Using Live Search
SELECT
name AS application_name,
version,
publisher,
install_date,
install_location
FROM programs
ORDER BY name;
Recent Comments
No comments to show.Categories
Using Bitdefender Gravityzone to do Software Inventory
Network Check Script
You can download here
Windows
https://github.com/darklite404/Bitdefender_Gravityzone/blob/main/BESTagentnetworkcheckMay2026.ps1
Linux
https://github.com/darklite404/Bitdefender_Gravityzone/blob/main/BESTagentnetworkcheckMay2026.sh
using data for May 2026
To run
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
.\BESTagentnetworkcheckMay2026.ps1
log will show what is the error
Posted in Gravityzone
Leave a comment
Bitdefender Endpoint Security Tools remote deployment
Setting this
Then https://www.bitdefender.com/business/support/en/77209-157497-install-security-agents—standard-procedure.html#id337204
For Active Directory machines use these syntaxes: username@domain.com and domain\username. To make sure that entered credentials will work, add them in both forms (username@domain.com and domain\username).
Posted in Gravityzone
Tagged AD, bitdefender, edr, EPP, installation, join AD, MDR, remote
Leave a comment
Enable Excel Macro
Macro can be block by
Fileless Attack Defense if it trigger powershell.exe
Fix by
add command in Exclusions such as below command
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-Process EXCEL .......... | Stop-Process -Force"
Then when it execute this command it will not blocked again.
Advance Anti Exploit
Fixed by
Go to Policy > Antimalware > Advance Anti-Exploit
then Find
| Microsoft Office, Microsoft Excel | Excel.exe |
Add to report only for what it trigger in Incidents
then save the policy
Posted in Gravityzone
Tagged bitdefender, edr, enable excel macro, enable macro, EPP, gravityzone, MDR
Leave a comment
Enable Network Print
In Firewall > Rule
Edit rule > Allow
Enable Rule
That it !!!
Posted in Gravityzone
Tagged bitdefender, gravityzone, network, network print, print
Leave a comment
Bitdefender EDR PoC Step
As I got Lots of request on How to PoC EDR
then this is my write up
we will use this Github to test
https://github.com/redcanaryco/invoke-atomicredteam/wiki/Installing-Invoke-AtomicRedTeam
First add exclusion on Gravityzone to C:\AtomicRedTeam
Open Powershell to create folder
mkdir C:\AtomicRedTeam
cd C:\AtomicRedTeam
Install moduleInstall-Module -Name invoke-atomicredteam,powershell-yaml -Scope CurrentUser
ANSWER Y
ANSWER A
Then download all test script
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing);
Install-AtomicRedTeam -getAtomics
Checking script by
Invoke-AtomicTest All -ShowDetailsBrief
then
start test with to test all T1003 InteractivelyInvoke-AtomicTest T1003 -Interactive
but you can see Bitdefender Agent Already block it
Invoke-AtomicTest T1003.001 -Interactive
Install Bindefender Best Agent on Windows 7 Service Pack 1 and Windows 2008r2
Prerequisite For Windows 7 Service Pack 1
- Latest Visual C++ Redistributable for Visual Studio 2015-2022
download here
or https://aka.ms/vs/17/release/vc_redist.x86.exe
/////////////////////////////////////////////////////////////////////////////////////////////////////////////
ONLY IF you are using Windows 7 need to install these patch
KB3033929
KB4490628
KB4474419
KB4536952
KB4534310
/////////////////////////////////////////////////////////////////////////////////////////////////////////////
Prerequisite For Windows server 2008r2
- Visual C++ Redistributable for Visual Studio 2015-2022
or https://aka.ms/vc14/vc_redist.x64.exe
- MicrosoftEasyFix51044
- Microsoft .NET Framework 4 (Standalone Installer)
http://microsoft.com/en-us/download/details.aspx?id=17718
- Security Update for Windows Server 2008 R2 x64 Edition (KB3033929)
https://www.microsoft.com/en-us/download/details.aspx?id=46083
Or If you cannot download with that link you can check at github
https://github.com/darklite404/Bitdefender_Gravityzone/tree/main/Windows2008R2
Posted in Gravityzone
Tagged 2008r2, bitdefender, edr, gravityzone, Prerequisite, windows, windows 2008r2, windows 7, ติดตั้ง
Leave a comment
Connect Bitdefender CSPM+ with Jira and create ticket
1 Setting up an integration with Jira
To set up a Jira integration, follow these steps:
- Log in to Jira with an account that has access to your organization Settings page.
