints that are running processes with a specified hash. The API key and the applied policy must allow Live Search. Endpoints must be online. The command waits up to five minutes for responses before timing out.

Base Command

gz-endpoint-list-by-running-process-hash

Input

Argument Name Description Required
process_hash Hash of the process. Required

Context Output

Path Type Description
GravityZone.Command.EndpointsRunningProcessHash.EndpointID String The endpoint ID.
GravityZone.Command.EndpointsRunningProcessHash.Path String The Live Search results.
GravityZone.Command.EndpointsRunningProcessHash.ProcessHash String The process hash.

Command example

!gz-endpoint-list-by-running-process-hash process_hash=b8412bcc6f47b2a11e4c39bc1bc9fab74969ff0648ba22db4c5254a0457af0c7

Context Example

{
    "GravityZone": {
        "Command": {
            "EndpointsRunningProcessHash": {
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "Path": "/opt/bitdefender-security-tools/bin/epagngd",
                "ProcessHash": "b8412bcc6f47b2a11e4c39bc1bc9fab74969ff0648ba22db4c5254a0457af0c7"
            }
        }
    }
}

Human Readable Output

Live Search Results

EndpointID ProcessHash Results
6942a43afe8d4e463ca5c197 b8412bcc6f47b2a11e4c39bc1bc9fab74969ff0648ba22db4c5254a0457af0c7 {“hostname”:”ENDPOINT_NAME”,”path”:”/opt/bitdefender-security-tools/bin/epagngd”}

gz-endpoint-get-process-tree-by-hash

Retrieves the process tree on an endpoint for a specified process hash. The applied policy must allow Live Search, and the endpoint must be online.

Base Command

gz-endpoint-get-process-tree-by-hash

Input

Argument Name Description Required
id The ID of the targeted endpoint. Required
process_hash The hash of the process to search for. Required

Context Output

Path Type Description
GravityZone.Command.ProcessTreeForHash.EndpointID String The endpoint ID.
GravityZone.Command.ProcessTreeForHash.PID Number The process ID.
GravityZone.Command.ProcessTreeForHash.Path String The process path.
GravityZone.Command.ProcessTreeForHash.Cmdline String The command line used to start the process.
GravityZone.Command.ProcessTreeForHash.ParentPID Number The parent process ID.

Command example

!gz-endpoint-get-process-tree-by-hash id=6942a43afe8d4e463ca5c197 process_hash=b8412bcc6f47b2a11e4c39bc1bc9fab74969ff0648ba22db4c5254a0457af0c7

Context Example

{
    "GravityZone": {
        "Command": {
            "ProcessTreeForHash": {
                "EndpointID": "6942a43afe8d4e463ca5c197",
                "Cmdline": "/usr/lib/systemd/systemd --system --deserialize=73",
                "ParentPID": 0,
                "Path": "/usr/lib/systemd/systemd",
                "PID": 1
            }
        }
    }
}

Human Readable Output

Live Search Results

EndpointID ProcessHash Results
6942a43afe8d4e463ca5c197 b8412bcc6f47b2a11e4c39bc1bc9fab74969ff0648ba22db4c5254a0457af0c7 {“cmdline”:”/usr/lib/systemd/systemd –system –deserialize=73”,”parent”:”0”,”path”:”/usr/lib/systemd/systemd”,”pid”:”1”}

gz-incident-get

Retrieves incident details by ID.

Base Command

gz-incident-get

Input

Argument Name Description Required
id The ID of the incident to fetch. Required

Context Output

Path Type Description
GravityZone.Incident.ID String The incident ID.
GravityZone.Incident.Type String The incident type (‘incident’ / ‘extendedIncident’).
GravityZone.Incident.Company.Name String The GravityZone company name where the incident is located.
GravityZone.Incident.Company.ID String The GravityZone company ID where the incident is located.
GravityZone.Incident.Number Number The incident number (specific to the company).
GravityZone.Incident.Severity.Score Number The incident severity score (0 - 100).
GravityZone.Incident.Status Number The incident status.
GravityZone.Incident.ActionTaken String The action taken by the detecting technology (‘reported’ / ‘blocked’ / ‘partially_blocked’).
GravityZone.Incident.Created Date The date when the incident was detected on the endpoint / sensor.
GravityZone.Incident.LastUpdated Date The date when the incident was last updated in GravityZone or by the endpoint / sensor.
GravityZone.Incident.LastProcessed Date The date when the incident was last processed by GravityZone services.
GravityZone.Incident.Permalink String The incident URL in the GravityZone Console.
GravityZone.Incident.AssignedPriority String The priority assigned to the incident (‘unknown’ / ‘low’ / ‘medium’ / ‘high’ / ‘critical’).
GravityZone.Incident.Notes.Text String The note contents.
GravityZone.Incident.Notes.User String The username (email) of the user who wrote the note.
GravityZone.Incident.Notes.Date Date The note creation date.
GravityZone.Incident.Alerts.Name String The alert name.
GravityZone.Incident.Alerts.Date Date The date of when the alert was generated.
GravityZone.Incident.Alerts.Sensors String The list of sensors that generated the alert. Available only for ‘extendedIncident’-type incidents.
GravityZone.Incident.Alerts.Tactic String The list of tactics that generated the alert. Available only for ‘extendedIncident’-type incidents.
GravityZone.Incident.Alerts.Resources Array The list of resources involved in the ‘incident’-type incidents.
GravityZone.Incident.RawJSON JSON The raw JSON response from the GravityZone API.
GravityZone.Incident.EndpointID String The endpoint ID. Available only for ‘incident’-type incidents.
GravityZone.Incident.EndpointHostname String The endpoint hostname. Available only for ‘incident’-type incidents.
GravityZone.Incident.EndpointIP String The endpoint IP address. Available only for ‘incident’-type incidents.

