Integrating with Bitdefender GravityZone using HTTP

Overview

You can use HTTP Ingestion to send Bitdefender GravityZone events to Blumira without an on-premises Blumira sensor or a separately hosted connector. GravityZone's Event Push Service sends events directly to a unique HTTPS endpoint that Blumira creates for your organization. Blumira stores these events under the same Bitdefender log type as the sensor-based integration, so the same detections apply.

Before you begin

• You need a GravityZone Cloud console. The Event Push Service is a GravityZone Cloud feature.
• You need a GravityZone user that can create API keys, usually a partner or company administrator.
• GravityZone has no console setting for the Event Push Service. You configure it once by sending a request to the GravityZone API, for example with curl.

Generate your unique Blumira ingestion credentials by doing the following:

1. In Blumira, navigate to HTTP Ingestion.
2. Click Add Ingestion Instance.
3. In the window that appears, do the following:
   1. In Vendor, select Universal Ingestion Source (JSON).
   2. For the vendor name, type bitdefender (lowercase).
      Note: The vendor name must be exactly bitdefender. Blumira uses it to choose the Bitdefender parser. If you use any other name, Blumira does not split GravityZone's event batches into individual events or map their fields.
   3. (Optional) In Ingestion Instance Name, edit the pre-populated name.
   4. (Optional) In Description, type a description that provides context for this instance.
   5. Click Save.
4. In the Credentials window, copy and save the Blumira service URL and the token to use later.

Configuring Bitdefender GravityZone

Create a GravityZone API key

To create your API key in GravityZone, do the following:

1. In the GravityZone console, click your user name in the upper-right corner, and then select My Account.
2. Under API keys, click Add.
3. Type a name for the key, select Event Push Service API, and then click Generate.
4. Copy the API key.
5. On the same page, under Control Center API, copy the entire Access URL, for example https://cloud.gravityzone.bitdefender.com/api. The host varies by region and tenant, so use the URL shown in your console.

This key is only for calling the GravityZone API. You do not enter it in Blumira.

Point the Event Push service at Blumira

On a computer with curl, set these environment variables. Using environment variables keeps the secrets out of your shell history. 

export GZ_ACCESS_URL='https://cloud.gravityzone.bitdefender.com/api'   # Access URL
export GZ_API_KEY='...'          # GravityZone API key
export BLUMIRA_URL='https://...' # Blumira service URL
export BLUMIRA_TOKEN='...'       # Blumira token

Then run the following command:

curl -sS -u "${GZ_API_KEY}:" \
  -H 'Content-Type: application/json' \
  "${GZ_ACCESS_URL}/v1.0/jsonrpc/push" \
  -d @- <<EOF
{
  "jsonrpc": "2.0",
  "id": "blumira-setup",
  "method": "setPushEventSettings",
  "params": {
    "status": 1,
    "serviceType": "jsonRPC",
    "serviceSettings": {
      "url": "${BLUMIRA_URL}",
      "authorization": "Bearer ${BLUMIRA_TOKEN}",
      "requireValidSslCertificate": true
    },
    "subscribeToEventTypes": {
      "antiexploit": true,
      "aph": true,
      "av": true,
      "avc": true,
      "fw": true,
      "hd": true,
      "new-extended-incident": true,
      "new-incident": true,
      "task-status": true
    }
  }
}
EOF

A successful request returns {"id":"blumira-setup","jsonrpc":"2.0","result":true}. 

Consider the following when you run the command: 

• GravityZone signs in with the API key as the user name and an empty password, which is what -u "${GZ_API_KEY}:" sends. The authorization value is different: it is the header GravityZone sends to Blumira, so it must be Bearer followed by a space and your Blumira token.
• The event types in the command are the ones Blumira maps field by field. You can turn on other GravityZone event types, such as ransomware-mitigation. Blumira still collects them, but their module-specific fields are not mapped yet.
• serviceType must be jsonRPC. The cef, splunk, and qradar types send a format that this integration does not read.
• GravityZone keeps one push configuration per account, and setPushEventSettings replaces it. If your account already pushes events to another SIEM, this request takes that push over. To check the current configuration first, run the getPushEventSettings request in Verify the integration, below.
• MSPs: By default, GravityZone pushes events for every company the account manages. To limit the push to specific companies, add "subscribeToCompanies": ["<companyId>", ...] to params. Include your own company ID, and do not send an empty list.

Verify the integration

Check the saved configuration by running this request:

curl -sS -u "${GZ_API_KEY}:" -H 'Content-Type: application/json' \
  "${GZ_ACCESS_URL}/v1.0/jsonrpc/push" \
  -d '{"jsonrpc":"2.0","id":"1","method":"getPushEventSettings","params":{}}'

Send a test event by running this command:

curl -sS -u "${GZ_API_KEY}:" -H 'Content-Type: application/json' \
  "${GZ_ACCESS_URL}/v1.0/jsonrpc/push" \
  -d '{"jsonrpc":"2.0","id":"1","method":"sendTestPushEvent","params":{"eventType":"av"}}'

A test event arrives in Blumira like a real event, with _testEvent_=true in the parameter field. Filter on that value in Report Builder if you do not want test events in your results.

Check the delivery counters with this request:

curl -sS -u "${GZ_API_KEY}:" -H 'Content-Type: application/json' \
  "${GZ_ACCESS_URL}/v1.0/jsonrpc/push" \
  -d '{"jsonrpc":"2.0","id":"1","method":"getPushEventStats","params":{}}'

In the response, sentMessages should increase while errorMessages stays at 0.

Troubleshooting

A new push configuration can take up to about two hours to start sending events. If getPushEventStats shows connection errors or 401/403 responses, check the service URL first, then confirm that the authorization value starts with Bearer and uses your current Blumira token. If you regenerated the token in Blumira, run Step 2 again with the new token.