Bitdefender API

This connector integrates with Bitdefender Control Center. The API uses the JSON-RPC protocol.

Asset Configuration

The Bitdefender connector requires an API Key to be passed in the username field.

JSONRPC

The APIs are exposed using JSON-RPC 2.0 protocol specified here:

http://www.jsonrpc.org/specification

Here is an example of API call updating the company name inside Control Center:

{
    "id": "91d6430d-bfd4-494f-8d4d-4947406d21a7",
    "jsonrpc": "2.0",
    "method": "updateCompanyDetails",
    "params": {
        "name": "My Company Name"
    }
}

For this call, the following response is sent back to the application:

{
    "id":"91d6430d-bfd4-494f-8d4d-4947406d21a7",
    "jsonrpc":"2.0",
    "result": null
}

Each API call targets a method and passes a set of parameters.

There are two types of parameters:

required - MUST be always passed to the called method.

optional - has a default value and can be omitted from the parameters list. Any optional parameter can be skipped, regardless its position in the parameters list.

API Docs

https://www.bitdefender.com/business/support/en/77209-125280-getting-started.html

Configurations

HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host. This is the Control Center API Access URL.	string	Required
username	Username. In some cases, the username might be the API Key.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Add File to Quarantine

This action creates a new task to add a file to quarantine

Endpoint

URL: api/v1.0/jsonrpc/quarantine

Method: POST

Input

Argument Name	Type	Required	Description
params	object	Optional	Parameter for Add File to Quarantine
params.endpointIds	array	Required	Unique identifier
params.filePath	string	Required	Parameter for Add File to Quarantine
jsonrpc	string	Optional	Parameter for Add File to Quarantine
method	string	Optional	HTTP method to use
id	string	Optional	Unique identifier

Input Example

{"json_body":{"params":{"endpointIds":["63896b87b7894d0f367b23c6","65896b87b7894d0f367b23c6"],"filePath":"Z:\\path\\to\\file"},"jsonrpc":"2.0","method":"createAddFileToQuarantineTask","id":"5399c9b5-0b46-45e4-81aa-889952433d86"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
jsonrpc	string	Output field: jsonrpc
result	boolean	Result of the operation

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"5399c9b5-0b46-45e4-81aa-889952433d86","jsonrpc":"2.0","result":true}}

Create Empty Quarantine

This action creates a new task to empty the quarantine.

Endpoint

URL: api/v1.0/jsonrpc/quarantine/{{type}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.type	string	Optional	Parameters for the Create Empty Quarantine action
params	object	Optional	Parameter for Create Empty Quarantine
jsonrpc	string	Optional	Parameter for Create Empty Quarantine
method	string	Optional	HTTP method to use
id	string	Optional	Unique identifier

Input Example

{"json_body":{"params":{},"jsonrpc":"2.0","method":"createEmptyQuarantineTask","id":"5399c9b5-0b46-45e4-81aa-889952433d86"},"path_parameters":{"type":"computers"}}

Output

Parameter	Type	Description
id	string	Unique identifier
jsonrpc	string	Output field: jsonrpc
result	boolean	Result of the operation

Output Example

{"id":"5399c9b5-0b46-45e4-81aa-889952433d86","jsonrpc":"2.0","result":true}

Create Restore Endpoint From Isolation Task

This action creates a task to restore the specified endpoint from isolation

Endpoint

URL: api/v1.0/jsonrpc/incidents

Method: POST

Input

Argument Name	Type	Required	Description
id	string	Optional	Unique identifier
jsonrpc	string	Optional	Parameter for Create Restore Endpoint From Isolation Task
method	string	Optional	HTTP method to use
params	object	Optional	Parameter for Create Restore Endpoint From Isolation Task
params.endpointId	string	Required	Unique identifier

Input Example

{"json_body":{"id":"0df7568c-59c1-48e0-a31b-18d83e6d9810","jsonrpc":"2.0","method":"createRestoreEndpointFromIsolationTask","params":{"endpointId":"5b680f6fb1a43d860a7b23c1"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
jsonrpc	string	Output field: jsonrpc
result	boolean	Result of the operation

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"0df7568c-59c1-48e0-a31b-18d83e6d9810","jsonrpc":"2.0","result":true}}

Create Rule

Method to create a custom rule.