Command example

!gz-incident-get id=69415c9d5f5c8b75247c58d1

Context Example

{
    "GravityZone": {
        "Incident": {
            "ActionTaken": "blocked",
            "Alerts": [
                {
                    "Date": "2025-12-16T15:20:19+02:00",
                    "DetectedBy": {
                        "Class": "EDR Detection",
                        "Name": "KeyloggingAPICall"
                    },
                    "Name": "KeyloggingAPICall",
                    "Resources": [
                        {
                            "CommandLine": "\"C:\\Windows\\System32\\notepad.exe\" C:\\Users\\bdvm\\Desktop\\New Text Document.txt",
                            "ParentPid": 5212,
                            "ParentProcessAccessPrivileges": "elevated",
                            "ParentProcessIntegrityLevel": "high",
                            "ParentProcessPath": "c:\\windows\\explorer.exe",
                            "ParentProcessUser": "TA66H0I6F225\\bdvm",
                            "Pid": 2592,
                            "ProcessAccessPrivileges": "elevated",
                            "ProcessIntegrityLevel": "high",
                            "ProcessPath": "c:\\windows\\system32\\notepad.exe",
                            "Type": "process",
                            "User": "TA66H0I6F225\\bdvm"
                        }
                    ]
                }
            ],
            "AssignedPriority": "unknown",
            "AssignedUser": null,
            "Company": {
                "ID": "611717cb22a30cee251b03f3",
                "Name": "Company"
            },
            "Created": "2025-12-16T15:20:21+02:00",
            "ID": "69415c9d5f5c8b75247c58d1",
            "LastProcessed": "2025-12-16T15:21:48+02:00",
            "LastUpdated": "2025-12-16T15:21:38+02:00",
            "Notes": [
                {
                    "Date": "2026-02-23T13:27:53+02:00",
                    "Text": "InvestigationInProgress",
                    "User": "user email"
                }
            ],
            "Number": 473,
            "Permalink": "https://gravityzone.domain/#!/incidents/view/69415c9d5f5c8b75247c58d1",
            "EndpointID" : "694148bffe8d4e463ca5bd1e",
            "EndpointHostname": "TA66H0I6F225",
            "EndpointIP": "1.1.1.1",
            "RawJSON": {
                "assignee": null,
                "attackTypes": [
                    "Malware"
                ],
                "company": {
                    "id": "611717cb22a30cee251b03f3",
                    "name": "Company"
                },
                "created": "2025-12-16T15:20:21+02:00",
                "details": {
                    "alerts": [
                        {
                            "date": "2025-12-16T15:20:19+02:00",
                            "detectedBy": {
                                "class": "EDR Detection",
                                "name": "KeyloggingAPICall"
                            },
                            "extra": [
                                {
                                    "key": "hookedApiName",
                                    "value": "Key Logging"
                                },
                                {
                                    "key": "extraInfo1",
                                    "value": "\nProcess PE VersionInfo and Certification Information: \nOriginal File Name: NOTEPAD.EXE\nInternal Name: Notepad\nFile Description: Notepad\nCompany Name: Microsoft Corporation\nFile Version: 10.0.19041.1865 (WinBuild.160101.0800)\nProduct Name: MicrosoftR WindowsR Operating System\nProduct Version: 10.0.19041.1865\nLegal Copyright: C Microsoft Corporation. All rights reserved.\nCertificate Serial: 330000033b655faefadb75e9d600000000033b\nCertificate Signer: Microsoft Corporation\nCertificate Issuer: Microsoft Corporation\n\nWorking Directory: c:\\users\\bdvm\\desktop\\"
                                }
                            ],
                            "id": "69415ce1997e9c48ed12c360",
                            "name": "KeyloggingAPICall",
                            "resources": [
                                {
                                    "details": {
                                        "commandLine": "\"C:\\Windows\\System32\\notepad.exe\" C:\\Users\\bdvm\\Desktop\\New Text Document.txt",
                                        "loadedModule": null,
                                        "loadedModulePid": null,
                                        "parentPid": 5212,
                                        "parentProcessAccessPrivileges": "elevated",
                                        "parentProcessCmdline": null,
                                        "parentProcessIntegrityLevel": "high",
                                        "parentProcessPath": "c:\\windows\\explorer.exe",
                                        "parentProcessUser": "TA66H0I6F225\\bdvm",
                                        "pid": 2592,
                                        "processAccessPrivileges": "elevated",
                                        "processInjectionSizeofWrite": null,
                                        "processInjectionTarget": null,
                                        "processInjectionTargetPid": null,
                                        "processInjectionWriter": null,
                                        "processInjectionWriterPid": null,
                                        "processIntegrityLevel": "high",
                                        "processPackerName": null,
                                        "processPath": "c:\\windows\\system32\\notepad.exe",
                                        "processPathSize": null,
                                        "user": "TA66H0I6F225\\bdvm"
                                    },
                                    "type": "process"
                                }
                            ]
                        }
                    ],
                    "computerFqdn": "ta66h0i6f225",
                    "computerId": "694148bffe8d4e463ca5bd1e",
                    "computerIp": "1.1.1.1",
                    "computerMacAddresses": [
                        "005056a7862b"
                    ],
                    "computerName": "TA66H0I6F225",
                    "counters": {
                        "domains": 0,
                        "endpoints": 1,
                        "events": 17,
                        "files": 3,
                        "processes": 4,
                        "registries": 0,
                        "storages": 0
                    },
                    "detectionName": "BAT.Trojan.FormatC.Z",
                    "mitreTags": [
                        {
                            "category": "Execution",
                            "techniques": [
                                {
                                    "id": "T1059",
                                    "name": "Command and Scripting Interpreter",
                                    "subtechniques": null
                                }
                            ]
                        }
                    ],
                    "nodes": [
                        {
                            "alertIds": [
                                "69415ce1997e9c48ed12c361"
                            ],
                            "details": {
                                "file": {
                                    "isExecutable": true,
                                    "md5": null,
                                    "name": "<system>",
                                    "path": "<system>",
                                    "sha256": null,
                                    "size": 0
                                },
                                "killProcess": null,
                                "process": {
                                    "commandLine": "<did_not_receive>",
                                    "date": "2025-12-16T14:05:30+02:00",
                                    "name": "<system>",
                                    "parent": {
                                        "name": "<SYSTEM>",
                                        "path": null,
                                        "pid": 0
                                    },
                                    "pid": 0,
                                    "userId": null,
                                    "userName": "NT AUTHORITY\\SYSTEM"
                                },
                                "quarantine": null,
                                "sandbox": null
                            },
                            "id": "69415c9d5f5c8b75247c58e4",
                            "name": "<system>",
                            "type": "process_execution"
                        }
                    ],
                    "partOf": null,
                    "transitions": [
                        {
                            "date": "2025-12-16T15:19:59+02:00",
                            "from": "69415c9d5f5c8b75247c58e2",
                            "to": "69415c9d5f5c8b75247c58e5"
                        }
                    ],
                    "triggerNodeId": "69415c9d5f5c8b75247c58e5"
                },
                "incidentId": "69415c9d5f5c8b75247c58d1",
                "incidentLink": "https://gravityzone.domain/#!/incidents/view/69415c9d5f5c8b75247c58d1",
                "incidentNumber": 473,
                "incidentType": "incident",
                "lastProcessed": "2025-12-16T15:21:48+02:00",
                "lastUpdated": "2025-12-16T15:21:38+02:00",
                "mainAction": "blocked",
                "notes": [
                    {
                        "created": "2026-02-23T13:27:53+02:00",
                        "id": "699c39b9cf8645f670042eb0",
                        "text": "InvestigationInProgress",
                        "userId": "6941466eda1158ec9f0ecb5d",
                        "userName": "user email"
                    }
                ],
                "priority": "unknown",
                "severityScore": 43,
                "status": "open"
            },
            "Severity": {
                "Score": 43
            },
            "Status": 0,
            "Type": "incident"
        }
    }
}

