GravityZone - BITDEFENDER FOR MALAYSIA · Bitdefender GravityZone Installation Guide Publicationdate2016.07.21 ... OS LocalScanning HybridScanning CentralizedScanning Full Options

GravityZone

INSTALLATION GUIDE

Bitdefender GravityZoneInstallation Guide

Publication date 2016.07.21

Copyright© 2016 Bitdefender

Legal NoticeAll rights reserved. No part of this book may be reproduced or transmitted in any form or by any means, electronicormechanical, including photocopying, recording, or by any information storage and retrieval system, withoutwrittenpermission from an authorized representative of Bitdefender. The inclusion of brief quotations in reviews may bepossible only with the mention of the quoted source. The content can not be modified in any way.Warning and Disclaimer. This product and its documentation are protected by copyright. The information in thisdocument is provided on an “as is” basis, without warranty. Although every precaution has been taken in thepreparation of this document, the authors will not have any liability to any person or entity with respect to any lossor damage caused or alleged to be caused directly or indirectly by the information contained in this work.This book contains links to third-party Websites that are not under the control of Bitdefender, therefore Bitdefenderis not responsible for the content of any linked site. If you access a third-party website listed in this document, youwill do so at your own risk. Bitdefender provides these links only as a convenience, and the inclusion of the link doesnot imply that Bitdefender endorses or accepts any responsibility for the content of the third-party site.Trademarks. Trademark namesmay appear in this book. All registered and unregistered trademarks in this documentare the sole property of their respective owners, and are respectfully acknowledged.

50340A34392034390AFE02048790BF8082B92FA06FA080BA74BC7CC1AE80BA996CE11D2E80BA74C7E78C2E8082FFB239EA2080FEAAAAAAAABF800006AA3FB00000FBD5EFE73AD5009CF2544B4C3D00A6B67D616B878031FB500EA66D0063567F854DF700E84116D29479001E1671326B0580C5FB204BC43D8067FDFBC34DB780D0D217971C6C00C7917C347B4580254D7859B54800EE712FF15D9700606495D7DC7D00AFBD83E36BFD8058E6B23EC589003A89EEB31DAF00C8C91627818C001FB72BF86BFB803D6ABDBFC000809E5E6C015DFE80A54917860DD200B30202C06377805DE366E8361180DF05ED2359FA00AD5455C690B200A3E97B50FB728034D4AF78869180FFA96A063B6F80D53484FF0C718046A5B3D16B298071D6D5BE608100E375ABE609FE8000DA16331D8A00FEF606A13EAF80825B662EA68800BADF6BE52EFE80BA891646848B00BA9C21A5EE700082CC28DA84E080FEA1EC237E1780

Table of ContentsPreface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v

1. Conventions Used in This Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v

1. About GravityZone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.1. GravityZone Security Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.2. GravityZone Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

1.2.1. Web Console (Control Center) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21.2.2. Security Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31.2.3. Security Agents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

2. Installation Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92.1. Endpoint Protection Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

2.1.1. Security Agent Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92.1.2. Security Server Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16

2.2. Security for Exchange Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172.2.1. Supported Microsoft Exchange Environments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172.2.2. System Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182.2.3. Other Software Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

2.3. GravityZone Communication Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

3. Installing Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203.1. License Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

3.1.1. Finding a Reseller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213.1.2. Activating a License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213.1.3. Checking Current License Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

3.2. Installing Security Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223.2.1. Installing Security Server on Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

3.3. Installing Security Agents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253.3.1. Preparing for Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263.3.2. Local Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273.3.3. Remote Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353.3.4. Support for On-access Scanning on Linux Virtual Machines . . . . . . . . . . . . . . . . . . . . . . . 403.3.5. How Network Discovery Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

3.4. Installing Protection on Exchange Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463.4.1. Preparing for Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463.4.2. Installing Protection on Exchange Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

3.5. Credentials Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473.5.1. Adding Credentials to the Credentials Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473.5.2. Deleting Credentials from Credentials Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

4. Integrations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504.1. Integrating with ConnectWise . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504.2. Integrating with Amazon EC2 Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

4.2.1. About Amazon EC2 Integration in Control Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504.2.2. Configuring the Amazon EC2 Integration in Control Center . . . . . . . . . . . . . . . . . . . . . . . . 524.2.3. Subscribing to Security for Amazon Web Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

4.3. Removing Integrations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

iii

5. Getting Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565.1. Bitdefender Support Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565.2. Asking for Assistance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 575.3. Using Support Tool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

5.3.1. Using Support Tool on Windows Operating Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585.3.2. Using Support Tool on Linux Operating Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 595.3.3. Using Support Tool on Mac Operating Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

5.4. Contact Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 615.4.1. Web Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 615.4.2. Local Distributors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625.4.3. Bitdefender Offices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62

iv

PrefaceThis guide is intended for network administrators in charge with deploying theGravityZone protection within their organization's premises, and also for ITmanagers in search for information about GravityZone requirements and availableprotection modules.This document aims to explain how to install and configure theGravityZone solutionand its security agents on all types of endpoints in your company.

1. Conventions Used in This Guide

Typographical ConventionsThis guide uses several text styles for an improved readability. Learn about theiraspect and meaning from the table below.

DescriptionAppearance

Inline command names and syntaxes, pathsand filenames, configuration file outputs, inputtext are printed with monospaced characters.

sample

The URL link is pointing to some externallocation, on http or ftp servers.

http://www.bitdefender.com

E-mail addresses are inserted in the text forcontact information.

[email protected]

This is an internal link, towards some locationinside the document.

