GravityZone

GravityZone provides secure access to incident and endpoint data and enables remediation actions through its APIs.

Category

Endpoint

Pack

GravityZone

Configuration parameters

• url — Server URL (required)
• credentials — (required)
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• isFetch — Fetch incidents
• max_fetch — Maximum incidents to fetch
• first_fetch — First fetch time
• mirror_direction — Mirroring Direction
• incidentType — Incident type
• incidentFetchInterval — Incidents Fetch Interval

Commands (27)

• fetch-incidents — Retrieves incidents from GravityZone Cloud.
• get-mapping-fields — Returns the list of fields available for outgoing mirroring. This command is intended for debugging purposes only.
• get-modified-remote-data — Retrieves incidents that were modified since the last data sync. This command is intended for debugging purposes.
• get-remote-data — Retrieves data from a remote incident without updating the current incident. This command is intended for debugging purposes.
• gz-endpoint-create-memory-dump — Initiates the creation of a memory dump for the specified endpoint. Once the dump is successfully generated, the resulting archive is uploaded to the Bitdefender cloud.
• gz-endpoint-deisolate — Restores an isolated endpoint to the network.
• gz-endpoint-download-file — Downloads a file from an endpoint.
• gz-endpoint-download-investigation-package — Collects and downloads an investigation package from an endpoint.
• gz-endpoint-get — Retrieves endpoint details by endpoint ID.
• gz-endpoint-get-process-tree-by-hash — Retrieves the process tree on an endpoint for a specified process hash. The applied policy must allow Live Search and the endpoint must be online.
• gz-endpoint-isolate — Isolates an endpoint from the network.
• gz-endpoint-kill-process — Terminates a process on an endpoint by process ID.
• gz-endpoint-list — Retrieves the list of managed endpoints.
• gz-endpoint-list-by-running-process-hash — Retrieves endpoints that are running processes with a specified hash. The API key and the applied policy must allow Live Search and endpoints must be online. The command waits up to five minutes for responses before timing out.
• gz-endpoint-memory-dump-status — Verifies the status of a task initiated via gz-endpoint-create-memory-dump.
• gz-endpoint-run-command — Runs a command on the endpoint. The applied policy must have remote shell enabled for this action to work.
• gz-endpoint-upload-file — Uploads a file to an endpoint.
• gz-endpoint-users-loggedin — Retrieves details of all active user sessions on a specific managed endpoint.
• gz-incident-add-note — Adds a note to one or more incidents.
• gz-incident-change-status — Changes the status of one or more incidents.
• gz-incident-get — Retrieves incident details by ID.
• gz-incident-list — Retrieves incidents from the last three days for all endpoints or for a specific endpoint.
• gz-poll-endpoint-users-loggedin-status — Verifies the status of a task initiated via gz-endpoint-users-loggedin. This command is invoked automatically and is not intended for direct use.
• gz-poll-investigation-activity-status — Checks the status of an investigation activity. This command is not intended for direct use.
• gz-poll-live-search-status — Checks the status of a Live Search query. This command is not intended for direct use.
• gz-poll-task-status — Checks the task status. This command is not intended for direct use.
• update-remote-system — Updates the remote incident with local incident changes without updating the current incident. This command is intended for debugging purposes.