Sensors – Bitdefender TechZone

Sensors are grouped by attack surface. Each sensor links to its dedicated article, which covers detection, deployment and configuration, along with hands-on scenarios and common mistakes and misconceptions.

Fig. 1. GravityZone sensors grouped by the attack surface they cover

Endpoint Sensors: Collect operating system events from the endpoints including process creation, file manipulation, registry changes, and network connections, together with detections from BEST components such as Network Attack Defense and Fileless Protection.

Network Sensors: Analyze a copy of network traffic received through a SPAN port, from each device on the network including unmanaged ones, and detect port scanning, brute-force logins, exploits used for lateral movement, and command-and-control channels.

Productivity Applications Sensors: Connect directly to Microsoft 365 and Google Workspace, with no appliance or agent, and process account, administrative, email, and file activity from Exchange Online, SharePoint, OneDrive, Gmail, and Drive, detecting phishing emails, malicious file uploads, suspicious sign-ins, and mail forwarding used for exfiltration.

Business Applications Sensors: Retrieve audit events from Atlassian Admin, Jira Cloud, and Confluence Cloud through a direct connection, detecting credential attacks, API token creation, permission changes in Jira, and public exposure of Confluence pages.

Identity Sensors: Collect authentication and directory activity: Kerberos, NTLM, and LDAP events from domain controllers, sign-ins and configuration changes from Microsoft Entra ID, and device, policy, and app changes from Microsoft Intune.

Cloud Sensors: Read each platform's own audit stream with no appliance or agent, detecting reconnaissance, compromised keys, privilege changes, data exports, and audit log deletion.

Mobile Sensors: Process the device events that GravityZone Security for Mobile collects on Android and iOS devices, detecting malicious apps, rooted or tampered devices, network scans and man-in-the-middle conditions.

Cloud Security Posture: When an incident involves cloud resources, CSPM+ queries GravityZone Cloud Security and adds the matching misconfiguration findings to the incident's Associated Risks widget.

Individual sensor events are like single puzzle pieces: a failed login or a script running on a computer is easy to miss among thousands of routine events. The Correlation Engine links related events and puts them in order, so what looked like unrelated events becomes one clear timeline of the attack.

The Correlation Engine for EDR connects events from endpoints only (see the Incidents Sensor article). The Correlation Engine for XDR connects events from every sensor, so it can follow an attack from the first compromised account or device to each system the attacker reached.

Fig. 2. Sensors send raw events from each attack surface to the Correlation Engine for XDR, which assembles related events into one incident

Anomaly Detection gives each machine its own machine learning model, so it knows what is normal for that specific computer. Unusual behavior is checked against known attack techniques from MITRE, custom rules from Bitdefender Labs, and the user's own activity. For example, if PowerShell, a trusted Windows tool often abused in living-off-the-land attacks, normally runs once a month but suddenly runs several times in one day, the model flags it as unusual and sends it to the Correlation Engine.

Incident Advisor shows the whole attack in one place, with events from every sensor involved, and recommends the steps to stop it and clean up. You can see every machine and account the attacker reached, so the response covers all of them.

Fig. 3. Bitdefender GravityZone Incident Advisor allows security teams to check all the key details about the particular incident.

Hands-on Scenarios

Imagine an attack that begins with a single email. An employee opens a phishing message and runs the attached file. The attacker's code opens a command and control (C2) connection from inside the network back to the attacker's server. Next, the attacker tries to guess passwords on a file server and starts logging in to other machines with administrator rights to steal data and deploy ransomware.

Fig. 4. XDR Demo incident graph.

Each attacker step leaves a trace in a different place, and the sensor watching that place records it. To see this attack with all its detections, open the Demo Incident (available with XDR subscriptions) in your GravityZone console: go to Incidents > All Incidents and click the demo icon in the top-right corner. The GravityZone Demo Incident article walks you through each step of the recorded incident.

To learn more about the technologies included in the Detection layer we recommend reading the next article Incidents Sensor.

Bitdefender GravityZone XDR official website: GravityZone XDR

Discover the XDR Sensors full potential with our dedicated video masterclasses: Masterclass