“Preface” (p. v)

All the product options are printed using boldcharacters.

option

Interface options, keywords or shortcuts arehighlighted using bold characters.

keyword

Preface v


mailto:[email protected]

AdmonitionsThe admonitions are in-text notes, graphically marked, bringing to your attentionadditional information related to the current paragraph.

NoteThe note is just a short observation. Although you can omit it, the notes can providevaluable information, such as specific feature or a link to some related topic.

ImportantThis requires your attention and is not recommended to skip over it. Usually, it providesnon-critical but significant information.

WarningThis is critical information you should treat with increased caution. Nothing bad willhappen if you follow the indications. You should read and understand it, because itdescribes something extremely risky.

Preface vi

1. ABOUT GRAVITYZONEGravityZone is a business security solution built from ground-up for virtualizationand cloud to deliver security services to physical endpoints, virtual machines inprivate, public cloud and Exchange mail servers.GravityZone is one product with a unified management console available in thecloud, hosted by Bitdefender, or as one virtual appliance to be installed on premise,and it provides a single point for deploying, enforcing andmanaging security policiesfor any number of endpoints and of any type, in any location.GravityZone delivers multiple layers of security for endpoints, including MicrosoftExchange mail servers: antimalware with behavioral monitoring, zero day threatprotection, application control and sandboxing, firewall, device control, contentcontrol, anti-phishing and antispam.

1.1. GravityZone Security ServicesGravityZone provides the following security services:

● Security for Endpoints

● Security for Virtualized Environments

● Security for Exchange

● Security for Amazon Web Services

Security for Amazon Web ServicesAlthough cloud computing is broadly considered a secure technology, companiesstill need optimal protection against targeted malware attacks. To realize the fullpotential of cloud computing without sacrificing security, antimalware solutionsshould also have minimal impact on system performance.Security for Amazon Web Services addresses all these challenges withhighly-scalable, innovative technology. Bitdefender’s solution has been designedspecifically for virtualized environments and meets the requirements of the mostdynamic cloud infrastructures. Seamlessly integrated with Amazon Web Services(AWS) for availability in the cloud, Bitdefender Security for Amazon Web Servicesprotects virtualized Windows and Linux systems with a small agent footprint,generating immediate cost savings for Amazon users.

About GravityZone 1

Security for EndpointsProtects unobtrusively any number of Windows, Linux and Mac OS X laptops,desktops and servers by using top-ranked antimalware technologies. Additionally,Windows systems benefit of evenmore enhanced security with a two-way firewall,intrusion detection, web access control and filtering, sensitive data protection,application and device control. Low system usage ensures performanceimprovements. The solution provides an alternative to legacy antimalware systemsby combining industry-acclaimed security technologies with simplicity ofdeployment and management through the powerful GravityZone Control Center.Proactive heuristics is employed to classify malicious processes based on theirbehavior, detecting new threats in real time.

Security for Virtualized EnvironmentsSecurity for Virtualized Environments is the first all-encompassing security solutionfor virtualized datacenters, protecting virtualized servers and desktops onWindowsand Linux systems. Powered by cutting-edge caching technologies, the solutiondrives significant performance gains and boosts server consolidation by up to 30%compared to traditional antimalware.

Security for ExchangeBitdefender Security for Exchange provides antimalware, antispam, antiphishing,attachment and content filtering seamlessly integratedwith theMicrosoft ExchangeServer, to ensure a securemessaging and collaboration environment and increaseproductivity. Using award-winning antimalware and antispam technologies, itprotects the Exchange users against the latest, most sophisticated malware andagainst attempts to steal users' confidential and valuable data.

1.2. GravityZone ArchitectureThe GravityZone solution includes the following components:

● Security Server● Security Agents

1.2.1. Web Console (Control Center)Bitdefender security solutions aremanagedwithin GravityZone from a single pointof management, Control Center web console, which provides easier managementand access to overall security posture, global security threats, and control over all

About GravityZone 2

security modules protecting virtual or physical desktops and servers and Amazoninstances. Powered by a Gravity Architecture, Control Center is capable ofaddressing the needs of even the largest organizations.Control Center, a web-based interface, integrates with the existing systemmanagement and monitoring systems to make it simple to apply protection tounmanaged desktops and servers.

1.2.2. Security ServerTheSecurity Server is a dedicated virtualmachine that deduplicates and centralizesmost of the antimalware functionality of antimalware agents, acting as a scanserver.

NoteYour product license may not include this feature.

TheSecurity Servermust be installed on one or several hosts so as to accommodatethe number of protected virtual machines.For Amazon EC2 instances, you do not need to install any Security Server. In thiscase, Security Server machines are hosted by Bitdefender, and the EC2 instanceswill automatically connect to the Bitdefender Security Server hosted in theappropriate AWS region.

1.2.3. Security AgentsTo protect your network with Bitdefender, you must install the appropriateGravityZone security agents on network endpoints.

● Bitdefender Endpoint Security Tools● Endpoint Security for Mac

Bitdefender Endpoint Security ToolsGravityZone ensures physical and virtual machines protection with BitdefenderEndpoint Security Tools, an intelligent environment-aware security agent capableto automatically self-configure according to the endpoint type. Bitdefender EndpointSecurity Tools can be deployed on anymachine, either virtual or physical, providinga flexible scanning system, being an ideal choice formixed environments (physical,virtual and cloud).

About GravityZone 3

In addition to file system protection, Bitdefender Endpoint Security Tools alsoincludes mail server protection for Microsoft Exchange Servers.Bitdefender Endpoint Security Tools uses one single policy template for physicaland virtualmachines, and one installation kit source for any environment (physicalor virtual). Bitdefender Endpoint Security Tools is also available for Linux physicalendpoints (servers and desktops).