Human Readable Output

GravityZone Incident

Action Taken Assigned Priority Assigned User Company Name Created Endpoint ID Endpoint IP Endpoint Name ID Last Processed Last Updated Number Permalink Severity Score Status Type
Blocked Unknown Unassigned Company 2025-12-16T15:20:21+02:00 694148bffe8d4e463ca5bd1e 1.1.1.1 TA66H0I6F225 69415c9d5f5c8b75247c58d1 2025-12-16T15:21:48+02:00 2025-12-16T15:21:38+02:00 473 https://gravityzone.domain/#!/incidents/view/69415c9d5f5c8b75247c58d1 43% 0 (Pending) Incident (EDR)

Incident Notes

Text User Date
InvestigationInProgress user email 2026-02-23T13:27:53+02:00

Incident Alerts

Date Detected By Name Resources
2025-12-16T15:20:19+02:00 KeyloggingAPICall (EDR Detection) KeyloggingAPICall [{“Pid”: 2592,”ProcessPath”: “c:\windows\system32\notepad.exe”,”CommandLine”: “"C:\Windows\System32\notepad.exe" C:\Users\bdvm\Desktop\New Text Document.txt”,”ParentPid”: 5212,”ParentProcessPath”: “c:\windows\explorer.exe”,”ParentProcessUser”: “TA66H0I6F225\bdvm”,”User”: “TA66H0I6F225\bdvm”,”ProcessAccessPrivileges”: “elevated”,”ParentProcessAccessPrivileges”: “elevated”,”ProcessIntegrityLevel”: “high”,”ParentProcessIntegrityLevel”: “high”,”Type”: “process”}]

gz-incident-list

Retrieves incidents within the last three days from all endpoints or a specific endpoint.

Base Command

gz-incident-list

Input

Argument Name Description Required
from_date The start date to retrieve incidents from. The default value is the current date minus three days. Optional
to_date The end date to retrieve incidents until. The default value is the current date and time. Optional
limit The maximum number of incidents to retrieve. Optional
endpoint_id The ID of the endpoint to list incidents for. Optional

Context Output

Path Type Description
GravityZone.IncidentsList.ID String The incident ID.
GravityZone.IncidentsList.Type String The incident type (‘incident’ / ‘extendedIncident’).
GravityZone.IncidentsList.CompanyName String The GravityZone company name where the incident is located.
GravityZone.IncidentsList.Number Number The incident number (specific to the company).
GravityZone.IncidentsList.SeverityScore Number The incident severity score (0 - 100).
GravityZone.IncidentsList.Status Number The incident status.
GravityZone.IncidentsList.ActionTaken String The action taken by the detecting technology (‘reported’ / ‘blocked’ / ‘partially_blocked’).
GravityZone.IncidentsList.Created Date The date when the incident was detected on the endpoint / sensor.
GravityZone.IncidentsList.LastUpdated Date The date when the incident was last updated in GravityZone or by the endpoint / sensor.
GravityZone.IncidentsList.LastProcessed Date The incident last processed date by GravityZone services.
GravityZone.IncidentsList.Permalink String The incident URL in the GravityZone Console.
GravityZone.IncidentsList.AssignedPriority String The priority assigned to the incident (‘unknown’ / ‘low’ / ‘medium’ / ‘high’ / ‘critical’).
GravityZone.IncidentsList.AssignedUserId String The ID of the user assigned to the incident.
GravityZone.IncidentsList.RawJSON JSON The raw JSON response from the GravityZone API.
GravityZone.IncidentsList.EndpointID String The endpoint ID. Available only for ‘incident’-type incidents.
GravityZone.IncidentsList.EndpointHostname String The endpoint hostname. Available only for ‘incident’-type incidents.
GravityZone.IncidentsList.EndpointIP String The endpoint IP address. Available only for ‘incident’-type incidents.

