Security & Identity ยท CONNECTIONManage GravityZone endpoints, incidents, isolation, scans, policies, quarantine, patches, maintenance windows and reports.
Explore 98 workflow actions for Bitdefender GravityZone, including account permissions and operation limits.
Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.
addIntegrators You can use this method to assign an endpoint as an integrator for a specific integration.
A repeated request may repeat the external action. Review the previous result before retrying a write.
addToBlocklist Use this method to set up one or more rules that you can use to add items to blocklists.
A repeated request may repeat the external action. Review the previous result before retrying a write.
applyRecommendations This method applies recommendations by ID and returns success and failure details for each one requested.
A repeated request may repeat the external action. Review the previous result before retrying a write.
assignIncident The assignIncident method enables bulk assignment and reassignment of EDR and XDR incidents to eligible GravityZone users.
A repeated request may repeat the external action. Review the previous result before retrying a write.
assignMaintenanceWindows This method assigns a set of maintenance windows to a policy.
A repeated request may repeat the external action. Review the previous result before retrying a write.
assignPolicy Use this method to assign a policy to one or more endpoints.
A repeated request may repeat the external action. Review the previous result before retrying a write.
changeIncidentPriority You can use this method to change the priority of an incident.
A repeated request may repeat the external action. Review the previous result before retrying a write.
changeIncidentStatus This method changes the status of an incident.
A repeated request may repeat the external action. Review the previous result before retrying a write.
collectInvestigationPackage You can use this method to initiate a forensic collection task on an endpoint.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createAddFileToQuarantineTask This method creates a new task to add a file to quarantine.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createCustomGroup This method creates a new custom group of endpoints.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createCustomRule Method to create a custom rule.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createEmptyQuarantineTask This method creates a new task to empty the quarantine.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createIsolateEndpointTask This method creates one or more tasks to isolate the specified endpoint or endpoints.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createPatchManagementMaintenanceWindow This method creates a maintenance window which you can use in Patch Management.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createReconfigureClientTask This method creates a new Reconfigure Agent task.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createReleaseQuarantineExchangeItemTask This method creates a new task to release items from the quarantine to their intended recipients.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createRemoveQuarantineItemTask This method creates a new task to remove items from quarantine.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createReport This method creates a new instant or scheduled report, based on the parameters received, and returns the ID of the new created report.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createResponseAction You can use this method to take response actions on user nodes generated in GravityZone XDR incidents or your own SOC-generated incidents.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createRestoreEndpointFromIsolationTask This method creates one or more tasks to restore the specified endpoint or endpoints from isolation.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createRestoreQuarantineItemTask This method creates a new task to restore items from the quarantine.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createScanTask This method creates a new scan task.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createScanTaskByMac Use this method to generate a scan task for managed endpoints identified by their MAC address.
A repeated request may repeat the external action. Review the previous result before retrying a write.
createSubmitToSandboxAnalyzerTask Use this method to create a Sandbox Analyzer task and submit up to 5 files for analysis.
A repeated request may repeat the external action. Review the previous result before retrying a write.
deleteAccount You can use this method to delete a specific user account.
A repeated request may repeat the external action. Review the previous result before retrying a write.
deleteCustomGroup This method deletes a custom group.
A repeated request may repeat the external action. Review the previous result before retrying a write.
deleteCustomRule Method to delete a custom rule.
A repeated request may repeat the external action. Review the previous result before retrying a write.
deleteEndpoint This method deletes an endpoint.
A repeated request may repeat the external action. Review the previous result before retrying a write.
deleteIntegration Use this method to delete a specific integration that was configured under the Integrations hub from a target company.
A repeated request may repeat the external action. Review the previous result before retrying a write.
deleteMaintenanceWindow This method deletes a maintenance window.
A repeated request may repeat the external action. Review the previous result before retrying a write.
deletePackage This method deletes a package identified through the provided package ID.
A repeated request may repeat the external action. Review the previous result before retrying a write.
deleteReport The method deletes a report by its ID.
A repeated request may repeat the external action. Review the previous result before retrying a write.
deleteTask You can use this method to delete a specific task, based on its ID.
A repeated request may repeat the external action. Review the previous result before retrying a write.
editMonitoredRulesAccess You can use this method to restrict or allow access to behavioral profiles based on the recommendation generated by a specific PHASR rule.
A repeated request may repeat the external action. Review the previous result before retrying a write.
getAccountDetails Use this method to retrieve information for a specific GravityZone account.
getAccountsList You can use this method to display all the user accounts that belong to a company.
getAllCompanyIdentities Use this method to retrieve all detected identities for a company.
getAllCompanyResources Use this method to retrieve all detected resources for a company.
getApiKeyDetails This method returns details about the API key used.
getBlocklistItems This method lists all items present in a Blocklist.
getCompanyDetails This method retrieves the details of your company.
getConfiguredIntegrations This method allows you to get a list of all the integrations configured on a specific company under the Integrations hub .
getCustomGroupsList This method retrieves the list of groups under a specified group.
getCustomRulesList This method retrieves the list of custom rules for your company.
getEndpointTags This method returns details about the endpoint tags within your company.
getEndpointsList This method returns the list of endpoints.
getHourlyUsageForAmazonEC2Instances This method exposes the hourly usage for each Amazon instance category (micro, medium etc.).
getIncident You can use this method to retrieve information regarding a specific incident, by referencing it's ID.