Scanning Engines

The scanning engines are automatically set during Bitdefender Endpoint SecurityTools packages creation, letting the endpoint agent detect the machine'sconfiguration and adapt the scanning technology accordingly. The administratorcan also customize the scan engines, being able to choose between severalscanning technologies:

1. Local Scan, when the scanning is performed on the local endpoint. The localscanning mode is suited for powerful machines, having all signatures andengines stored locally.

2. Hybrid Scan with Light Engines (Public Cloud), with a medium footprint, usingin-the-cloud scanning and, partially, the local signatures. This scanning modebrings the benefit of better resources consumption, while involving off-premisescanning.

3. Central Scan in Private Cloud, with a small footprint requiring a Security Serverfor scanning. In this case, no signature set is stored locally, and the scanningis offloaded on the Security Server.

4. Central Scan (Private Cloud scanning with Security Server) with fallback* onLocal Scan (Full Engines)

5. Central Scan (Private Cloud scanning with Security Server) with fallback* onHybrid Scan (Public Cloud with Light Engines)

*When using a dual engines scanning, if the first engine is unavailable, the fallbackengine will be used. Resource consumption and network utilization will be basedon used engines.

Protection Modules

The following protectionmodules are available with Bitdefender Endpoint SecurityTools:

● Antimalware● Advanced Threat Control

About GravityZone 4

● Firewall● Content Control● Device Control● Power User

Antimalware

The antimalware protection module is based on signature scanning and heuristicanalysis (B-HAVE) against: viruses, worms, trojans, spyware, adware, keyloggers,rootkits and other types of malicious software.Bitdefender's antimalware scanning technology relies on the following protectionlayers:

● First, a traditional scanning method is employed where scanned content ismatched against the signature database. The signature database contains bytepatterns specific to known threats and is regularly updated by Bitdefender. Thisscanning method is effective against confirmed threats that have beenresearched and documented. However, no matter how promptly the signaturedatabase is updated, there is always a vulnerability window between the timewhen a new threat is discovered and when a fix is released

● Against brand-new, undocumented threats, a second layer of protection isprovided byB-HAVE, Bitdefender's heuristic engine. Heuristic algorithms detectmalware based on behavioral characteristics. B-HAVE runs suspectedmalwarein a virtual environment to test its impact on the system and ensure it posesno threat. If a threat is detected, the program is prevented from running.

Advanced Threat Control

For threats that elude even the heuristic engine, a third layer of protection is presentin the form of Advanced Threat Control (ATC).Advanced Threat Control continuously monitors running processes and gradessuspicious behaviors such as attempts to: disguise the type of process, executecode in another process's space (hijack process memory for privilege escalation),replicate, drop files, hide from process enumeration applications, etc. Eachsuspicious behavior raises the process rating. When a threshold is reached, analarm is triggered.

ImportantThis module is available only for supported Windows desktop and server operatingsystems, except Windows XP and Windows Server 2003 / Windows Server 2003 R2.

About GravityZone 5

Firewall

The Firewall controls applications' access to the network and to the Internet. Accessis automatically allowed for a comprehensive database of known, legitimateapplications. Furthermore, the firewall can protect the system against port scans,restrict ICS and warn when new nodes join a Wi-Fi connection.

ImportantThis module is available only for supported Windows workstations.

Content Control

The Content Control module helps enforce company policies for allowed traffic,web access, data protection and applications control. Administrators can definetraffic scan options and exclusions, scheduleweb accesswhile blocking or allowingcertain web categories or URLs, configure data protection rules and definepermissions for the use of specific applications.

ImportantThis module is available only for supported Windows workstations.

Device Control

The Device Control module allows preventing the sensitive data leakage andmalware infections via external devices attached to endpoints by applying blockingrules and exceptions via policy to a vast range of device types (such as USB FlashDrives, Bluetooth Devices, CD/DVD-Players, Storage Devices, etc.).

ImportantThis module is available only for supported Windows desktop and server operatingsystems.

Power User

Control Center administrators can grant Power User rights to endpoint users viapolicy settings. The Power Usermodule enables administration rights at user level,allowing the endpoint user to access and modify security settings via a localconsole. Control Center is being notified when an endpoint is in Power User modeand the Control Center administrator can always overwrite local security settings.

ImportantThis module is available only for supported Windows desktop and server operatingsystems.

About GravityZone 6

Endpoint Roles

Relay Role

Endpoint agents with Bitdefender Endpoint Security Tools Relay role serve ascommunication proxy and update servers for other endpoints in the network.Endpoint agentswith relay role are especially required in organizationswith isolatednetworks, where all traffic is made through a single access point.In companies with large distributed networks, relay agents help lowering thebandwidth usage, by preventingprotected endpoints and security servers to connectdirectly to the GravityZone appliance.Once a Bitdefender Endpoint Security Tools Relay agent is installed in the network,other endpoints can be configured via policy to communicate with Control Centerthrough the relay agent.Bitdefender Endpoint Security Tools Relay agents serve for the following:

● Discovering all unprotected endpoints in the network.This functionality is essential for the security agent deployment in a cloudGravityZone environment.

● Deploying the endpoint agent inside the local network.

● Updating protected endpoints in the network.

● Ensuring the communication betweenControl Center and connected endpoints.

● Acting as proxy server for protected endpoints.

● Optimizing the network traffic during updates, deployments, scanning and otherresource-consuming tasks.

