> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/endpoint-protection/bitdefender.md).

# Bitdefender GravityZone

By integrating **Bitdefender GravityZone** with **ThreatDefence** via Bitdefender’s APIs, you can ingest real-time threat alerts and security events into ThreatDefence, enabling centralised monitoring and faster incident response.

This integration allows ThreatDefence to query endpoint protection data, manage incidents, and initiate remediation actions, such as isolating endpoints or triggering scans - enhancing endpoint visibility and threat mitigation across your environment.

***

### Prerequisites

* GravityZone Control Center access (Company Administrator role)
* A reachable HTTP/HTTPS endpoint with Basic Authentication credentials
* Firewall rules permitting outbound traffic from GravityZone to your endpoint on the required port

***

### Steps

#### 1. Lodge a ticket with ThreatDefence Support.

1. A ticket is required to onboard this datasource, as TD support needs to deploy a collector to your NDR or Syslog forwarder. If you do not have one of these deployed, one will be required.

#### 2. Open Integration Settings

1. Log in to **GravityZone Control Center**
2. Navigate to **Configuration** → **Integrations**
3. Select the **Push** tab (or **SIEM Integration**, depending on your version)

#### 3. Add a New Push Service

1. Click **Add**
2. Set **Service Type** to **HTTP/HTTPS**

#### 4. Configure the Endpoint

| Field          | Value                                   |
| -------------- | --------------------------------------- |
| URL            | `https://{your-ip-address}`             |
| Port           | To be provided by ThreatDefence Support |
| Authentication | Basic Authentication                    |
| Username       | To be provided by ThreatDefence Support |
| Password       | To be provided by ThreatDefence Support |

> **Note:** ThreatDefence Support will provide you the destination port, username and password.

#### 5. Select Event Types

Enable the event categories relevant to your use case:

* **Malware** – detections, blocked threats, quarantine actions
* **Network Attacks** – IDS/IPS alerts, blocked connections
* **Audit** – admin logins, policy changes
* **Device Control** – USB/peripheral events
* **Endpoint** – agent status, scan results

#### 6. Save and Test

1. Click **Save**
2. Use the **Test** button to send a sample event to your endpoint
3. Confirm your endpoint returns **HTTP 200 OK**

***

### Troubleshooting

| Symptom                  | Resolution                                                 |
| ------------------------ | ---------------------------------------------------------- |
| Events not arriving      | Check firewall rules between GravityZone and your endpoint |
| `401 Unauthorized`       | Verify username/password and Basic Auth encoding           |
| No events for a category | Re-check selected event types in push configuration        |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.threatdefence.com/siem-integrations/endpoint-protection/bitdefender.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.