- Click the Settings button on the upper right side of the page and select Products:
The Jira Software configuration page is displayed. - Click the Applications links link from the menu on the left side of the page.
- Click the Create link button:
The Create link window is displayed. - Under Link type, make sure the Direct application link is selected.
- Open a new browser tab and log in to your Cloud Security console.
- Copy the first part of the URL, starting from
httpsand up togravityzone.bitdefender.com:
- Go back to the browser tab with Jira and paste the URL into the Application URL field.
- Click Continue.
- In the Configure Application URL window, the new URL field will be auto filled with the URL you entered in the previous step.
- Click Continue. The Review link window is displayed.
- Fill in the following information:
- Under Application Name, type in a descriptive name, such as
GravityZone Cloud Security. - Under Application Type, select
Generic Application. - Select the Create incoming link checkbox.
- Under Application Name, type in a descriptive name, such as
- Click Continue.
Additional information is displayed under the Review link window. - Fill in the following information:
- Under Consumer Key, type in
OauthKey. - In the Consumer Name field type in a descriptive name, such as
GravityZone Cloud Security. - Copy the below code and paste it under Public Key—–BEGIN PUBLIC KEY—– MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsrt+7VobIBFZE6fK9Ikd hEZBFUSzB3i41j/ MftDJwyC4YlNIvQIyhMR1ViRpxQFQiQFp7P9FlDLsezrDJu+E m7Z+VJFLcnOHoOm4EAcyjlMbUb87YPYp0SbvxxVnhbpQ4EOIr//gMO/ +yjyh6lVc i3uy+B7MFFlF247fhnpQOWthI5dK6C44Y66YSzAEPHHMVDyRYPciuajSdodSr71s h/ 0nuF5jy0jv48qzfZVKw3w258JvXmx8V+ia5MxlYAfDN9vVX0Gb0oFOzfqr/ qDxOfyBYoV3NcURgCj1EA0V/ADsFS+BVWB5fs8Bs1kLREsPjmOlI6A4PRiRFKiGyuLM 1QIDAQAB —–END PUBLIC KEY—–
- Under Consumer Key, type in
- Click Continue:
The Application links page is displayed, along with a new entry, if the creation of the entry has been successful. - Copy the first part of the URL, starting from
httpsand up toatlassian.net:
- Go back to the Cloud Security console browser tab.
- Go to the Integrations page.
- Under the Task Management section, click the Add button for the Jira integration:
The Add Jira integration window is displayed. - Paste the URL you copied in step 16 in the Jira URL field.
- Click Add:
A Welcome to Jira window appears. - Click Allow to finish the integration.
The integration is now complete.
The No connection status is no longer showing under Jira, and today’s date is displayed under the Integration date column.
2 Creating a Jira ticket from a finding
To automatically generate a Jira ticket from a finding, follow the steps below:
Note
To use this feature you require an active Jira integration.
- Open the Check Details panel for the finding you want to export.
- Click the Export
button on the upper right side of the panel and select Export issue:
The Export Finding page is displayed. - Click the Choose a project drop-down menu and select the project where you want to create the request:
- Select the type of issue you want to create.
- Click Export
A new Jira ticket containing all the information present in the finiding is created.
Ref :
Gravityzone Policy Best Practices for Client/Server
For EPP/EDR
https://techzone.bitdefender.com/en/tech-papers/gravityzone-best-practices.html
Agent
General settings within the policy allow you to manage user interface display options, password protection, proxy settings, power user settings, communication options, and update preferences for the selected endpoints.
Set uninstall password: This prevents users with administrative rights from unauthorized uninstalling the BEST agent. This uninstall password, however, won’t stop advanced threat actors, who use more advanced tampering techniques. To configure Anti-Tampering protection, navigate here.
Allow endpoints to send user login data to GravityZone: Enable this option to see the logged-in user on their machines within the Network section.
Update
Navigate to the Agent > Update section to configure the BEST agent and security content update settings.
We recommend configuring the following:
- Product Update: Set a one-hour update interval. For non-persistent VDIs, disable product updates to avoid frequent reinstalls.
- Security Content Update: Set a one-hour update interval to ensure endpoints are always protected with the latest security definitions.
- Update Ring: The update ring should be configured to use the Slow ring for stable, well-tested updates. However, for larger organizations that have a staging or testing environment, the Fast ring can be used to identify any potential issues with new updates before they are deployed broadly across your production endpoints.