Endpoint

URL: api/v1.0/jsonrpc/incidents

Method: POST

Input

Argument Name	Type	Required	Description
params	object	Optional	Parameter for Create Rule
params.companyId	string	Optional	Unique identifier
params.type	number	Optional	Type of the resource
params.name	string	Required	Name of the resource
params.description	string	Optional	Parameter for Create Rule
params.tags	array	Optional	Parameter for Create Rule
params.settings	object	Required	Parameter for Create Rule
params.settings.status	number	Optional	Status value
params.settings.severity	number	Optional	Parameter for Create Rule
params.settings.target	string	Optional	Parameter for Create Rule
params.settings.criteriaList	array	Optional	Parameter for Create Rule
params.settings.criteriaList.field	string	Optional	Parameter for Create Rule
params.settings.criteriaList.relation	string	Optional	Parameter for Create Rule
params.settings.criteriaList.value	array	Optional	Value for the parameter
params.returnRuleId	boolean	Optional	Unique identifier
jsonrpc	string	Optional	Parameter for Create Rule
method	string	Optional	HTTP method to use
id	string	Optional	Unique identifier

Input Example

{"json_body":{"params":{"companyId":"61827b8036492c2fc0718722","type":1,"name":"Detection Rule via API","description":"description test api","tags":["test","api","demo"],"settings":{"status":0,"severity":1,"target":"connection","criteriaList":[{"field":"Connection.DestinationPort","relation":"is","value":["25691"]},{"field":"Connection.Process.Name","relation":"contains","value":"./network1"},{"field":"Connection.SourcePort","relation":"any","value":["22","23","24"]}]},"returnRuleId":true},"jsonrpc":"2.0","method":"createCustomRule","id":"0df7568c-59c1-48e0-a31b-18d83e6d9810"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
jsonrpc	string	Output field: jsonrpc
result	string	Result of the operation

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"0df7568c-59c1-48e0-a31b-18d83e6d9810","jsonrpc":"2.0","result":"6372b7a3897aaa77ee021642"}}

Delete Rule

Method to delete a custom rule.

Endpoint

URL: api/v1.0/jsonrpc/incidents

Method: POST

Input

Argument Name	Type	Required	Description
params	object	Optional	Parameter for Delete Rule
params.ruleId	string	Required	Unique identifier
params.type	number	Required	Type of the resource
jsonrpc	string	Optional	Parameter for Delete Rule
method	string	Optional	HTTP method to use
id	string	Optional	Unique identifier

Input Example

{"json_body":{"params":{"ruleId":"6182a7e26f59d3072a1e8fc5","type":1},"jsonrpc":"2.0","method":"deleteCustomRule","id":"0df7568c-59c1-48e0-a31b-18d83e6d9810"}}

Output

Parameter	Type	Description
id	string	Unique identifier
jsonrpc	string	Output field: jsonrpc
result	boolean	Result of the operation

Output Example

{"id":"0df7568c-59c1-48e0-a31b-18d83e6d9810","jsonrpc":"2.0","result":true}

Get Block List Items

This action lists all the hashes that are present in the blocklist

Endpoint

URL: api/v1.0/jsonrpc/incidents

Method: POST

Input

Argument Name	Type	Required	Description
params	object	Optional	Parameter for Get Block List Items
params.page	number	Optional	Parameter for Get Block List Items
params.perPage	number	Optional	Parameter for Get Block List Items
jsonrpc	string	Optional	Parameter for Get Block List Items
method	string	Optional	HTTP method to use
id	string	Optional	Unique identifier

Input Example

{"json_body":{"params":{"page":1,"perPage":30},"jsonrpc":"2.0","method":"getBlocklistItems","id":"0df7568c-59c1-48e0-a31b-18d83e6d9810"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
jsonrpc	string	Output field: jsonrpc
result	object	Result of the operation
result.items	array	Result of the operation
result.items.companyId	string	Unique identifier
result.items.hash	string	Result of the operation
result.items.hashType	number	Type of the resource
result.items.id	string	Unique identifier
result.items.source	number	Result of the operation
result.items.sourceInfo	string	Result of the operation
result.items.filename	string	Name of the resource
result.page	number	Result of the operation
result.pagesCount	number	Result of the operation
result.perPage	number	Result of the operation
result.total	number	Result of the operation

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"0df7568c-59c1-48e0-a31b-18d83e6d9810","jsonrpc":"2.0","result":{"items":[],"page":1,"pagesCount":1,"perPage":30,"total":2}}}

Get Quarantine Items

This action retrieves the list of quarantined items available for a company.