Command example


#### Context Example

```json
{
    "GravityZone": {
        "IncidentsList": [
            {
                "ActionTaken": "reported",
                "AssignedPriority": "unknown",
                "AssignedUserId": null,
                "AttackTypes": [
                    "Persistence"
                ],
                "CompanyID": "611717cb22a30cee251b03f3",
                "CompanyName": "Company",
                "Created": "2026-02-23T13:09:34+02:00",
                "ID": "699c367136732459d7d3b1af",
                "LastProcessed": "2026-02-23T13:13:53+02:00",
                "LastUpdated": "2026-02-23T13:09:34+02:00",
                "Number": 1017,
                "Permalink": "https://gravityzone.domain/#!/incidents/view/699c367136732459d7d3b1af",
                "RawJSON": {
                    "assignee": null,
                    "attackTypes": [
                        "Persistence"
                    ],
                    "company": {
                        "id": "611717cb22a30cee251b03f3",
                        "name": "Company"
                    },
                    "created": "2026-02-23T13:09:34+02:00",
                    "details": {
                        "contains": null,
                        "counters": {
                            "ADInstances": 0,
                            "AWSInstances": 0,
                            "DGAs": 0,
                            "DNSs": 0,
                            "GCPInstances": 0,
                            "IPs": 0,
                            "IoTs": 0,
                            "atlassianBitbucketProducts": 0,
                            "atlassianConfluenceProducts": 0,
                            "atlassianInstances": 0,
                            "atlassianJiraProducts": 0,
                            "azureADInstances": 1,
                            "bitbucketProjects": 0,
                            "cloudStorages": 0,
                            "confluenceSpaces": 0,
                            "containers": 0,
                            "databases": 0,
                            "domains": 0,
                            "emails": 0,
                            "endpoints": 0,
                            "exfiltratedFiles": 0,
                            "externalDrives": 0,
                            "externalSources": 0,
                            "googleWorkspaceInstances": 0,
                            "identities": 1,
                            "internalEmails": 0,
                            "internalIPs": 0,
                            "mobileDevices": 0,
                            "office365Instances": 0,
                            "printers": 0,
                            "routers": 0,
                            "servers": 0,
                            "storages": 0,
                            "torNodes": 0,
                            "users": 1,
                            "virtualDesktops": 0
                        },
                        "partOf": null
                    },
                    "incidentId": "699c367136732459d7d3b1af",
                    "incidentLink": "https://gravityzone.domain/#!/incidents/view/699c367136732459d7d3b1af",
                    "incidentNumber": 1017,
                    "incidentType": "extendedIncident",
                    "lastProcessed": "2026-02-23T13:13:53+02:00",
                    "lastUpdated": "2026-02-23T13:09:34+02:00",
                    "mainAction": "reported",
                    "priority": "unknown",
                    "severityScore": 71,
                    "status": "in_progress"
                },
                "SeverityScore": 71,
                "Status": 1,
                "Type": "extendedIncident"
            }
        ]
    }
}

Human Readable Output

GravityZone Incidents List

ActionTaken Assigned Priority Assigned User ID Attack Types Company Name Created ID Last Processed Last Updated Number Permalink Severity Score Status Type
Reported Unknown Unassigned Persistence Company 2026-02-23T13:09:34+02:00 699c367136732459d7d3b1af 2026-02-23T13:13:53+02:00 2026-02-23T13:09:34+02:00 1017 https://gravityzone.domain/#!/incidents/view/699c367136732459d7d3b1af 71% 1 (Active) Extended Incident (XDR)

Command example

!gz-incident-list from_date="2026-02-20" to_date="2026-02-21" limit="1"

Context Example

{
    "GravityZone": {
        "IncidentsList": [
            {
                "ActionTaken": "reported",
                "AssignedPriority": "unknown",
                "AssignedUserId": null,
                "AttackTypes": [
                    "Persistence"
                ],
                "CompanyID": "611717cb22a30cee251b03f3",
                "CompanyName": "Company",
                "Created": "2026-02-20T20:58:17+02:00",
                "ID": "6998b40f36732459d7d3aa58",
                "LastProcessed": "2026-02-20T21:20:47+02:00",
                "LastUpdated": "2026-02-20T20:58:17+02:00",
                "Number": 998,
                "Permalink": "https://gravityzone.domain/#!/incidents/view/6998b40f36732459d7d3aa58",
                "RawJSON": {
                    "assignee": null,
                    "attackTypes": [
                        "Persistence"
                    ],
                    "company": {
                        "id": "611717cb22a30cee251b03f3",
                        "name": "Company"
                    },
                    "created": "2026-02-20T20:58:17+02:00",
                    "details": {
                        "contains": null,
                        "counters": {
                            "ADInstances": 0,
                            "AWSInstances": 0,
                            "DGAs": 0,
                            "DNSs": 0,
                            "GCPInstances": 0,
                            "IPs": 0,
                            "IoTs": 0,
                            "atlassianBitbucketProducts": 0,
                            "atlassianConfluenceProducts": 0,
                            "atlassianInstances": 0,
                            "atlassianJiraProducts": 0,
                            "azureADInstances": 1,
                            "bitbucketProjects": 0,
                            "cloudStorages": 0,
                            "confluenceSpaces": 0,
                            "containers": 0,
                            "databases": 0,
                            "domains": 0,
                            "emails": 0,