ImportantThis role is available only for supported Windows desktop and server operatingsystems.

Exchange Protection Role

Bitdefender Endpoint Security Tools with Exchange role can be installed onMicrosoft Exchange Servers with the purpose of protecting the Exchange usersfrom email-borne threats.Bitdefender Endpoint Security Tools with Exchange role protects both the servermachine and the Microsoft Exchange Solution.

About GravityZone 7

Endpoint Security for MacEndpoint Security for Mac is a powerful antimalware scanner, which can detectand remove all kinds of malware, including viruses, spyware, Trojan horses,keyloggers, worms and adware on Intel-basedMacintoshworkstations and laptopswith Mac OS X version 10.8.5 or later.Endpoint Security forMac includesonly theAntimalwaremodule, while the scanningtechnology available is Local Scan, with all signatures and engines stored locally.

About GravityZone 8

2. INSTALLATION REQUIREMENTSAll of the GravityZone solutions are installed and managed via Control Center.

2.1. Endpoint Protection RequirementsTo protect your networkwith Bitdefender, youmust install the GravityZone securityagents on network endpoints. For optimized protection, you can also install SecurityServers. For this purpose, you need a Control Center user with administratorprivileges over the services you need to install and over the network endpointsunder your management.

2.1.1. Security Agent Requirements

Hardware Requirements

Intel® Pentium compatible processor

Workstation Operating Systems

● 1 GHz or faster for Microsoft Windows XP SP3, Windows XP SP2 64 bit andWindows 7 Enterprise (32 and 64 bit)

● 2 GHz or faster for Microsoft Windows Vista SP1 or higher (32 and 64 bit),Microsoft Windows 7 (32 and 64 bit), Microsoft Windows 7 SP1 (32 and 64bit),Windows 8, Windows 8.1, Windows 10, Windows 10 TH2

● 800MHZor faster forMicrosoftWindows Embedded Standard 7 SP1,MicrosoftWindowsPOSReady 7,MicrosoftWindowsPOSReady 2009,MicrosoftWindowsEmbeddedStandard 2009,MicrosoftWindowsXPEmbeddedwith Service Pack2, Microsoft Windows XP Tablet PC Edition

Server Operating Systems

● Minimum: 2.4 GHz single-core CPU

● Recommended: 1.86 GHz or faster Intel Xeon multi-core CPU

Free RAM Memory

RAM Memory Required at Installation (MB)

Installation Requirements 9

SINGLE ENGINE

OS Centralized ScanningHybrid ScanningLocal Scanning

FullOptions

AV OnlyFullOptions

AV OnlyFullOptions

AV Only

40025666051212001024Windows25625651251210241024Linuxn/an/an/an/a10241024Mac

RAM Memory for Daily Usage (MB)*

Protection ModulesAntivirus (Single Engine)OS Update

ServerPowerUser

ContentControlFirewall

BehavioralScanCentralizedHybridLocal

+76+29+41+17+13305575Windows-----90180200Linux-------300Mac

* The measurements cover the daily endpoint client usage, without taking intoaccount additional tasks, such as on-demand scans or product updates.

HDD Requirements

Free HDD Space Required at Installation (MB)

● DUAL ENGINESINGLE ENGINE

OS

Centralized +Hybrid

Scanning

Centralized +Local

Scanning

CentralizedScanning

HybridScanning

LocalScanning

FullOptions

AVOnly

FullOptions

AVOnly

FullOptions

AVOnly

FullOptions

AVOnly

FullOptions

AVOnly

7005001200102457035070050012001024Windows4004001024102425025040040010241024Linux


DUAL ENGINESINGLE ENGINE

OS

Centralized +Hybrid

Scanning

Centralized +Local

Scanning

CentralizedScanning

HybridScanning

LocalScanning

FullOptions

AVOnly

FullOptions

AVOnly

FullOptions

AVOnly

FullOptions

AVOnly

FullOptions

AVOnly

n/an/an/an/an/an/an/an/a10241024Mac

Note– At least 10 GB additional free disk space is required for entities with

Bitdefender Endpoint Security Tools Relay role, as they will store all updatesand installation packages.

– The quarantine for Exchange Servers requires additional hard-disk space onthe partition where the security agent is installed.The quarantine size depends on the number of items stored and their size.By default, the agent is installed on the system partition.

Free HDD Space for Daily Usage (MB)*

Protection ModulesAntivirus (Single Engine)OS Update

ServerPowerUser

ContentControlFirewall

BehavioralScanCentralizedHybridLocal

+10+80+60+5+12140190410Windows-----110200500Linux-------1024Mac

* The measurements cover the daily endpoint client usage, without taking intoaccount additional tasks, such as on-demand scans or product updates.

Traffic Usage

● Product updates traffic between endpoint client and update serverEach periodical Bitdefender Endpoint Security Tools product update generatesthe following download traffic on each endpoint client:


– On Windows OS: ~20 MB

– On Linux OS: ~26 MB

– On Mac OS: ~25 MB

● Downloaded signature updates traffic between endpoint client and updateserver

Scan Engine TypeUpdate Server Type

CentralizedHybridLocal

555865Relay (MB / day)33.53Bitdefender Update Server (MB / day)

● Central Scan traffic between endpoint client and Security Server

Upload (MB)Download (MB)Traffic TypeScanned Objects

84127First scanFiles*

38213Cached scanN/A621Web traffic

First scanWebsites**

105054Security ServerN/A654Web traffic

Cached Scan0.50.2Security Server

* The provided data has been measured for 3.49 GB of files (6,658 files), ofwhich 1.16 GB are Portable Executable (PE) files.** The provided data has been measured for the top-ranked 500 websites.