Endpoint

URL: api/v1.0/jsonrpc/quarantine/{{type}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.type	string	Required	Parameters for the Get Quarantine Items action
params	object	Optional	Parameter for Get Quarantine Items
params.endpointId	string	Optional	Unique identifier
params.page	number	Optional	Parameter for Get Quarantine Items
params.perPage	number	Optional	Parameter for Get Quarantine Items
params.filters	object	Optional	Parameter for Get Quarantine Items
params.filters.threatName	string	Optional	Name of the resource
params.filters.actionStatus	number	Optional	Status value
params.filters.startDate	string	Optional	Date value
params.filters.endDate	string	Optional	Date value
params.filters.filePath	string	Optional	Parameter for Get Quarantine Items
jsonrpc	string	Optional	Parameter for Get Quarantine Items
method	string	Optional	HTTP method to use
id	string	Optional	Unique identifier

Input Example

{"json_body":{"params":{"endpointId":"5d36c255f23f730fa91944e2","page":2,"perPage":1,"filters":{"threatName":"Virus 0","actionStatus":1,"startDate":"2019-07-28T11:31:28","endDate":"2019-08-16T11:31:16","filePath":"c:\\Virus0\\virus0.exe"}},"jsonrpc":"2.0","method":"getQuarantineItemsList","id":"5399c9b5-0b46-45e4-81aa-889952433d86"},"path_parameters":{"type":"computers"}}

Output

Parameter	Type	Description
id	string	Unique identifier
jsonrpc	string	Output field: jsonrpc
result	object	Result of the operation
result.total	number	Result of the operation
result.page	number	Result of the operation
result.perPage	number	Result of the operation
result.pagesCount	number	Result of the operation
result.items	array	Result of the operation
result.items.id	string	Unique identifier
result.items.quarantinedOn	string	Result of the operation
result.items.actionStatus	number	Status value
result.items.companyId	string	Unique identifier
result.items.endpointId	string	Unique identifier
result.items.endpointName	string	Name of the resource
result.items.endpointIP	string	Result of the operation
result.items.canBeRestored	boolean	Result of the operation
result.items.canBeRemoved	boolean	Result of the operation
result.items.threatName	string	Name of the resource
result.items.details	object	Result of the operation
result.items.details.filePath	string	Result of the operation

Output Example

{"id":"5399c9b5-0b46-45e4-81aa-889952433d86","jsonrpc":"2.0","result":{"total":2,"page":2,"perPage":1,"pagesCount":2,"items":[{}]}}

Get Rules

Get Custom Rules

Endpoint

URL: api/v1.0/jsonrpc/incidents

Method: POST

Input

Argument Name	Type	Required	Description
params	object	Optional	Parameter for Get Rules
params.companyId	string	Required	Unique identifier
params.type	number	Required	Type of the resource
params.page	number	Required	Parameter for Get Rules
params.perPage	number	Required	Parameter for Get Rules
jsonrpc	string	Optional	Parameter for Get Rules
method	string	Optional	HTTP method to use
id	string	Optional	Unique identifier

Input Example

{"json_body":{"params":{"companyId":"61827b8036492c2fc0718722","type":1,"page":1,"perPage":100},"jsonrpc":"2.0","method":"getCustomRulesList","id":"0df7568c-59c1-48e0-a31b-18d83e6d9810"}}