                            "endpoints": 0,
                            "exfiltratedFiles": 0,
                            "externalDrives": 0,
                            "externalSources": 0,
                            "googleWorkspaceInstances": 0,
                            "identities": 1,
                            "internalEmails": 0,
                            "internalIPs": 0,
                            "mobileDevices": 0,
                            "office365Instances": 0,
                            "printers": 0,
                            "routers": 0,
                            "servers": 0,
                            "storages": 0,
                            "torNodes": 0,
                            "users": 1,
                            "virtualDesktops": 0
                        },
                        "partOf": null
                    },
                    "incidentId": "6998b40f36732459d7d3aa58",
                    "incidentLink": "https://gravityzone.domain/#!/incidents/view/6998b40f36732459d7d3aa58",
                    "incidentNumber": 998,
                    "incidentType": "extendedIncident",
                    "lastProcessed": "2026-02-20T21:20:47+02:00",
                    "lastUpdated": "2026-02-20T20:58:17+02:00",
                    "mainAction": "reported",
                    "priority": "unknown",
                    "severityScore": 71,
                    "status": "open"
                },
                "SeverityScore": 71,
                "Status": 0,
                "Type": "extendedIncident"
            }
        ]
    }
}

Human Readable Output

GravityZone Incidents List

ActionTaken Assigned Priority Assigned User ID Attack Types Company Name Created ID Last Processed Last Updated Number Permalink Severity Score Status Type
Reported Unknown Unassigned Persistence Company 2026-02-20T20:58:17+02:00 6998b40f36732459d7d3aa58 2026-02-20T21:20:47+02:00 2026-02-20T20:58:17+02:00 998 http://gravityzone.domain/#!/incidents/view/6998b40f36732459d7d3aa58 71% 0 (Pending) Extended Incident (XDR)

Command example

!gz-incident-list endpoint_id=694148bffe8d4e463ca5bd1e from_date="2025-11-20"

Context Example

{
    "GravityZone": {
        "IncidentsList": [
            {
                "ActionTaken": "reported",
                "AssignedPriority": "critical",
                "AssignedUserId": "6540b72b1ffbc14e1808bc00",
                "AttackTypes": [
                    "Malware"
                ],
                "CompanyID": "611717cb22a30cee251b03f3",
                "CompanyName": "Company",
                "Created": "2025-12-17T09:02:03+02:00",
                "ID": "694255755f5c8b75247c7ce2",
                "LastProcessed": "2025-12-17T09:02:13+02:00",
                "LastUpdated": "2025-12-17T09:02:03+02:00",
                "Number": 477,
                "Permalink": "https://gravityzone.domain/#!/incidents/view/694255755f5c8b75247c7ce2",
                "EndpointID" : "694148bffe8d4e463ca5bd1e",
                "EndpointHostname": "TA66H0I6F225",
                "EndpointIP": "1.1.1.1",
                "RawJSON": {
                    "assignee": "6540b72b1ffbc14e1808bc00",
                    "attackTypes": [
                        "Malware"
                    ],
                    "company": {
                        "id": "611717cb22a30cee251b03f3",
                        "name": "Company"
                    },
                    "created": "2025-12-17T09:02:03+02:00",
                    "details": {
                        "computerFqdn": "ta66h0i6f225",
                        "computerId": "694148bffe8d4e463ca5bd1e",
                        "computerIp": "1.1.1.1",
                        "computerMacAddresses": [
                            "005056a7862b"
                        ],
                        "computerName": "TA66H0I6F225",
                        "counters": {
                            "domains": 0,
                            "endpoints": 1,
                            "events": 6,
                            "files": 0,
                            "processes": 2,
                            "registries": 0,
                            "storages": 0
                        },
                        "detectionName": "RegSecurityDump",
                        "partOf": null
                    },
                    "incidentId": "694255755f5c8b75247c7ce2",
                    "incidentLink": "https://gravityzone.domain/#!/incidents/view/694255755f5c8b75247c7ce2",
                    "incidentNumber": 477,
                    "incidentType": "incident",
                    "lastProcessed": "2025-12-17T09:02:13+02:00",
                    "lastUpdated": "2025-12-17T09:02:03+02:00",
                    "mainAction": "reported",
                    "priority": "critical",
                    "severityScore": 33,
                    "status": "closed"
                },
                "SeverityScore": 33,
                "Status": 2,
                "Type": "incident"
            }
        ]
    }
}

Human Readable Output

GravityZone Incidents List

ActionTaken Assigned Priority Assigned User ID Attack Types Company Name Created Endpoint ID Endpoint IP Endpoint Name ID Last Processed Last Updated Number Permalink Severity Score Status Type
Reported Critical 6540b72b1ffbc14e1808bc00 Malware Company 2025-12-17T09:02:03+02:00 694148bffe8d4e463ca5bd1e 1.1.1.1 TA66H0I6F225 694255755f5c8b75247c7ce2 2025-12-17T09:02:13+02:00 2025-12-17T09:02:03+02:00 477 https://gravityzone.domain/#!/incidents/view/694255755f5c8b75247c7ce2 33% 2 (Done) Incident (EDR)

gz-incident-add-note

Adds a note to one or more incidents.

Base Command

gz-incident-add-note

Input

Argument Name Description Required
id The IDs of the incidents to add a note to. Supports comma separated values. Required
note The note to add to the incidents. Required

Context Output

Path Type Description
GravityZone.Command.AddIncidentNote.IncidentID String The incident ID.
GravityZone.Command.AddIncidentNote.Note String The requested note.
GravityZone.Command.AddIncidentNote.CommandStatus String The command status.

Command example

!gz-incident-add-note id=69415c9d5f5c8b75247c58d1 note=InvestigationInProgress

Context Example

{
    "GravityZone": {
        "Command": {
            "AddIncidentNote": {
                "CommandStatus": "Success",
                "IncidentID": "69415c9d5f5c8b75247c58d1",