getIncidentsByIds You can use this method to retrieve information on multiple incidents, by referencing their IDs.
getIncidentsList This method retrieves details about Endpoint and Organization incidents within your company based on the applied filters.
getInstalledPatches Use this method to request a list of installed patches that are associated to specific endpoints or a specific company.
getIntegrators You can use this method to retrieve a list of integrators configured for a specific integration.
getLicenseInfo This method retrieves the license information for a company.
getMaintenanceWindowDetails This method retrieves all the information related to a maintenance window.
getMaintenanceWindowsList This method will display a list of available Maintenance Windows for a company.
getManagedEndpointDetails The getManagedEndpointDetails method retrieves comprehensive information about a specific endpoint managed in GravityZone .
getManuallyApprovedPatches This method returns a list of manually approved patches from the endpoints of a specific company.
getMissingPatches Use this method to request a list of missing patches that are associated to specific endpoints or a specific company.
getMonitoredRuleData You can use this method to retrieved detailed information regarding a specific PHASR rule and the behavioral profiles it applies to.
getMonitoredRules This method displays all the monitored PHASR rules across all behavioral categories for a specific company.
getMonthlyUsage This method exposes the monthly usage for a company in a target month.
getMonthlyUsagePerProductType The method exposes the monthly usage of a company in a target month.
getNetworkInventoryItems This method returns network inventory items.
getNotificationsSettings This method returns the notifications settings.
getPackageDetails This method retrieves information about the configuration of a specific package identified through the provided ID.
getPackagesList Returns the list of available packages.
getPhasrRecommendations Use this method to retrieve PHASR recommendations for a company.
getPoliciesList This method retrieves the list of available policies.
getPolicyDetails This method retrieves all information related to a security policy.
getPushEventStats This method gets the push event statistics and errors.
getQuarantineItemsList This method retrieves the list of quarantined items available for a company.
getRecommendationProfiles Use this method to retrieve information for the behavioral profiles that a specific recommendation applies to.
getReportsList This method returns the list of scheduled reports, according to the parameters received.
getResponseActionStatus You can use this method to request the status and the result of a response action.
getScanTasksList This method returns the list of scan tasks.
getSimilarEmails You can use this method to retrieve emails similar to a given email, scoped to the same company.
getTaskStatus This method retrieves information about the status of a given task identified using its ID.
killProcess You can use this method to initiate a task that terminates a running process on a managed endpoint.
A repeated request may repeat the external action. Review the previous result before retrying a write.
killProcess Use this method to terminate an active process using it's process ID, it's path, the endpoint where it is running, and, if available, the ID of the.
A repeated request may repeat the external action. Review the previous result before retrying a write.
manageIntegration Use this method to enable or disable an integration configured under the Integrations hub .
A repeated request may repeat the external action. Review the previous result before retrying a write.
moveCustomGroup This method moves a custom group to another custom group.
A repeated request may repeat the external action. Review the previous result before retrying a write.
moveEndpoints This method moves a list of endpoints to a custom group.
A repeated request may repeat the external action. Review the previous result before retrying a write.
removeFromBlocklist This method removes one or more items from the Blocklist, identified by their IDs.
A repeated request may repeat the external action. Review the previous result before retrying a write.
removeIntegrators You can use this method to unassign a specific endpoint as an integrator.
A repeated request may repeat the external action. Review the previous result before retrying a write.
resetPushEventStats This method resets the push event statistics and errors.
A repeated request may repeat the external action. Review the previous result before retrying a write.
runGatherLogsTask Use this method to create a task that collects diagnostic logs from an online endpoint.
A repeated request may repeat the external action. Review the previous result before retrying a write.
sendTestPushEvent This method sends a test event.
A repeated request may repeat the external action. Review the previous result before retrying a write.
setEndpointLabel This method sets a new label to an endpoint.
A repeated request may repeat the external action. Review the previous result before retrying a write.
setPolicyModulesState You can use this method to enable or disable the settings associated to a specific policy.
A repeated request may repeat the external action. Review the previous result before retrying a write.
startRetrieveInvestigationFileFromEndpoint You can use this method to retrieve a file from an endpoint within your company and upload it as an archive to a.
A repeated request may repeat the external action. Review the previous result before retrying a write.
startYaraScan You can use this method to initiate an On-demand scan on the specified targets, using a YARA rule to detect files that match the rule conditions.
A repeated request may repeat the external action. Review the previous result before retrying a write.
takeRequestAccessAction Takes action on request access recommendations by either allowing or denying them.
A repeated request may repeat the external action. Review the previous result before retrying a write.
unassignMaintenanceWindows This method unassigns a set of maintenance windows from a policy.
A repeated request may repeat the external action. Review the previous result before retrying a write.
updateCompanyDetails This method updates the details of your company.
A repeated request may repeat the external action. Review the previous result before retrying a write.
updateCustomRule You can use this method to edit any existing custom exclusion or detection rule by referencing its Rule ID .
A repeated request may repeat the external action. Review the previous result before retrying a write.
updateIncidentNote This method assigns a note to an incident.
A repeated request may repeat the external action. Review the previous result before retrying a write.
updatePatchManagementMaintenanceWindow This method modifies a patch management maintenance window.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Use the account and permissions required for your process. Review the connection check before configuring a workflow action.
Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.
Inspect step outputs and confirm the result in Bitdefender GravityZone. A saved workflow is not a completed provider action.