● Hybrid scan traffic between endpoint client and Bitdefender Cloud Services

Upload (MB)Download (MB)Traffic TypeScanned Objects

0.61.7First scanFiles*

0.30.6Cached scanN/A650Web traffic

Web traffic**2.72.6Bitdefender Cloud Services


* The provided data has been measured for 3.49 GB of files (6,658 files), ofwhich 1.16 GB are Portable Executable (PE) files.** The provided data has been measured for the top-ranked 500 websites.

NoteThe network latency between endpoint client and Bitdefender Cloud Server mustbe under 1 second.

● Signatures download traffic betweenBitdefender Endpoint Security Tools Relayclients and update serverClients with Bitdefender Endpoint Security Tools Relay role download ~16 MB/ day* from update server.* Available with Bitdefender Endpoint Security Tools clients starting from6.2.3.569 version.

● Traffic between endpoint clients and Control Center web consoleAn average traffic of 618 KB / day is generated between endpoint clients andControl Center web console.

Supported Operating Systems

Windows Operating Systems

Desktop Operating Systems

● Windows 10 TH2.

● Windows 10(1)

● Windows 8.1

● Windows 8

● Windows 7

● Windows Vista with Service Pack 1

● Windows XP with Service Pack 2 64 bit

● Windows XP with Service Pack 3


WarningBitdefender will provide full protection support for Windows XP until January1st 2017.Starting January 1st 2017 until January 1st 2020, Bitdefenderwill provide limitedsupport (only signature-based antimalware protection) on a case by case basis.

Tablet and embedded operating systems

● Windows Embedded 8.1 Industry

● Windows Embedded 8 Standard

● Windows Embedded Standard 7

● Windows Embedded Compact 7

● Windows Embedded POSReady 7

● Windows Embedded Enterprise 7

● Windows Embedded POSReady 2009

● Windows Embedded Standard 2009

● Windows XP Embedded with Service Pack 2(2)

● Windows XP Tablet PC Edition(2)

Server operating systems:

● Windows Server 2012 / Windows Server 2012 R2



WarningBitdefender will provide full protection support for Windows 2003 untilJanuary 1st 2017.Starting January 1st 2017 until January 1st 2020, Bitdefender will providelimited support (only signature-based antimalware protection) on a case bycase basis.

● Windows Small Business Server (SBS) 2011




● Windows Home Server

ImportantBitdefender Endpoint Security Tools supports the Windows Server FailoverCluster (WSFC) technology.

Note(1) Windows 10 support is available for Endpoint Security starting with version5.3.23.704and for Bitdefender Endpoint Security Tools startingwith version 6.2.4.582.(2) Specific embedded operating system modules must be installed for BitdefenderEndpoint Security Tools to work.

Linux Operating Systems

● Red Hat Enterprise Linux / CentOS 5.6 or higher● Ubuntu 10.04 LTS or higher● SUSE Linux Enterprise Server 11 or higher● OpenSUSE 11 or higher● Fedora 15 or higher● Debian 5.0 or higher● Amazon Linux AMI

On-access scanning is available for all supported guest operating systems. OnLinux systems, on-access scanning support is provided in the following situations:

On-access scanning supportLinux DistributionKernel Version

The fanotify kernel option must beenabled.

All supported2.6.38 or higher

For Debian 8 systems, refer to thisKB article.Bitdefender provides support viaDazukoFS with prebuilt kernelmodules.

Debian 5.0, 6.0Ubuntu 10.04 LTSCentOS 6.x

2.6.18 - 2.6.37

Red Hat Enterprise Linux6.x


http://www.bitdefender.com/support/bitdefender-endpoint-security-tools-compatibility-with-debian-8-1482.html

http://www.bitdefender.com/support/bitdefender-endpoint-security-tools-compatibility-with-debian-8-1482.html

For any other distribution or kernel version you need to manually compile theDazukoFS module. To view the procedure for manual compilation of DazukoFS,refer to: “Support for On-access Scanning on Linux Virtual Machines” (p. 40).

NoteFanotify and DazukoFS enable third-party applications to control file access on Linuxsystems. For more information, refer to:

● Fanotify man pages:http://www.xypron.de/projects/fanotify-manpages/man7/fanotify.7.html.

● Dazuko project website: http://dazuko.dnsalias.org/wiki/index.php/About.

Mac OS X Operating Systems

● Mac OS X El Capitan (10.11.x)

● Mac OS X Yosemite (10.10.5)

● Mac OS X Mavericks (10.9.5)

● Mac OS X Mountain Lion (10.8.5)

Supported BrowsersEndpoint browser security is verified to be working with the following browsers:

● Internet Explorer 8+

● Mozilla Firefox 8+

● Google Chrome 15+

● Safari 4+

2.1.2. Security Server RequirementsSecurity Server is a preconfigured virtual machine running on an Ubuntu Server12.04 LTS (3.2 kernel).


