Collects endpoint compliance posture from Bitdefender GravityZone
epack install collector bitdefender
Adds to epack.yaml, resolves dependencies, downloads binary.
Run all configured collectors and build a pack:
epack collect
Runs all collectors in epack.yaml and outputs an evidence pack.
Or add manually to epack.yaml:
collectors:
bitdefender:
source: https://github.com/locktivity/epack-collector-bitdefender
Then run epack install to lock and sync.
Gathers endpoint compliance posture from Bitdefender GravityZone Control Center.
See docs/levels.md for exactly what's included at each collection level, and
how this collector defines "compliant" (GravityZone's Network API has no single native
compliance-percentage field).
getEndpointsList (Network API) to build the endpoint inventory and compute
the compliance percentage — one paginated call, regardless of levelinternal, it additionally calls getManagedEndpointDetails per computer (Network
API) for enabled protection modules, and getQuarantineItemsList once for the whole
company (Quarantine API), grouping results by computer client-sideSee Configuration for setup instructions.
The collector uses a GravityZone API key over HTTP Basic auth (API key as username, empty
password), per GravityZone's Public API
convention.
collectors:
bitdefender:
source: locktivity/epack-collector-bitdefender@^0.1
config:
base_url: https://cloud.gravityzone.bitdefender.com/api
level: audit
secrets:
- BITDEFENDER_API_KEY
BITDEFENDER_API_KEY| Deployment | base_url |
|---|---|
| Global/US cloud | https://cloud.gravityzone.bitdefender.com/api |
| EU cloud | https://cloudgz.gravityzone.bitdefender.com/api |
| On-premises | Your Control Center's own API URL |
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
base_url |
string | Yes | - | GravityZone Control Center API base URL |
parent_group_id |
string | No | company root | Scope collection to one network group (and descendants) instead of the whole company |
level |
string | No | trust |
Collection level: trust, audit, or internal |
| Name | Required | Description |
|---|---|---|
BITDEFENDER_API_KEY |
Yes | GravityZone API key, used as the HTTP Basic auth username |
Each API key is scoped to specific APIs at creation time. Grant only what the configured
level needs — a missing API skips just that surface (recorded under
diagnostics.permission_errors), so you can grant incrementally.
| Surface | Gating API | Needed for |
|---|---|---|
| Compliance %, endpoint inventory | Network | trust / audit / internal |
| Per-endpoint policy + enabled modules | Network | internal |
| Quarantine inventory | Quarantine | internal |
trust and audit only ever need the Network API.
"base_url is required"
Set base_url in your config — see Region / on-premises base URLs
above.
"authentication required"
Provide BITDEFENDER_API_KEY as a secret.
GravityZone JSON-RPC error -32001 ("Authorization error")
The API key isn't scoped to the API the call needed. Add that API to the key under
My Account > API keys in Control Center — see
Required GravityZone APIs above. The collector surfaces this
as a permission_errors diagnostic entry rather than failing the whole run, except for the
initial endpoint list call (Network API), which is required at every level.
GravityZone JSON-RPC error -32003 / HTTP 429 ("Too many requests")
GravityZone rate-limits API keys to a fixed number of requests per second. This collector
doesn't currently retry on rate limiting — if you hit it consistently (e.g. a very large
fleet at internal level, which calls getManagedEndpointDetails once per computer),
consider narrowing parent_group_id or running at audit instead.
**Full Changelog**: https://github.com/locktivity/epack-collector-bitdefender/commits/v0.1.0