| 1 | --- |
| 2 | title: Bitdefender (GravityZone) |
| 3 | description: Ingest Bitdefender GravityZone events into the SOCFortress SIEM stack via the Event Push Service connector. |
| 4 | --- |
| 5 | |
| 6 | ## What this integration is |
| 7 | |
| 8 | This integration ingests **Bitdefender GravityZone** security events into your SIEM stack using GravityZone’s **Event Push Service**. |
| 9 | |
| 10 | In SOCFortress CoPilot deployments, Bitdefender typically pushes events to a small HTTP receiver/connector, which then forwards them to **Graylog** over syslog. |
| 11 | |
| 12 | --- |
| 13 | |
| 14 | ## Data path (how it flows) |
| 15 | |
| 16 | 1) Bitdefender GravityZone (cloud) → **Event Push Service** |
| 17 | 2) Event Push Service → **CoPilot-hosted HTTP receiver** (connector) |
| 18 | 3) Receiver → **Graylog input** (syslog) |
| 19 | 4) Graylog → stream/index/dashboards (provisioned) |
| 20 | 5) Optional: Graylog alerting → Incident ingestion (if configured) |
| 21 | |
| 22 | --- |
| 23 | |
| 24 | ## Prerequisites |
| 25 | |
| 26 | - Bitdefender API access is enabled and an API client is created. |
| 27 | - Network path is in place so Bitdefender can reach your HTTP receiver. |
| 28 | - You have a target syslog host/port (Graylog input). |
| 29 | |
| 30 | Vendor reference: |
| 31 | - Event Push Service API connector (CEF): https://www.bitdefender.com/business/support/en/77209-144080-build-an-event-push-service-api-connector-for-cef-standard.html |
| 32 | |
| 33 | --- |
| 34 | |
| 35 | ## Credentials & configuration you’ll need |
| 36 | |
| 37 | From Bitdefender: |
| 38 | - API credentials / auth string (connector uses an `authentication_string`) |
| 39 | |
| 40 | From your SIEM: |
| 41 | - Graylog host + port (syslog target) |
| 42 | |
| 43 | From your deployment: |
| 44 | - A public-facing DNS/port so Bitdefender can deliver events to the receiver |
| 45 | |
| 46 | Example receiver config (for context; CoPilot provisioning typically generates this for you): |
| 47 | |
| 48 | ```json |
| 49 | { |
| 50 | "port": 3200, |
| 51 | "syslog_port": 10514, |
| 52 | "transport": "Tcp", |
| 53 | "target": "YOUR_GRAYLOG_SERVER", |
| 54 | "authentication_string": "Basic <base64>", |
| 55 | "secure": { |
| 56 | "enabled": true, |
| 57 | "key": "api/config/server.key", |
| 58 | "cert": "api/config/server.crt" |
| 59 | } |
| 60 | } |
| 61 | ``` |
| 62 | |
| 63 | --- |
| 64 | |
| 65 | ## CoPilot setup (recommended workflow) |
| 66 | |
| 67 | 1) **Provision the customer** first (so the tenant wiring exists). |
| 68 | 2) In CoPilot, open the customer and add the **Bitdefender** integration. |
| 69 | 3) Enter the required configuration values. |
| 70 | 4) Deploy/start the Bitdefender connector container generated during provisioning. |
| 71 | |
| 72 | Provisioning typically creates: |
| 73 | - Graylog CEF/syslog input |
| 74 | - Graylog stream + index |
| 75 | - Grafana datasource + dashboards |
| 76 | - Bitdefender docker compose + config |
| 77 | |
| 78 | --- |
| 79 | |
| 80 | ## Deployment notes (connector container) |
| 81 | |
| 82 | In a standard layout, provisioning creates a customer-specific folder under: |
| 83 | - `/opt/CoPilot/data/data/<CUSTOMER_NAME>/` |
| 84 | |
| 85 | Start the connector: |
| 86 | |
| 87 | ```bash |
| 88 | docker compose -f /opt/CoPilot/data/data/<CUSTOMER_NAME>/<CUSTOMER_NAME>_bitdefender_docker-compose.yml up -d |
| 89 | ``` |
| 90 | |
| 91 | --- |
| 92 | |
| 93 | ## Success criteria |
| 94 | |
| 95 | - [ ] Bitdefender events are arriving in Graylog |
| 96 | - [ ] Events are routed to the customer’s index/stream |
| 97 | - [ ] Dashboards show non-empty data (after a short delay) |
| 98 | |
| 99 | --- |
| 100 | |
| 101 | ## Troubleshooting |
| 102 | |
| 103 | - Verify inbound firewall/NAT allows Bitdefender → HTTP receiver traffic. |
| 104 | - Verify the receiver can reach Graylog syslog input (host/port). |
| 105 | - Validate TLS cert/key configuration if `secure.enabled=true`. |
| 106 | - Confirm auth string matches what Bitdefender expects. |