Bitdefender Security Server canbe installed on the following virtualizationplatforms:

● VMware vSphere 6.0, 5.5, 5.1, 5.0, 4.1 with VMware vCenter Server 6.0, 5.5, 5.1,5.0, 4.1


http://www.xypron.de/projects/fanotify-manpages/man7/fanotify.7.html

http://dazuko.dnsalias.org/wiki/index.php/About

● VMware View 5.3, 5.2, 5.1, 5.0

● VMware Workstation 8.0.6, 9.x, 10.x, 11.x

● VMware Player 5.x, 6.x, 7.x

● Citrix XenServer 7.0, 6.5, 6.2, 6.0, 5.6 or 5.5 (including Xen Hypervisor)

● Citrix XenDesktop 7.9, 7.8, 7.7, 7.6, 7.5, 7.1, 7, 5.6, 5.5, 5.0

● Citrix XenApp 7.9, 7.8, 7.6, 7.5, 6.5

● Citrix VDI-in-a-Box 5.x

● Microsoft Hyper-V Server 2008 R2, 2012, 2012 R2 or Windows Server 2008 R2,2012, 2012 R2 (including Hyper-V Hypervisor)

● Red Hat Enterprise Virtualization 3.0 (including KVM Hypervisor)

● Oracle VM 3.0

NoteSupport for other virtualization platforms may be provided on request.

Memory andCPU resource allocation for theSecurity Server dependson the numberand type of VMs running on the host. The following table lists the recommendedresources to be allocated:

CPUsRAMNumber of protected VMs

2 CPUs2 GB1-50 VMs4 CPUs2 GB51-100 VMs6 CPUs4 GB101-200 VMs

2.2. Security for Exchange RequirementsSecurity for Exchange is delivered through Bitdefender Endpoint Security Tools,which is able to protect both the file system and the Microsoft Exchange mailserver.

2.2.1. Supported Microsoft Exchange EnvironmentsSecurity for Exchange supports the following Microsoft Exchange versions androles:


● Exchange Server 2016 with Edge Transport or Mailbox role

● Exchange Server 2013 with Edge Transport or Mailbox role

● Exchange Server 2010 with Edge Transport, Hub Transport or Mailbox role

● Exchange Server 2007 with Edge Transport, Hub Transport or Mailbox role

Security for Exchange is compatiblewithMicrosoft ExchangeDatabaseAvailabilityGroups (DAGs).

2.2.2. System RequirementsSecurity for Exchange is compatible with any physical or virtual 64-bit server (Intelor AMD) running a supported Microsoft Exchange Server version and role. Fordetails regarding the Bitdefender Endpoint Security Tools system requirements,refer to “Security Agent Requirements” (p. 9).Recommended server resource availability:

● Free RAM memory: 1 GB

● Free HDD space: 1 GB

2.2.3. Other Software Requirements● For Microsoft Exchange Server 2013 with Service Pack 1: KB2938053 from

Microsoft.

● For Microsoft Exchange Server 2007: .NET Framework 3.5 Service Pack 1 orhigher

2.3. GravityZone Communication PortsThe following table provides information on the ports used by the GravityZonecomponents:

UsagePort

Port used to access the Control Center web console.80 (HTTP) / 443 (HTTPS)Bitdefender Cloud Antispam Detection ServiceHTTP(s) 80 / 443Update Server port.80Port used by client/agent software to connect to theCommunication Server.

8443 (HTTPS)


http://support.microsoft.com/kb/2938053

UsagePort

7074 (HTTP)Port used for Realtime Blackhole List (RBLs)53 (UDP)

* Since the relay is an update server that needs to listen all the time on a port,Bitdefender provides a mechanism able to automatically open a random port onlocalhost (127.0.0.1), so that the update server can receive proper configurationdetails. This mechanism applies when the default port 7074 is used by anotherapplication. In this case, the update server tries to open the 7075 port to listen onlocalhost. If 7075 port is also unavailable, the update server will search for anotherport that is free (in range of 1025 to 65535) and successfully bind to listen onlocalhost.For detailed information regarding GravityZone ports, refer to this KB article.


http://www.bitdefender.com/support/bitdefender-small-office-security-(cloud-console)-communication-ports-1256.html

3. INSTALLING PROTECTIONThe following table shows the types of endpoints each service is designed toprotect:

EndpointsService

Physical computers (workstations, laptops andservers) running on Microsoft Windows, Linuxand Mac OS X

Security for Endpoints

Microsoft Windows or Linux virtual machinesSecurity for VirtualizedEnvironments

Microsoft Exchange ServersSecurity for ExchangeAmazon EC2 instances running on MicrosoftWindows and Linux

Security for Amazon WebServices

3.1. License ManagementGravityZone is licensedwith a single key for all security services except for Securityfor Amazon Web Services, to which you subscribe using the Amazon Paymentservice. For more information about Security for Amazon Web Services licensing,refer to “Integrating with Amazon EC2 Services” (p. 50).You can try GravityZone for free for a period of 30 days. During the trial period allfeatures are fully available and you canuse the service on any number of computers.Before the trial period ends, if you want to continue using the services, you mustopt for a paid subscription plan and make the purchase.

NoteYou may view a red ribbon on the upper side of the webpage, informing you of theexpired trial. If using only Security for Amazon Web Services, please disregard thiswarning, as it refers to the Security for Endpoints and Security for VirtualizedEnvironments services.

To purchase a license, contact a Bitdefender reseller or contact us by email [email protected] subscription is managed by Bitdefender or by the Bitdefender partner whosells you the service. Some Bitdefender partners are security service providers.Depending on your subscription arrangements, GravityZone day-to-day operation

Installing Protection 20


may be handled either internally by your company or externally by the securityservice provider.

3.1.1. Finding a ResellerOur resellers will assist you with all the information you need and help you choosethe best licensing option for you.To find a Bitdefender reseller in your country:

1. Go to the Partner Locator page on Bitdefender website.2. Select the country you reside in to view contact information of available

Bitdefender partners.3. If you do not find a Bitdefender reseller in your country, feel free to contact us

by email at [email protected].