                "Note": "InvestigationInProgress"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.AddIncidentNote command on incidents 69415c9d5f5c8b75247c58d1

IncidentID Note CommandStatus
69415c9d5f5c8b75247c58d1 InvestigationInProgress Success

gz-incident-change-status

Changes the status of one or more incidents.

Base Command

gz-incident-change-status

Input

Argument Name Description Required
id The IDs of the incidents to update. Supports comma separated values. Required
status The new status of the incidents. Possible values are: PENDING, ACTIVE, DONE, ARCHIVE. Required

Context Output

Path Type Description
GravityZone.Command.ChangeIncidentStatus.IncidentID String The incident ID.
GravityZone.Command.ChangeIncidentStatus.IncidentStatus String The requested status of the incident.
GravityZone.Command.ChangeIncidentStatus.CommandStatus String The command status.

Command example

!gz-incident-change-status id=69415c9d5f5c8b75247c58d1 status=ACTIVE

Context Example

{
    "GravityZone": {
        "Command": {
            "ChangeIncidentStatus": {
                "CommandStatus": "Success",
                "IncidentID": "69415c9d5f5c8b75247c58d1",
                "IncidentStatus": "ACTIVE"
            }
        }
    }
}

Human Readable Output

GravityZone.Command.ChangeIncidentStatus command on incidents 69415c9d5f5c8b75247c58d1

IncidentID IncidentStatus CommandStatus
69415c9d5f5c8b75247c58d1 ACTIVE Success

gz-poll-investigation-activity-status

Checks the status of an investigation activity. This command is not intended for direct use.

Base Command

gz-poll-investigation-activity-status

Input

Argument Name Description Required
target_id The endpoint ID. Required
activity_id The activity ID. Required
output_file The path of the output file. Optional
metadata The metadata to pass to the task. Optional

Context Output

There is no context output for this command.

gz-poll-live-search-status

Checks the status of a Live Search query. This command is not intended for direct use.

Base Command

gz-poll-live-search-status

Input

Argument Name Description Required
task_id The task ID. Required
search_type The Live Search query type. Optional
metadata The metadata to pass to the task. Optional

Context Output

There is no context output for this command.

gz-poll-task-status

Checks the status of a task. This command is not intended for direct use.

Base Command

gz-poll-task-status

Input

Argument Name Description Required
task_id The task ID. Required
metadata The metadata to pass to the task. Optional

Context Output

There is no context output for this command.

get-modified-remote-data

Retrieves incidents that were modified since the last data sync. This command is intended for debugging purposes.

Base Command

get-modified-remote-data

Input

Argument Name Description Required
lastUpdate The time when the incident was last updated. Required

Context Output

There is no context output for this command.

get-remote-data

Retrieves data from a remote incident without updating the current incident. This command is intended for debugging purposes.

Base Command

get-remote-data

Input

Argument Name Description Required
id The ID of the incident to fetch. Required
lastUpdate The time when the incident was last updated. Required

Context Output

There is no context output for this command.

update-remote-system

Updates the remote incident with local incident changes without updating the current incident. This command is intended for debugging purposes.

Base Command

update-remote-system

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

get-mapping-fields

Returns the list of fields available for outgoing mirroring. This command is intended for debugging purposes only.

Base Command

get-mapping-fields

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and GravityZone corresponding incidents (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

  1. Enable Fetching incidents in your instance configuration.

  2. In the Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:

    Option Description
    None Disables incident mirroring.
    Incoming Reflects status changes from GravityZone incidents in Cortex XSOAR incidents.
    Outgoing Reflects status changes from Cortex XSOAR incidents in GravityZone incidents.
    Both Synchronizes status changes bidirectionally between Cortex XSOAR and GravityZone incidents.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.

gz-endpoint-users-loggedin

Retrieves details of all active user sessions on a specific managed endpoint.

Base Command

gz-endpoint-users-loggedin

Input

Argument Name Description Required
id The target endpoint ID. The endpoint must be accessible to you. Required

Context Output

Path Type Description
GravityZone.Endpoint.ID String The endpoint ID.
GravityZone.Endpoint.Hostname String The endpoint hostname.
GravityZone.Endpoint.ActiveSessions.Username String The username of the currently logged-in user.
GravityZone.Endpoint.ActiveSessions.ConnectionType String The connection type for the session.
GravityZone.Endpoint.ActiveSessions.StartTime Date The session start time, if available (e.g., “2021-05-19T10:37:56Z”).
GravityZone.Endpoint.ActiveSessions.UserSID String The Security Identifier (SID) of the logged-in user, if available.
GravityZone.Endpoint.ActiveSessions.DomainSID String The Security Identifier (SID) of the logged-in user’s domain, if available.
GravityZone.Endpoint.ActiveSessions.OrganizationalUnitDN String The full distinguished name (DN) of the organizational unit, if available.
GravityZone.Endpoint.ActiveSessions.MemberOfSIDs Array The SIDs for the groups to which the logged-in user belongs, if available.

Command example

!gz-endpoint-users-loggedin id=6942a43afe8d4e463ca5c197

Context Example

{
    "GravityZone": {
        "Endpoint": {
            "ID": "6942a43afe8d4e463ca5c197",
            "Hostname": "bdvm",
            "ActiveSessions": [
                {
                    "Username": "user@example.com",
                    "ConnectionType": "local",
                    "StartTime": "2021-05-19T10:37:56Z",
                    "UserSID": "S-1-5-21-1111111111-1111111111-1111111111-1001",
                    "DomainSID": "S-1-5-21-1111111111-1111111111-1111111111",
                    "OrganizationalUnitDN": "OU=Users,DC=example,DC=com",
                    "MemberOfSIDs": [
                        "S-1-5-32-544",
                        "S-1-5-32-545"
                    ]