Antimalware
The Antimalware module is the foundation of your BEST, providing a multi-layered defense that proactively protects against a wide range of threats, from traditional malware to advanced, fileless attacks and ransomware. This section details the configuration for key settings, including On-Access, On-Execute, On-Demand, Anti-Tampering, HyperDetect, and Advanced Anti-Exploit.
On-Access Scanning
Malware protection prevents new malware threats from entering the system by scanning local and network files when they are accessed (opened, moved, copied, or executed). Navigate to Antimalware > On-Access to configure antimalware protection.
On-Execute Scanning
On-Execute Scanning protects against malicious processes during their execution stage. Navigate to Antimalware > On-Execute to configure this layer of protection.
Advanced Threat Control (ATC)
Sensitivity: Set Normal scan sensitivity for workstations and Aggressive for servers.
On-Demand Scanning
We recommend two types of regular scanning: a weekly full scan and a daily quick scan.
Weekly Full Scan
Daily Quick Scan
Anti-Tampering
Hyper Detect
For client
For Server
Advanced Anti-Exploit
Settings
Exclusions
Recommended vendor and product exclusions – Enable this option to use default exclusions provided by Bitdefender for compatibility with common third-party software.
Sandbox Analyzer
Analysis mode: Blocking: Endpoint Users will have no access to the file until the analysis result is returned to the endpoint from the Sandbox Analyzer.
* The Bitdefender MDR Cybersecurity Breach Warranty requires Content Prefiltering settings to be configured in Aggressive mode.
Firewall
Settings
The firewall’s filtering policy depends on the trust level. To apply different profiles to network segments within your company, we recommend applying network profiles to your company’s managed networks in the Networks table:
- Trusted: Disables the firewall for respective adapters. The traffic is allowed and not filtered.
- Home/Office: Allows all traffic to and from computers in the local network while the other traffic is being filtered.
- Public: All traffic is filtered.
- Untrusted: Completely blocks network and Internet traffic through the respective adapters.
If a network that is not defined is detected, the Bitdefender security agent identifies the network adapter type and applies a corresponding profile to the connection.
Rules
If you are using Network Printing > Please Enabled and Set Permission as Allow (Rules 7)
Network Protection
Additional Processes: Add the following processes for scanning: wscript.exe; cscript.exe; powershell.exe; pwsh.exe
Web Protection
Network Attack Defense
Device Control
if want to block USB Wifi
if want to block External Storage
Set Windows Portable and External Storage as Block
Incidents Sensor
Risk Management
PHASR
Live Search
For MDR
Bitdefender Gravityzone EDR Patch Management
1 You need to install License key by go to
My Company > licensing
https://www.bitdefender.com/business/support/en/77209-295101-licensing—provisioning.html
GravityZone Patch Management is
Add-on and pay per endpoints
2 Config installation package to include Patch Management (if not it you need to manual install by each endpoint)
3 Create new maintenance window
https://www.bitdefender.com/business/support/en/77209-376316-patch-management.html
4 Assigning the maintenance window to a policy.
5 Run Patch Scan
- Log in to GravityZone Control Center.
- Go to the Network page from the left side menu.
- Select the target endpoints.
- Click the Actions button at the upper side of the table and select Patch scan. A confirmation window will appear.
- Click Yes to confirm the scan task.When the task finishes, GravityZone adds in Patch Inventory all patches your software needs. For more details, refer to Patch Inventory.
6 Go to Patch Inventory to manage patch
Manually install or uninstall features
- Log in to GravityZone Control Center.
- Go to the Network > Patch Inventory page from the left side menu.
- Select the patches you want from the list and either install or uninstall them from your managed endpoints.
7 Create Report
- Log in to GravityZone Control Center.
- Go to the Reports page from the left side menu.
- Click the Add button in the upper left side of the page.
- Select Network Patch Status.
- Under the Select target section, select the endpoints you want to run the report on.
- Click Save.
Supported vendors and products
This article provides comprehensive lists of vendors and products that are compatible with Bitdefender Patch Management for Windows, Linux (CentOS, RedHat, and SUSE), and macOS.
The Patch Management module supports a vast set of software products. In GravityZone Control Center you can view only the software products installed in your network, for which GravityZone provides patches.
The lists of supported vendors and products are available in CSV format, grouped by operating system:
Ref Link :
1: https://www.bitdefender.com/business/support/en/77209-376316-patch-management.html