Report types

Informs you about the activity of the Antiphishing module of Bitdefender Endpoint Security Tools. You can view the number of blocked phishing websites on the selected endpoints and the user that was logged in at the time of the last detection. By clicking the links from the Blocked Websites column, you can also view the website URLs, the number of block occurrences, and the date of the last event.

The report also includes a classification of the detection events and affected endpoints as follows:

Informs you about the activity of the following modules:

You can view the number of blocked applications on the selected endpoints and the user that was logged in at the time of the last detection.

Clicking the number associated with a target provides additional information on the blocked applications. Such information includes the number of events that occurred, and the date and time of the last Block event.

In this report, you can quickly instruct the protection modules to allow the selected application to run on the target endpoint:

Informs you about the activity of the Web Control module of Bitdefender Endpoint Security Tools. For each target, you can view the number of blocked websites. By clicking this number, you can view additional information, such as:

Informs you about the activity of the Data Protection module of Bitdefender Endpoint Security Tools. You can view the number of blocked emails and websites on the selected endpoints, as well as the user that was logged in at the time of the last detection.

Informs you about the events that occurred when monitored devices on the endpoints are accessed. For each target endpoint, you can view the number of allow, block and read-only events. Each event can provide you with additional information when clicking the corresponding numbers:

Informs you about the encryption status of the endpoints. The pie chart displays the number of endpoints that are compliant or non-compliant with the encryption policy settings.

The table below the pie chart delivers details such as:

Offers an overview of module coverage for selected targets. In the report details, for each target endpoint, you can view which modules are active, disabled or not installed, and also the scanning engine in use. Clicking the endpoint name will display the Information window with details about the endpoint and installed protection layers.

You can start a task to change the settings of one or several selected endpoints by clicking the Reconfigure agent button, located above the grid. For details, refer to Reconfigure agent.

Provides you with various status information concerning the selected endpoints from your network:

You can apply various filters by to find the information you are looking for.

Informs you about the activity of the Firewall module of Bitdefender Endpoint Security Tools. You can view the number of blocked traffic attempts and blocked port scans on the selected endpoints, as well as the user that was logged in at the time of the last detection.

Informs you about the activity of the HyperDetect module of Bitdefender Endpoint Security Tools.

The chart in the upper side of the report page shows you the dynamics of the attack attempts over the specified period of time and their distribution by type of attack.

You can interact with the chart in the following ways:

The details in the lower part of the report help you identify the malicious attempts in your network and if they were addressed. They refer to:

From this report, you can quickly resolve false positives, by adding exceptions in the assigned security policies. To do so, follow these steps:

If the threat was detected by the Antimalware module, the exception will apply to both On-access and On-demand scanning modes.

Helps you find out how many and which of the selected endpoints have had contact with malware (be that a prevented attack or situations that needed user intervention) over a specific time period and how the threats have been dealt with. You can also see the user that was logged in at the time of the last detection.

Endpoints are grouped based on these criteria:

You can view the list of threats and paths to the affected files, for each endpoint, by clicking the links available in the disinfection result columns.

In this report, you can quickly run a Full Scan task on the unresolved targets, by clicking the Scan infected targets button from the Action Toolbar above the data table.

Provides a high-level overview of Bitdefender MDR protection coverage for all your managed companies and their networks.

The report includes a list of all your managed companies, licensing information, Bitdefender MDR service and onboarding status, and network coverage.

You can view additional information on the displayed managed companies by clicking on the names in the Company Name column.

Informs you about the activity of the Network Attack Defense module. A graph displays the number of the attack attempts detected over a specified interval. The report details include:

Clicking the Add exceptions button for a selected detection automatically creates an entry in Global Exclusions from the Network Protection section.

Provides detailed information on the overall security status of the target endpoints. For example, you can view information about:

For unmanaged endpoints, you can view the Unmanaged status under other columns.

Provides information regarding on-demand scans performed on the selected targets. A pie chart displays the statistics of successful and failed scans. The table below the chart provides details regarding the scan type, occurrence and last successful scan for each endpoint.

Provides information regarding the security policies applied on the selected targets. A pie chart displays the status of the policy. In the table below the chart, you can view the assigned policy on each endpoint and the policy type, as well as the date and the user that assigned it.

Displays all failed submissions of objects sent from the endpoints to Sandbox Analyzer over a specified time period. A submission is considered failed after several retry attempts.

The graphic shows the variation of the failed submissions during the selected period, while in the report details table you can view which files could not be sent to Sandbox Analyzer, the endpoint where the object was sent from, date and time for each retry, the error code returned, description of each failed retry and the company name.

Provides you with detailed information related to the files on target endpoints, which were analyzed in the sandbox over a specified time period. A line chart displays the number of the clean or dangerous analyzed files, while the table presents you with details on each case.

You are able generate a Sandbox Analyzer Results report for all analyzed files or only for those detected as malicious.

You can view:

Sandbox Analyzer captures the following behavioral events:

In the Analysis Result window, click the Download button to save to your computer the Behavior Summary content in the following formats: XML, HTML, JSON, PDF.

Alternatively, you can use submission cards to gather the necessary information on analyzed samples. The submission cards are available in the Sandbox Analyzer section, in the main menu of Control Center.

Provides information about the security events that occurred on a selected target. The information refers to the following events:

To simplify the analysis of Antimalware detections, the report classifies them along with the affected endpoints based on different criteria as follows:

Helps you evaluate the status of the target Security Servers. You can identify the issues each Security Server might have, with the help of various status indicators, such as:

You can also view how many agents are connected to the Security Server. Further on, clicking the number of connected clients will display the list of endpoints. These endpoints may be vulnerable if the Security Server has issues.

Shows you the top 10 malware threats detected over a specific time period on selected endpoints.

Shows you the top 10 most infected endpoints by the number of total detections over a specific time period out of the selected endpoints.

Using the available filters, you can easily find out which clients have updated and which have not in the last 24 hours.

In this report, you can quickly bring the agents to the latest version. To do this, click the Update button from the Action Toolbar above the data table.

Informs you with regards to the ransomware attacks that GravityZone detected on the endpoints you manage, and provides you with the necessary tools to recover the files affected during the attacks.

The report is available as a page in Control Center, distinct from the other reports, accessible right from the Control Center main menu.

The Ransomware Activity page consists of a grid that, for each ransomware attack, lists the following:

Some details are hidden by default. Click the Show/Hide Columns button in the upper right side of the page to configure the details you want to view in the grid. If you have many entries in the grid, you can choose to hide filters using the Show/Hide filters button in the upper right side of the page.

Additional information is available by clicking the number for files. You can view a list with the full path to the original and restored files, and the restore status for all files involved in the selected ransomware attack.

To recover files from ransomware, follow these steps:

If detections are the result of legitimate processes, follow these steps:

Provides you with information about emails or attachments that Content Control deleted from the selected servers over a specific time interval. The information includes:

Provides you with information about emails containing unscannable attachments (over-compressed, password-protected, etc.), blocked on the selected Exchange mail servers over a specific time period. The information refers to:

Shows statistics on the actions taken by the Exchange Protection module over a specific time interval.

The actions are grouped by detection type (malware, spam, forbidden attachment and forbidden content) and by server.

The statistics refer to the following email statuses:

Provides you with information about emails with malware threats, detected on the selected Exchange mail servers over a specific time period. The information refers to:

Informs you about the top 10 most detected malware threats in email attachments. You can generate two views containing different statistics. One view shows the number of detections by affected recipients and one by senders.

For example, GravityZone has detected one email with an infected attachment sent to five recipients.

Besides the sender/recipients and the malware name, the report provides you with the following details:

Shows you the top 10 email recipients most targeted by malware over a specific time interval.

The report details provide you with the entire malware list that affected these recipients, together with the actions taken.

Shows you the top 10 email recipients by the number of spam or phishing emails detected over a specific time interval. The report provides information also on the actions applied to the respective emails.