Output

Parameter	Type	Description
id	string	Unique identifier
jsonrpc	string	Output field: jsonrpc
result	object	Result of the operation
result.total	number	Result of the operation
result.page	number	Result of the operation
result.perPage	number	Result of the operation
result.pagesCount	number	Result of the operation
result.items	array	Result of the operation
result.items.id	string	Unique identifier
result.items.name	string	Name of the resource
result.items.ownerId	string	Unique identifier
result.items.description	string	Result of the operation
result.items.companyId	string	Unique identifier
result.items.status	number	Status value
result.items.tags	array	Result of the operation
result.items.settings	object	Result of the operation
result.items.settings.status	number	Status value
result.items.settings.target	string	Result of the operation
result.items.settings.criteriaList	array	Result of the operation
result.items.settings.criteriaList.field	string	Result of the operation
result.items.settings.criteriaList.relation	string	Result of the operation
result.items.settings.criteriaList.value	array	Value for the parameter
result.items.settings.criteriaList.operator	string	Result of the operation
result.items.settings.severity	number	Result of the operation

Output Example

{"id":"0df7568c-59c1-48e0-a31b-18d83e6d9810","jsonrpc":"2.0","result":{"total":1,"page":1,"perPage":100,"pagesCount":1,"items":[{}]}}

Isolate Host

This action creates a task to isolate the specified endpoint.

Endpoint

URL: api/v1.0/jsonrpc/incidents

Method: POST

Input

Argument Name	Type	Required	Description
id	string	Optional	Unique identifier
jsonrpc	string	Optional	Parameter for Isolate Host
method	string	Optional	HTTP method to use
params	object	Optional	Parameter for Isolate Host
params.endpointId	string	Required	Unique identifier

Input Example

{"json_body":{"id":"0df7568c-59c1-48e0-a31b-18d83e6d9810","jsonrpc":"2.0","method":"createIsolateEndpointTask","params":{"endpointId":"5b680f6fb1a43d860a7b23c1"}}}

Output

Parameter	Type	Description
id	string	Unique identifier
jsonrpc	string	Output field: jsonrpc
result	boolean	Result of the operation

Output Example

{"id":"0df7568c-59c1-48e0-a31b-18d83e6d9810","jsonrpc":"2.0","result":true}

Quarantine File

This action creates a new task to add a file to quarantine.

Endpoint

URL: api/v1.0/jsonrpc/quarantine

Method: POST

Input

Argument Name	Type	Required	Description
params	object	Optional	Parameter for Quarantine File
params.endpointIds	array	Required	Unique identifier
params.filePath	string	Required	Parameter for Quarantine File
jsonrpc	string	Optional	Parameter for Quarantine File
method	string	Optional	HTTP method to use
id	string	Optional	Unique identifier

Input Example

Output

Parameter	Type	Description
id	string	Unique identifier
jsonrpc	string	Output field: jsonrpc
result	boolean	Result of the operation

Output Example

{"id":"5399c9b5-0b46-45e4-81aa-889952433d86","jsonrpc":"2.0","result":true}

Remove From Block List

This action removes an item from the Blocklist, identified by its ID

Endpoint

URL: api/v1.0/jsonrpc/incidents

Method: POST

Input

Argument Name	Type	Required	Description
params	object	Optional	Parameter for Remove From Block List
params.hashItemId	string	Required	Unique identifier
jsonrpc	string	Optional	Parameter for Remove From Block List
method	string	Optional	HTTP method to use
id	string	Optional	Unique identifier

Input Example

{"json_body":{"params":{"hashItemId":"hashItemId"},"jsonrpc":"2.0","method":"removeFromBlocklist","id":"0df7568c-59c1-48e0-a31b-18d83e6d9810"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
jsonrpc	string	Output field: jsonrpc
result	boolean	Result of the operation

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"0df7568c-59c1-48e0-a31b-18d83e6d9810","jsonrpc":"2.0","result":true}}

Remove Quarentine Items

This action creates a new task to remove items from quarantine.

