> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/endpoint-protection/bitdefender.md).

# Bitdefender GravityZone

By integrating **Bitdefender GravityZone** with **ThreatDefence** via Bitdefender’s APIs, you can ingest real-time threat alerts and security events into ThreatDefence, enabling centralised monitoring and faster incident response.

This integration allows ThreatDefence to query endpoint protection data, manage incidents, and initiate remediation actions, such as isolating endpoints or triggering scans - enhancing endpoint visibility and threat mitigation across your environment.

***

### Prerequisites

* GravityZone Control Center access (Company Administrator role)
* A reachable HTTP/HTTPS endpoint with Basic Authentication credentials
* Firewall rules permitting outbound traffic from GravityZone to your endpoint on the required port

***

### Steps

#### 1. Lodge a ticket with ThreatDefence Support.

1. A ticket is required to onboard this datasource, as TD support needs to deploy a collector to your NDR or Syslog forwarder. If you do not have one of these deployed, one will be required.

#### 2. Open Integration Settings

1. Log in to **GravityZone Control Center**
2. Navigate to **Configuration** → **Integrations**
3. Select the **Push** tab (or **SIEM Integration**, depending on your version)

#### 3. Add a New Push Service

1. Click **Add**
2. Set **Service Type** to **HTTP/HTTPS**

#### 4. Configure the Endpoint

| Field          | Value                                   |
| -------------- | --------------------------------------- |
| URL            | `https://{your-ip-address}`             |
| Port           | To be provided by ThreatDefence Support |
| Authentication | Basic Authentication                    |
| Username       | To be provided by ThreatDefence Support |
| Password       | To be provided by ThreatDefence Support |

> **Note:** ThreatDefence Support will provide you the destination port, username and password.

#### 5. Select Event Types

Enable the event categories relevant to your use case:

* **Malware** – detections, blocked threats, quarantine actions
* **Network Attacks** – IDS/IPS alerts, blocked connections
* **Audit** – admin logins, policy changes
* **Device Control** – USB/peripheral events
* **Endpoint** – agent status, scan results

#### 6. Save and Test

1. Click **Save**
2. Use the **Test** button to send a sample event to your endpoint
3. Confirm your endpoint returns **HTTP 200 OK**

***

### Troubleshooting

| Symptom                  | Resolution                                                 |
| ------------------------ | ---------------------------------------------------------- |
| Events not arriving      | Check firewall rules between GravityZone and your endpoint |
| `401 Unauthorized`       | Verify username/password and Basic Auth encoding           |
| No events for a category | Re-check selected event types in push configuration        |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.threatdefence.com/siem-integrations/endpoint-protection/bitdefender.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.