BitDefender
ArchivedRelease Details
Package Details
- Normalization Package
- LP_BitDefender
- Compiled Normalizer
- BitDefenderCompiledNormalizer
Enhancement
Installation
To install BitDefender :
- Download the .pak file from the Download link above.
- Go to Settings >> System Settings from the navigation bar and click Applications .
- Click Import .
- Browse to the downloaded .pak file.
- Click Upload .
Past Releases
BitDefender v5.0.1 ▾
Enhancement
BitDefender v3.3.0 ▾
Enhancement
Log Format
Expected Log Format
Semi-colon separated
Log Samples
<14>Jun 9 08:38:46 CPHBITxxxxx gravityzone: [modules] {"computer_name":"XXXXXXXXXXXXX", "computer_ip":"1.1.1.1", "computer_id":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXX", "product_installed":"EPS", "malware_status":1, "avc_status":0, "ids_status":0, "module":"modules"}
gravityzone: [av] {"computer_name":"server", "computer_fqdn":"server.abc.com", "computer_ip":"1.1.1.0", "computer_id":"xyzfsjf", "product_installed":"BEST", "user":{"id":"x-x-x-5", "name":"xyz@abc.com"}, "malware_type":"file", "malware_name":"Trojan", "file_path":"C:\\Downloads.lnk", "final_status":"deleted", "timestamp":"2017-04-11T03:31:42.000Z", "module":"av"}
<14>Mar 1 09:19:14 bitdef02 gravityzone: [av] {"computer_name":"SERVER01", "computer_fqdn":"SERVER01.DOMAIN.DK", "computer_ip":"10.10.20.20", "computer_id":"57xxxxxxxxxxxxxxxxxxxxxxxxxxxx", "product_installed":"BEST", "user": {"id":"S-1-5-21-456xxxxxx-456xxxxxxx-7567xxxxxxx-12xxxxxx", "name":"USER@DOMAIN.DK"}, "malware_type":"file", "malware_name":"Trojan.xxx.xxxx", "file_path":"D:Downloads.lnk", "final_status":"deleted", "timestamp":"2017-03-01T09:19:12.000Z", "module":"av"}
<14>Jun 8 12:04:09 CPHBITDEF01 gravityzone: [av] {"computer_name":"XXXXXXXXXXXXXX", "computer_ip":"1.1.1.1", "computer_id":"xxxxxxxxxxxxxxxxxxxx", "product_installed":"EPS", "malware_type":"file", "malware_name":"Gen:xxxxx.xxx.1014xxxx", "file_path":"E:\\OKxxxx Oxxxxxxx Mugaxxxx.exe", "final_status":"blocked", "timestamp":"2015-06-08T12:04:03.000Z", "module":"av"}
<14>Nov 4 14:43:02 i01234 logpoint: message repeated 5 times: [lp] {"module":"lp", "product_installed":"BEST", "user": {"id":null,"name":null}, "VM_NAME":"logpoint", "VM_ID":"vm-4575", "UUID_INSTANCE":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX", "UUID_BIOS":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXXX", "computer_name":"logpoint", "computer_fqdn":"logpoint.com", "computer_ip":"XXX.XXX.XXX.XX", "computer_id":"XXXXXXXXXXXXXXXXXXX", "malware_type":"file", "malware_name":"Test-File (not a virus)", "hash":"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f", "final_status":"deleted", "file_path":"D:\Cisco.txt", "timestamp":"2019-11-04T14:42:48.000Z"}]
To export data to Logpoint, use Syslog collector on port 514 on the Logpoint server.
Support
If you have any questions or require assistance, create a support ticket.
Comments
Article is closed for comments.