165 lines
6.6 KiB
Markdown
165 lines
6.6 KiB
Markdown
---
|
|
name: bitdefender
|
|
description: >-
|
|
Manage the ACG Bitdefender GravityZone Cloud MSP tenant (Public JSON-RPC API):
|
|
inventory/audit endpoints, live security sweeps (infected / outdated-signature /
|
|
outdated-product), client companies, install packages, custom groups, scans,
|
|
move/delete endpoints (gated), policies (read-only), quarantine. Live production
|
|
partner tenant — treat destructive actions conservatively. Triggers: bitdefender,
|
|
gravityzone, install bitdefender on, list endpoints, infected machines, av coverage,
|
|
security sweep, endpoint protection, quarantine.
|
|
---
|
|
|
|
# Bitdefender GravityZone Skill
|
|
|
|
Standalone CLI client for the GravityZone Cloud Public API (JSON-RPC). Talks to
|
|
the live ACG partner tenant. Read-only by default; destructive operations are
|
|
gated behind `--confirm`.
|
|
|
|
## Running the CLI
|
|
|
|
This machine's Python launcher is `py` (per identity.json). The scripts also
|
|
work with `python`/`python3`.
|
|
|
|
```bash
|
|
# from the scripts dir, or pass full paths
|
|
bash "$CLAUDETOOLS_ROOT/.claude/scripts/py.sh" "C:/claudetools/.claude/skills/bitdefender/scripts/gz.py" status
|
|
bash "$CLAUDETOOLS_ROOT/.claude/scripts/py.sh" "C:/claudetools/.claude/skills/bitdefender/scripts/gz.py" companies
|
|
bash "$CLAUDETOOLS_ROOT/.claude/scripts/py.sh" "C:/claudetools/.claude/skills/bitdefender/scripts/gz.py" sweep --company <id> --json
|
|
```
|
|
|
|
Transport auto-selects: uses `httpx` if installed, otherwise stdlib `urllib`
|
|
(no third-party dependency required).
|
|
|
|
## Credentials
|
|
|
|
The API key is NEVER hardcoded. At runtime the client loads it from the SOPS
|
|
vault:
|
|
|
|
```
|
|
bash "$CLAUDETOOLS_ROOT/.claude/scripts/vault.sh" \
|
|
get-field msp-tools/gravityzone.sops.yaml credentials.api_key
|
|
```
|
|
|
|
`CLAUDETOOLS_ROOT` resolves from the env var, else `claudetools_root` in
|
|
`C:/claudetools/.claude/identity.json`, else `C:/claudetools`. For testing you
|
|
can override with `GRAVITYZONE_API_KEY`. Auth is HTTP Basic (key as username,
|
|
empty password).
|
|
|
|
## Cache model (important)
|
|
|
|
The CLI keeps a local cache at
|
|
`.claude/skills/bitdefender/.cache/inventory.json` (gitignored — no secrets, no
|
|
PII).
|
|
|
|
- **Cached (identity / structure tier):** company id<->name map, endpoint
|
|
id<->name/company/fqdn map, policy id<->name map, package list, and custom
|
|
groups created via this tool. TTL = 86400s (24h).
|
|
- **NEVER cached (volatile):** infected status, last-seen, online/offline,
|
|
signature/product freshness. Those are ALWAYS pulled live — `sweep` and
|
|
`endpoint` always hit the API.
|
|
- **Refresh:** `inventory --refresh` forces a full re-pull. `get_inventory()`
|
|
auto-refreshes when the cache is stale.
|
|
- **Write-through:** a successful `create-package` or `make-group` updates the
|
|
cache with the new id immediately, so you don't need a full refresh to
|
|
reference it.
|
|
|
|
## Policy API limitation
|
|
|
|
The Public API exposes policies only shallowly. You CAN list policies, read
|
|
their id/name, audit which endpoints carry which policy (via endpoint detail),
|
|
and — via the UNVERIFIED `assignPolicy` — assign an existing policy. You CANNOT
|
|
read the granular module configuration of a policy, and there is NO create /
|
|
edit / clone policy method in the Public API. For policy authoring, use the
|
|
GravityZone console.