                }
            ]
        }
    }
}

Human Readable Output

Active sessions on endpoint 6942a43afe8d4e463ca5c197

Username ConnectionType StartTime UserSID DomainSID OrganizationalUnitDN MemberOfSIDs
TESTDOMAIN\full.user local 2021-05-19T10:37:56Z S-1-2-25-33 S-1-23-131231 OU=office,OU=Developers,OU=Users,DC=microsoft,DC=com S-1-5-32-450
basic.user remote 2021-05-19T11:00:00Z        

gz-endpoint-create-memory-dump

Initiates the creation of a memory dump for the specified endpoint. Once the dump is successfully generated, the resulting archive is uploaded to the Bitdefender cloud.

Important:

  • Please contact Bitdefender Enterprise Support to configure this feature.
  • The resulting memory dump archive is automatically deleted from the Bitdefender cloud after 24 hours.
  • The memory dump creation task completes successfully only when the generated memory dump archive is 16 GB or smaller.

Base Command

gz-endpoint-create-memory-dump

Input

Argument Name Description Required
id The target endpoint ID. The endpoint must be accessible and run a Windows operating system. Required
path The full path to the destination folder on the specified endpoint where the memory dump archive will be created. Required
password The password used to secure the memory dump archive after it is created. It must contain at least 12 characters, including one uppercase letter, one lowercase letter, one digit, and one special character. Required
polling Whether the command waits for the memory dump task completion. If set to true, the command returns the final result after the task completes. If set to false, the command returns only the endpoint ID and task ID immediately after the task is initiated. Optional

Context Output

Path Type Description
GravityZone.MemoryDump.TaskID String The memory dump task ID.
GravityZone.MemoryDump.TaskType String The task type.
GravityZone.MemoryDump.Status String The memory dump task status.
GravityZone.MemoryDump.EndpointID String The endpoint ID.
GravityZone.MemoryDump.Hostname String The endpoint hostname.
GravityZone.MemoryDump.StartDate Date The date and time when the memory dump task started (e.g., “2026-05-25T10:00:00Z”).
GravityZone.MemoryDump.EndDate Date The date and time when the memory dump task ended, if available (e.g., “2026-05-25T10:01:00Z”).
GravityZone.MemoryDump.ErrorCode String An error code if the memory dump task fails, or “Success” if the task completes successfully.
GravityZone.MemoryDump.Error String An error message if the memory dump task fails, or “Success” if the task completes successfully.
GravityZone.MemoryDump.DownloadURL String The memory dump download URL, available after the task completes successfully.

Command example

!gz-endpoint-create-memory-dump id=6942a43afe8d4e463ca5c197 password="ComplexPass123!" path=C:\\test2

Context Example

{
    "GravityZone": {
        "MemoryDump": {
            "TaskID": "6836f4a01a2b3c4d5e6f7a8b",
            "TaskType": "CreateMemoryDump",
            "Status": "Processed",
            "EndpointID": "6942a43afe8d4e463ca5c197",
            "Hostname": "bdvm",
            "StartDate": "2026-05-25T10:00:00Z",
            "EndDate": "2026-05-25T10:01:00Z",
            "ErrorCode": "Success",
            "Error": "Success",
            "DownloadURL": "https://example.com/memory-dump.zip"
        }
    }
}

Human Readable Output

This example illustrates the human-readable output when polling is set to true. When polling is false, the table contains only the task ID and endpoint ID.

Memory dump for endpoint 6942a43afe8d4e463ca5c197

EndpointID Hostname StartDate EndDate Error DownloadURL
6942a43afe8d4e463ca5c197 bdvm 2026-05-25T10:00:00Z 2026-05-25T10:01:00Z Success https://example.com/memory-dump.zip

gz-endpoint-memory-dump-status

Verifies the status of a task initiated via gz-endpoint-create-memory-dump.

Base Command

gz-endpoint-memory-dump-status

Input

Argument Name Description Required
task_id The ID of the task started through gz-endpoint-create-memory-dump. This ID is returned upon task initiation. Required
endpoint_id The ID of the endpoint for which the specified task was initiated. Required
polling Whether the command waits for the gz-endpoint-create-memory-dump task completion. If set to true, the command returns the final result after the task completes successfully or fails. If set to false, the command returns immediately, providing only the task status. Optional

Context Output

Path Type Description
GravityZone.MemoryDump.TaskID String The ID of the task started through gz-endpoint-create-memory-dump.
GravityZone.MemoryDump.TaskType String The task type.
GravityZone.MemoryDump.Status String The status of the task started through gz-endpoint-create-memory-dump.
GravityZone.MemoryDump.EndpointID String The endpoint ID.
GravityZone.MemoryDump.Hostname String The endpoint hostname.
GravityZone.MemoryDump.StartDate Date The date and time when the memory dump task started (e.g., “2026-05-25T10:00:00Z”).
GravityZone.MemoryDump.EndDate Date The date and time when the memory dump task ended, if available (e.g., “2026-05-25T10:01:00Z”).
GravityZone.MemoryDump.ErrorCode String An error code if the task started through gz-endpoint-create-memory-dump fails, or “Success” if the task completes successfully.
GravityZone.MemoryDump.Error String An error message if the task started through gz-endpoint-create-memory-dump fails, or “Success” if the task completes successfully.
GravityZone.MemoryDump.DownloadURL String The memory dump download URL, available after the memory dump creation task completes successfully.

Command example

!gz-endpoint-memory-dump-status task_id=6836f4a01a2b3c4d5e6f7a8b endpoint_id=6942a43afe8d4e463ca5c197

Context Example

{
    "GravityZone": {
        "MemoryDump": {
            "TaskID": "6836f4a01a2b3c4d5e6f7a8b",
            "TaskType": "CreateMemoryDump",
            "Status": "Processed",
            "EndpointID": "6942a43afe8d4e463ca5c197",
            "Hostname": "bdvm",
            "StartDate": "2026-05-25T10:00:00Z",
            "EndDate": "2026-05-25T10:01:00Z",
            "ErrorCode": "Success",
            "Error": "Success",
            "DownloadURL": "https://example.com/memory-dump.zip"
        }
    }
}

Human Readable Output

This example illustrates the human-readable output when polling is set to true. When polling is false, only the status of the memory dump creation task is displayed.

Memory dump for endpoint 6942a43afe8d4e463ca5c197