3.1.2. Activating a LicenseWhen you purchase a paid subscription plan for the first time, a license key isissued for you. The GravityZone subscription is enabled by activating this licensekey.

WarningActivating a license does NOT append its features to the currently active license.Instead, the new license overrides the old one. For example, activating a 10 endpointslicense on top of a 100 endpoints license will NOT result in a subscription for 110endpoints. On the contrary, it will reduce the number of covered endpoints from 100to 10.

The license key is sent to you via email when you purchase it. Depending on yourservice agreement, once your license key is issued, your service provider mayactivate it for you. Alternately, you can activate your licensemanually, by followingthese steps:

1. Log in to Control Center using your account.

2. Click your username in the upper-right corner of the console and choose MyCompany.

3. Check details about the current license in the License section.

4. In the License section, select the License type.

5. In the License Key field, enter your license key.


http://www.bitdefender.com/partners/partner-locator.html


6. Click theCheck button andwait until Control Center retrieves information aboutthe entered license key.

7. Click Save.

3.1.3. Checking Current License DetailsTo view your license details:

1. Log in to Control Center using your email and password received by email.2. Click your username in the upper-right corner of the console and choose My

Company.3. Check details about the current license in the License section. You can also

click the Check button and wait until Control Center retrieves the latestinformation about the current license key.

3.2. Installing Security Server


3.2.1. Installing Security Server on HostsSecurity Server is a dedicated virtual machine that deduplicates and centralizesmost of the antimalware functionality of antimalware clients, acting as a scanserver.You must install Security Server on one or more hosts so as to accommodate thenumber of virtual machines to be protected.You must consider the number of protected virtual machines, resources availablefor Security Server on hosts, as well as network connectivity between SecurityServer and protected virtual machines.

NoteSecurity Servermust be installed only in the local network, to protect virtualmachinesinstalled on the company's premises. Whenmanaging Amazon EC3 instances, thereis no need to install Security Server machines, as these are hosted by Bitdefender ineach AWS region.

The security agent installed on virtual machines connects to Security Server overTCP/IP, using details configured at installation or via a policy.


Local InstallationTheSecurity Server package is available for download fromControl Center in severaldifferent formats, compatible with the main virtualization platforms.

Downloading Installation Packages

To download Security Server installation packages:

1. Go to the Network > Packages page.

2. Select the Default Security Server Package.

3. Click the Download button at the upper side of the table and choose thepackage type from the menu.

4. Save the selected package to the desired location.

Deploying Security Server Installation Packages

Once you have the installation package, deploy it to the host using your preferredvirtual machine deployment tool.After deployment, set up the Security Server as follows:

1. Access the appliance console from your virtualization management tool (forexample, vSphere Client). Alternatively, you can connect to the appliance viaSSH.

2. Log in using the default credentials.

● User name: root

● Password: sve

3. Run the sva-setup command. You will access the appliance configurationinterface.


Security Server configuration interface (main menu)

To navigate throughmenus and options, use the Tab and arrow keys. To selecta specific option, press Enter.

4. Configure the network settings.The Security Server uses the TCP/IP protocol to communicate with the otherGravityZone components. You can configure the appliance to automaticallyobtain network settings from the DHCP server or you can manually configurenetwork settings, as described herein:

a. From the main menu, select Network configuration.

b. Select the network interface.

c. Select the IP configuration mode:

● DHCP, if you want the Security Server to automatically obtain networksettings from the DHCP server.

● Static, if a DHCP server is absent or an IP reservation for the appliancehas been made on the DHCP server. In this case, you must manuallyconfigure the network settings.

i. Enter the hostname, IP address, network mask, gateway and DNSservers in the corresponding fields.

ii. Select OK to save the changes.

NoteIf you are connected to the appliance via a SSH client, changing the networksettings will immediately terminate your session.


5. Configure the proxy settings.If a proxy server is used within the network, youmust provide its details so thatthe Security Server can communicate with GravityZone Control Center.

NoteOnly proxies with basic authentication are supported.

a. From the main menu, select Internet proxy configuration.

b. Enter the hostname, username, password and the domain in thecorresponding fields.

c. Select OK to save the changes.

6. Configure the Communication Server address.

a. From the main menu, select Communication server configuration.

b. Enter the following address for the Communication Server:https://cloud-ecs.gravityzone.bitdefender.com:443/hydra


7. Configure the client ID.

a. From the main menu, select Configure the client ID.

b. Enter the company ID.The ID is a string of 32 characters, which you can find by accessing thecompany details page in Control Center.


3.3. Installing Security AgentsTo learn about the available security agents, refer to “Security Agents” (p. 3).To protect your physical and virtual endpoints as well as Amazon EC2 instances,youmust install the security agent on each of them. Besidesmanaging protectionon the local endpoint, the security agent also communicates with Control Centerto receive the administrator's commands and to send the results of its actions.On Windows machines, the security agent can have two roles and you can installit as follows:

1. As a simple security agent for your endpoints.


2. As a Relay, acting as a security agent and also as a communication, proxy andupdate server for other endpoints in the network.

Warning● The first endpoint on which you install protection must have the Relay role,

otherwise you will not be able to remotely install the security agent on otherendpoints in the same network.

● The Relay endpointmust be powered-on and online in order for the connectedagents to communicate with Control Center.