|
|
|
|
## Safety gating
|
|
|
|
Destructive subcommands refuse to run without `--confirm`; without it they print
|
|
what they would do and exit non-zero:
|
|
|
|
- `delete-endpoint <id> --confirm`
|
|
- `delete-package --package <name> --confirm`
|
|
- `delete-group --group <id> --confirm`
|
|
- `isolate --endpoints <id> ... --confirm` (cuts the endpoint off the network; reversible via `unisolate`)
|
|
- `unisolate --endpoints <id> ... --confirm`
|
|
- `blocklist-add --company <id> --hashes <h> ... --confirm`
|
|
- `blocklist-remove --id <hashItemId> --confirm`
|
|
|
|
Never run destructive calls casually against this tenant. UNVERIFIED methods
|
|
(assignPolicy, uninstall/reconfigure tasks, quarantine remove/restore, set
|
|
label) are intentionally NOT exposed as dedicated subcommands — reach them only
|
|
through `raw` after confirming the correct params against
|
|
`references/api-reference.md` and the official Bitdefender docs.
|
|
|
|
`raw` itself refuses destructive method names (delete/uninstall/remove/
|
|
reconfigure, plus the EDR verbs isolat*/addToBlocklist/removeFromBlocklist)
|
|
unless `--confirm` is passed. Note that `raw` prints the upstream
|
|
response verbatim — it can carry data from the called method, so do not paste
|
|
raw output into tickets/logs without review.
|
|
|
|
## Common commands
|
|
|
|
```bash
|
|
GZ="bash "$CLAUDETOOLS_ROOT/.claude/scripts/py.sh" C:/claudetools/.claude/skills/bitdefender/scripts/gz.py"
|
|
|
|
# Status / inventory
|
|
$GZ status
|
|
$GZ companies
|
|
$GZ inventory --refresh
|
|
$GZ endpoints --company <companyId>
|
|
$GZ endpoint <endpointId>
|
|
|
|
# Live security posture
|
|
$GZ sweep --company <companyId> # readable table
|
|
$GZ sweep --company <companyId> --json # machine output
|
|
|
|
# Policies (read-only, shallow)
|
|
$GZ policies
|
|
$GZ policy <policyId>
|
|
|
|
# Quarantine
|
|
$GZ quarantine --company <companyId>
|
|
|
|
# Deployment
|
|
$GZ packages
|
|
$GZ create-package --name "Win Default" --company <companyId>
|
|
$GZ install-links --package "Win Default" --company <companyId>
|
|
|
|
# Org structure
|
|
$GZ make-group --name "New Site" --parent <parentId>
|
|
$GZ move --endpoints <id1> <id2> --group <groupId>
|
|
|
|
# Scans
|
|
$GZ scan --targets <id1> <id2> --type 2 --name "Full scan"
|
|
|
|
# EDR / incident response
|
|
$GZ blocklist # list blocklisted hashes (whole tenant)
|
|
$GZ blocklist --company <companyId> # scope to one company
|
|
$GZ incidents --company <companyId> # list incidents (parentId required; method UNVERIFIED on this tenant - may return "Method not found")
|
|
$GZ isolate --endpoints <id1> <id2> --confirm # cut endpoint(s) off the network (reversible via unisolate)
|
|
$GZ unisolate --endpoints <id1> <id2> --confirm # restore endpoint(s) from isolation
|
|
$GZ blocklist-add --company <companyId> --hashes <h1> <h2> --hash-type 1 --source-info "..." --confirm
|
|
$GZ blocklist-remove --id <hashItemId> --confirm # id comes from `blocklist` output
|
|
|
|
# Power use — call any method directly
|
|
$GZ raw --module network --method getEndpointsList --params '{"page":1,"perPage":50}'
|
|
|
|
# Destructive (gated)
|
|
$GZ delete-endpoint <id> --confirm
|
|
```
|
|
|
|
## Phase-2 hooks (not yet implemented)
|
|
|
|
- **GuruRMM push-deploy:** use `install-links` to fetch the platform installer
|
|
URL, then push the installer to a target via the GuruRMM agent fleet (`/rmm`)
|
|
for one-step Bitdefender rollout from RMM.
|
|
- **Push webhook:** subscribe to GravityZone Push events (new malware /
|
|
endpoint state changes) and surface them through the coord API / RMM alerts
|
|
instead of polling `sweep`.
|
|
|
|
## Reference
|
|
|
|
Full verified vs unverified method spec, JSON-RPC envelope, auth, and the
|
|
policy/deployment caveats: `references/api-reference.md`.
|