EndpointID Hostname StartDate EndDate Error DownloadURL
6942a43afe8d4e463ca5c197 bdvm 2026-05-25T10:00:00Z 2026-05-25T10:01:00Z Success https://example.com/memory-dump.zip

gz-poll-endpoint-users-loggedin-status

Verifies the status of a task initiated via gz-endpoint-users-loggedin. This command is invoked automatically and is not intended for direct use.

Base Command

gz-poll-endpoint-users-loggedin-status

Input

Argument Name Description Required
task_id The ID of the task started through gz-endpoint-users-loggedin. Required
endpoint_id The ID of the managed endpoint associated with the specified task. Required

Context Output

There is no context output for this command.

Configuration parameters

  • url — Server URL (required)
  • credentials — (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • max_fetch — Maximum incidents to fetch
  • first_fetch — First fetch time
  • mirror_direction — Mirroring Direction
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval

Commands (27)

  • fetch-incidents

    Retrieves incidents from GravityZone Cloud.

  • get-mapping-fields

    Returns the list of fields available for outgoing mirroring. This command is intended for debugging purposes only.

  • get-modified-remote-data

    Retrieves incidents that were modified since the last data sync. This command is intended for debugging purposes.

  • get-remote-data

    Retrieves data from a remote incident without updating the current incident. This command is intended for debugging purposes.

  • gz-endpoint-create-memory-dump

    Initiates the creation of a memory dump for the specified endpoint. Once the dump is successfully generated, the resulting archive is uploaded to the Bitdefender cloud.

  • gz-endpoint-deisolate

    Restores an isolated endpoint to the network.

  • gz-endpoint-download-file

    Downloads a file from an endpoint.

  • gz-endpoint-download-investigation-package

    Collects and downloads an investigation package from an endpoint.

  • gz-endpoint-get

    Retrieves endpoint details by endpoint ID.

  • gz-endpoint-get-process-tree-by-hash

    Retrieves the process tree on an endpoint for a specified process hash. The applied policy must allow Live Search and the endpoint must be online.

  • gz-endpoint-isolate

    Isolates an endpoint from the network.

  • gz-endpoint-kill-process

    Terminates a process on an endpoint by process ID.

  • gz-endpoint-list

    Retrieves the list of managed endpoints.

  • gz-endpoint-list-by-running-process-hash

    Retrieves endpoints that are running processes with a specified hash. The API key and the applied policy must allow Live Search and endpoints must be online. The command waits up to five minutes for responses before timing out.

  • gz-endpoint-memory-dump-status

    Verifies the status of a task initiated via gz-endpoint-create-memory-dump.

  • gz-endpoint-run-command

    Runs a command on the endpoint. The applied policy must have remote shell enabled for this action to work.

  • gz-endpoint-upload-file

    Uploads a file to an endpoint.

  • gz-endpoint-users-loggedin

    Retrieves details of all active user sessions on a specific managed endpoint.

  • gz-incident-add-note

    Adds a note to one or more incidents.

  • gz-incident-change-status

    Changes the status of one or more incidents.

  • gz-incident-get

    Retrieves incident details by ID.

  • gz-incident-list

    Retrieves incidents from the last three days for all endpoints or for a specific endpoint.

  • gz-poll-endpoint-users-loggedin-status

    Verifies the status of a task initiated via gz-endpoint-users-loggedin. This command is invoked automatically and is not intended for direct use.

  • gz-poll-investigation-activity-status

    Checks the status of an investigation activity. This command is not intended for direct use.

  • gz-poll-live-search-status

    Checks the status of a Live Search query. This command is not intended for direct use.

  • gz-poll-task-status

    Checks the task status. This command is not intended for direct use.

  • update-remote-system

    Updates the remote incident with local incident changes without updating the current incident. This command is intended for debugging purposes.

Source

GravityZone.py GravityZone_test.py GravityZone.yml GravityZone_description.md command_examples.txt
Download History Raw 
## GravityZone

For detailed API documentation, see the [Bitdefender GravityZone Public API](https://www.bitdefender.com/business/support/en/77209-125277-public-api.html).

GravityZone provides secure API access to incident and event data, as well as the ability to perform remediation actions.

To integrate with third-party applications, you must generate an API key, which authorizes communication with the GravityZone Cloud platform.

### Manage GravityZone API keys

To integrate with third-party applications, you must generate an API key which authorizes communication with the GravityZone Cloud platform.
API keys are created in the **My account** section of the GravityZone Control Center. Each key grants access to selected APIs, as specified during creation.
Some sensitive operations require elevated permissions. If required, contact Bitdefender Enterprise Support to have your API key permissions updated.

#### Generate an API key

To generate an API key:

1. Log in with an administrator account that has View and Analyze Data, Manage Networks, Manage Users, and Manage Company permissions.
2. Click your username in the upper-right corner and select **My account**.
3. Go to the **API keys** section and click **Add**.
4. Provide a description and select the APIs to enable.
5. Click **Generate**.
6. The API key will be displayed. It is only visible while this window is open and cannot be retrieved later.
7. Use the **Copy to clipboard** button to copy and securely store the key.
8. Close the window. The new key will appear encoded in the **API keys** section, along with its details.

**Note:**
API keys provide access to sensitive data, including packages and inventory. To prevent unauthorized access, do not share your API keys.

#### Mirroring

- When enabled, mirroring synchronizes only the **Incident status** field for incidents modified in the last 24 hours.
- Closing an incident in Cortex XSOAR closes the corresponding incident in GravityZone and adds a related note.
- Closing an incident in GravityZone also closes the corresponding incident in Cortex XSOAR.