[Idea] Linux Support for Bitdefender Antivirus

[OscarBeiro]

Your idea

Inspired by #458 we've tried to add support for Bitdefender Endpoint Security Tools, since it is our antimalware solution.

The command is bduitool but doesn't return a json.

Command:

/opt/bitdefender-security-tools/bin/bduitool get ps

Content returned:

Product version: 7.0.3.2239
Last product update: 2023-08-24 at 10:44:23 GMT+2
New product update available: no
Engines version: 7.95171
Last security content update: 2023-08-24 at 11:44:37 GMT+2
New security content available: no
Installed scan type: Full
Installed scan type fallback: None
Currently used scan type: Full
Features:
  - Antimalware status: On
  - NetworkMonitor status: On

Product version and Engines version are assigned directly

• Antimalware status: 0n should be the choice for setting the active to Yes
• If New product update available and New security content available are set to no, Up to date should be YES.
  I don't think we can retrieve any other info since GravityZone handles everything.
  In fact the Windows solutions returns a lot less info.

Finally we have even started to make some substitution to the defender code, but it is not working. Having no clue about Perl might be a reason! :)

I will create a PR to see if anybody can help

[OscarBeiro]

PR #472

[OscarBeiro]

Hi,

You are right. As they are now, API permissions don't allow a read-only key. It seems a lot of work for one particular date, but I will look into it once we have some information from Bitdefender in GLPI. :)

Merci

[OscarBeiro]

Hi,
I have reviewed the getLicenseInfo endpoint and I think it is overkill to use it.
We are managing licenses for several clients, and the key will have access to all that information. In my opinion, dropping the APIKey on another guy's computer is not a good idea.
Also, we will need to find a way to match each license with the installed client, and I don't think there's an easy way for that.

So, I think the Gravityzone will remain on my lengthy wishlist of future GLPI integrations

[g-bougard]

Okay, maybe this a place for a dedicated GLPI plugin ;-)

[g-bougard]

Hello @OscarBeiro

as I'm adding an unittest with your bduitool output, I'm having a question: you decided to set Engines version as BASE_VERSION. From a semantic view, this doesn't seem to match the purpose. In GLPI this is reported as Signature database version as your screenshot here shows. Is Engines version really updated each time the Bitdefender database is ?

[OscarBeiro]

I understand is weird, but it is what it makes more sense to me.
This is my current result:

Product version: 7.0.3.2239
Last product update: 2023-09-05 at 19:04:47 GMT+2
New product update available: yes
Engines version: 7.95234
Last security content update: 2023-09-07 at 17:14:26 GMT+2
New security content available: no
Installed scan type: Full
Installed scan type fallback: None
Currently used scan type: Full
Features:
  - Antimalware status: On
  - NetworkMonitor status: Off

So, Engines version is updated continuously it is what it makes sense to me to equal signature database. Product update is 2 days old, which is a lot for a security solution.

Regards,