Bitdefender Protection

Use the local Bitdefender Endpoint Security to verify that the agent and real-time protection run, how old the signatures are and whether files were quarantined.

The Bitdefender Protection check runs on the device and reads the local state of Bitdefender Endpoint Security: whether the Bitdefender agent is running, whether real-time protection is active, how old the signatures are, and how many files were quarantined recently. It runs on Windows and macOS (each as an x64 and an Arm64 build) every 5 minutes by default. The check does not need a connection to GravityZone.

If the Bitdefender integration is set up as well, octoja adds the quarantine list and the EDR incidents that GravityZone reports for this device to the result. This cloud data is only displayed; the check's status is determined by the locally read values alone.

Prerequisites

Bitdefender Endpoint Security is installed on the device.
For the quarantine list and EDR incidents from GravityZone: a connected Bitdefender integration in which the device's customer is matched to the GravityZone company the device belongs to. See Set up the Bitdefender integration for the setup.

Steps

Open the device under Devices and switch to the Checks tab.
Click Add Check → Bitdefender Protection.
Adjust the settings if needed.
Click Add Check.

To roll the check out to many devices at once, add it to a config package — see Assign checks with config packages.

Settings

Field	Type	Required	Default	Description
Signature age — warning (hours)	Integer	Yes	48	Warning when the signature database is at least this many hours old. 0 disables this level
Signature age — critical (hours)	Integer	Yes	168	Critical when the signature database is at least this many hours old. 0 disables this level
Real-time protection off	Selection	Yes	Critical	Status when real-time protection is disabled: Ignore, Warning or Critical
Quarantine — recency window (hours)	Integer	Yes	24	Only quarantine files newer than this many hours are counted (0–87600). 0 counts the entire local vault
Quarantine — warning (count)	Integer	Yes	1	Warning from this many quarantined files. 0 disables this level
Quarantine — critical (count)	Integer	Yes	0	Critical from this many quarantined files. 0 disables this level

The recency window is needed because the local quarantine vault keeps files long after GravityZone has purged the detection. Without it, a single old detection would keep the check at Warning indefinitely.

Results

The check reports the worst status of all problems it finds.

Situation	Status
Bitdefender Endpoint Security was not detected (no Bitdefender data and no running agent)	Warning
The Bitdefender agent is not running	Critical, regardless of the settings
Real-time protection is off	As set in Real-time protection off, Critical by default
The signatures reach one of the signature-age thresholds	Warning or Critical
The signature age cannot be determined and Bitdefender reports the definitions as outdated	Warning
The quarantine count within the window reaches one of the quarantine thresholds	Warning or Critical
The agent is running, but the Bitdefender data cannot be read or the real-time protection status cannot be determined	Failure
The query exceeds 30 seconds or returns no output	Failure
None of the above	OK

The result shows these values:

Value	Meaning
Agent running	On Windows, at least one of the Bitdefender services `EPSecurityService`, `EPProtectedService`, `EPIntegrationService` or `EPUpdateService` is running; on macOS, the `BDLDaemon` and Endpoint Security processes are running
Definitions current	The signatures were updated within the last 48 hours. This indicator is fixed and does not depend on your signature-age thresholds
Real-time protection	On-access file scanning is active
Threats / quarantine	The number of files in the local quarantine vault within the recency window. At 0 it reads No threats
Signatures and Signature age	The signature value Bitdefender reports, and the age of the newest signature file
Endpoint ID	The device's GravityZone ID. octoja uses it to attach the cloud data of the Bitdefender integration
Quarantine (list) and EDR incidents	Only with the Bitdefender integration: threat name and file path of the quarantine entries (up to 50), and the number of EDR incidents from GravityZone. If the company has no EDR license, it reads "No EDR license assigned — incidents unavailable."

Differences by platform

Platform	Signatures	Quarantine	Real-time protection, signature value and endpoint ID
Windows	Newest file below `C:\Program Files\Bitdefender\Endpoint Security\Signatures`	Files below `C:\Program Files\Bitdefender\Endpoint Security\Quarantine`, excluding index and cache files	Local Bitdefender database `C:\Program Files\Bitdefender\Endpoint Security\epagng\epagng.db`
macOS	Newest signature file below `/Library/Bitdefender/AVP/signatures/engine`	Files below `/Library/Application Support/Antivirus for Mac/Quarantine`	Local Bitdefender database `/Library/Bitdefender/AVP/settings/epagng/epagng.db`

FAQ

Why does the quarantine count differ from the GravityZone console?

The check counts the files in the local quarantine vault that are newer than Quarantine — recency window (hours). The GravityZone console shows its own detections instead. The two numbers can therefore differ. For the cloud view with threat names and file paths, use the Quarantine list on the same check.

Why do the quarantine list and EDR incidents stay empty although the status rows work?

The cloud data only appears when the Bitdefender integration is connected and the device's customer is matched to the GravityZone company the device belongs to. Check the matching under Match customers — see Set up the Bitdefender integration.

Does the check count as antivirus protection in reports?

Yes. Antivirus evaluation in reports includes Bitdefender Protection. A device counts as protected there when one of its included checks reports OK — see the reports reference.

See also: Set up alerts for a check

Was this helpful?

Still need help? Ask the team