Endpoint

URL: api/v1.0/jsonrpc/quarantine/{{type}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.type	string	Optional	Parameters for the Remove Quarentine Items action
params	object	Optional	Parameter for Remove Quarentine Items
params.quarantineItemsIds	array	Optional	Unique identifier
jsonrpc	string	Optional	Parameter for Remove Quarentine Items
method	string	Optional	HTTP method to use
id	string	Optional	Unique identifier

Input Example

{"json_body":{"params":{"quarantineItemsIds":["63896b87b7894d0f367b23c6","65896b87b7894d0f367b23c6"]},"jsonrpc":"2.0","method":"createRemoveQuarantineItemTask","id":"5399c9b5-0b46-45e4-81aa-889952433d86"},"path_parameters":{"type":"computers"}}

Output

Parameter	Type	Description
id	string	Unique identifier
jsonrpc	string	Output field: jsonrpc
result	boolean	Result of the operation

Output Example

{"id":"5399c9b5-0b46-45e4-81aa-889952433d86","jsonrpc":"2.0","result":true}

Restore Quarantine Exchage Item

This action creates a new task to restore items from the quarantine for Exchange Servers

Endpoint

URL: api/v1.0/jsonrpc/quarantine/exchange

Method: POST

Input

Argument Name	Type	Required	Description
params	object	Optional	Parameter for Restore Quarantine Exchage Item
params.quarantineItemsIds	array	Required	Unique identifier
params.username	string	Required	Name of the resource
params.password	string	Required	Parameter for Restore Quarantine Exchage Item
jsonrpc	string	Optional	Parameter for Restore Quarantine Exchage Item
method	string	Optional	HTTP method to use
id	string	Optional	Unique identifier

Input Example

{"json_body":{"params":{"quarantineItemsIds":["63896b87b7894d0f367b23c6","65896b87b7894d0f367b23c6"],"username":"user@domain","password":"userPassword"},"jsonrpc":"2.0","method":"createRestoreQuarantineExchangeItemTask","id":"5399c9b5-0b46-45e4-81aa-889952433d86"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
jsonrpc	string	Output field: jsonrpc
result	boolean	Result of the operation

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"5399c9b5-0b46-45e4-81aa-889952433d86","jsonrpc":"2.0","result":true}}

Restore Quarantine Item

This action creates a new task to restore items from the quarantine

Endpoint

URL: api/v1.0/jsonrpc/quarantine/computers

Method: POST

Input

Argument Name	Type	Required	Description
params	object	Optional	Parameter for Restore Quarantine Item
params.quarantineItemsIds	array	Optional	Unique identifier
params.locationToRestore	string	Optional	Parameter for Restore Quarantine Item
params.addExclusionInPolicy	boolean	Optional	Parameter for Restore Quarantine Item
jsonrpc	string	Optional	Parameter for Restore Quarantine Item
method	string	Optional	HTTP method to use
id	string	Optional	Unique identifier

Input Example

{"json_body":{"params":{"quarantineItemsIds":["63896b87b7894d0f367b23c6","65896b87b7894d0f367b23c6"],"locationToRestore":"C:\\RestoreDirectory","addExclusionInPolicy":true},"jsonrpc":"2.0","method":"createRestoreQuarantineItemTask","id":"5399c9b5-0b46-45e4-81aa-889952433d86"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
id	string	Unique identifier
jsonrpc	string	Output field: jsonrpc
result	boolean	Result of the operation

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"id":"5399c9b5-0b46-45e4-81aa-889952433d86","jsonrpc":"2.0","result":true}}

Update Block List

Use this method to add one or more file hashes to the Blocklist.

Endpoint

URL: api/v1.0/jsonrpc/incidents

Method: POST

Input

Argument Name	Type	Required	Description
id	string	Optional	Unique identifier
jsonrpc	string	Optional	Parameter for Update Block List
method	string	Optional	HTTP method to use
params	object	Optional	Parameter for Update Block List
params.hashType	number	Required	Type of the resource
params.hashList	array	Required	Parameter for Update Block List
params.sourceInfo	string	Required	Parameter for Update Block List

Input Example

{"json_body":{"id":"0df7568c-59c1-48e0-a31b-18d83e6d9810","jsonrpc":"2.0","method":"addToBlocklist","params":{"hashType":2,"hashList":["5b7ac19bb1a43dfb107b23c6","f696282aa4cd4f614aa995190cf442fe"],"sourceInfo":"Added from public API"}}}

Output

Parameter	Type	Description
id	string	Unique identifier
jsonrpc	string	Output field: jsonrpc
result	boolean	Result of the operation

Output Example

{"id":"0df7568c-59c1-48e0-a31b-18d83e6d9810","jsonrpc":"2.0","result":true}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT