Bitdefender GravityZone Data Collector

Bitdefender GravityZone Data Collector brings GravityZone security incidents and console activity into Splunk. GravityZone incidents do not stand still: alerts are added, more endpoints become involved, severity changes, and analysts assign, prioritise, comment on and close them. The add-on collects that whole history, so you can triage, investigate and report on GravityZone incidents alongside the rest of your security data. It collects two kinds of data through the GravityZone API, one input per GravityZone company, so a single Splunk deployment can follow many companies, as partners and managed service providers need. The first is security incidents, both endpoint (EDR) and extended (XDR): every time an incident changes, the add-on indexes the new version with a field-level diff and a short, readable summary of what changed. The second is console activity: every entry of the company's GravityZone user activity log, such as sign-ins and failed sign-ins, changes to users and companies, tasks, quarantine actions and actions on incidents, each indexed as its own searchable event. Actions on incidents are also linked to the incidents they affected. Four dashboards are included. Incident Overview shows what is open, how serious it is, who owns it, who initiated it and what GravityZone did about it. Incident Changes is a filterable feed of changes, with severity and priority escalations and re-opened incidents. Incident Detail shows the current state and full history of one incident, with its alerts, nodes and notes, the incidents GravityZone grouped with it, and who changed it in the console. SLA and Ingestion Health shows the time taken to assign and to resolve incidents, open work by owner, and whether every input is collecting. The dashboards focus on incidents; the complete console activity log is available to your own searches, selected by gz_event_type=activity_log. All data uses the bitdefender:gravityzone sourcetype, with plain summary fields named gz_* that keep your own searches simple and fast.