You can install the security agents on physical and virtual endpoints by runninginstallation packages locally or by running installation tasks remotely fromControlCenter.It is very important to carefully read and follow the instructions to prepare forinstallation.In normal mode, the security agents have a minimal user interface. It only allowsusers to check protection status and run basic security tasks (updates and scans),without providing access to settings.If enabled by the network administrator via installation package and security policy,the security agent can also run in Power User mode onWindows endpoints, lettingthe endpoint user view andmodify policy settings. Nevertheless, the Control Centeradministrator can always control which policy settings apply, overriding the PowerUser mode.By default, the display language of the user interface on protected endpoints is setat installation time based on the language of your account. To install the userinterface in another language on certain endpoints, you can create an installationpackage and set the preferred language in its configuration options. For moreinformation on creating installation packages, refer to “Creating InstallationPackages” (p. 28).

3.3.1. Preparing for InstallationBefore installation, follow these preparatory steps to make sure it goes smoothly:

1. Make sure the target endpoints meet the minimum system requirements. Forsome endpoints, you may need to install the latest operating system servicepack available or free up disk space. Compile a list of endpoints that do notmeet the necessary requirements so that you can exclude them frommanagement.


2. Uninstall (not just disable) any existing antimalware, firewall or Internet securitysoftware from target endpoints. Running the security agent simultaneouslywith other security software on an endpoint may affect their operation andcause major problems with the system.Many of the incompatible security programs are automatically detected andremoved at installation time. To learn more and to check the list of detectedsecurity software, refer to this KB article.

ImportantNoneed toworry aboutWindows security features (WindowsDefender,WindowsFirewall), as they will be turned off automatically before installation is initiated.

3. The installation requires administrative privileges and Internet access. Makesure you have the necessary credentials at hand for all endpoints.

4. Endpoints must have connectivity to Control Center.5. It is recommended to use a static IP address for the relay server. If you do not

set a static IP, use the machine's hostname.

3.3.2. Local InstallationOne way to install the security agent on an endpoint is to locally run an installationpackage.You can create andmanage installation packages in theNetwork > Packages page.

The Packages page

Warning

● The firstmachine onwhich you install protectionmust have Relay role, otherwiseyouwill not be able to deploy the security agent on other endpoints in the network.

● The Relay machine must be powered-on and online in order for the clients tocommunicate with Control Center.


http://www.bitdefender.com/support/Removing-security-software-incompatible-with-GravityZone-Security-for-Endpoints-1123.html

Once the first client has been installed, it will be used to detect other endpoints inthe same network, based on the Network Discovery mechanism. For detailedinformation on network discovery, refer to “HowNetwork DiscoveryWorks” (p. 42).To locally install the security agent on an endpoint, follow the next steps:

1. Create an installation package according to your needs.

NoteThis step is not mandatory if an installation package has already been createdfor the network under your account.

2. Download the installation package on the target endpoint.You can alternately send the installation package download links by email toseveral users in your network.

3. Run the installation package on the target endpoint.

Creating Installation PackagesTo create an installation package:

1. Connect and log in to Control Center.


3. Click the Add button at the upper side of the table. A configuration windowwill appear.


Create Packages - Options

4. Enter a suggestive name and description for the installation package you wantto create.

5. From the Language field, select the desired language for the client's interface.

6. Select the protection modules you want to install.

NoteOnly the supportedmodules for each operating systemwill be installed. Formoreinformation, refer to “Protection Modules” (p. 4).On Amazon EC2 instances, only Antimalware, Active Virus Control and DeviceControl modules are supported.

7. Select the target endpoint role:

● Relay, to create the package for an endpoint with Relay role. For moreinformation, refer to “Relay Role” (p. 7)

● Exchange Protection, to install the protection modules for MicrosoftExchangeServers, including antimalware, antispam, content and attachmentfiltering for the Exchange email traffic and on-demand antimalware scanningof the Exchange databases. For more information, refer to “Security forExchange” (p. 2).


8. Scan Mode. Choose the scanning technology that best suits your networkenvironment and your endpoints' resources. You can define the scan mode bychoosing one of the following types:

● Automatic. In this case, the security agent will automatically detect theendpoint's configuration andwill adapt the scanning technology accordingly:

– Central Scan in Private Cloud (with Security Server) with fallback onHybrid Scan (Light Engines) for physical computers with low hardwareperformance.

– Local Scan (with Full Engines) for physical computerswith high hardwareperformance.

– Central Scan in Private Cloud (with Security Server) with fallback onHybrid Scan (with Light Engines) for virtualmachines. This case requiresat least one Security Server deployed in the network.

– Central Scan in Private Cloud (Security Server) with fallback on HybridScan (with Light Engines) for EC2 instances. In this case, the EC2instances will automatically connect to the Bitdefender Security Serverhosted in the corresponding AWS region.

NoteIt is recommended to use the default scan modes for EC2 instancesbecause these are specifically designed for a small footprint and lowresource consumption.

● Custom. In this case, you can configure the scanmode by choosing betweenseveral scanning technologies for physical and virtual machines:

– Central Scan in Private Cloud (with Security Server)

– Hybrid Scan (with Light Engines)

– Local Scan (with Full Engines)

– Central Scan in Private Cloud (with Security Server) with fallback* onHybrid Scan (with Light Engines)

– Central Scan in Private Cloud (with Security Server) with fallback* onLocal Scan (with Full Engines)

For EC2 instances, you can choose between the following custom scanmodes:


– Central Scan in Private cloud (with Security Server) with fallback* onHybrid Scan (with Light Engines)

– Central Scan in Private cloud (Security Server) with fallback* on LocalScan (with Full Engines)

* When using a dual engines scanning, if the first engine is unavailable, thefallback enginewill be used. Resource consumption and network utilizationwill be based on used engines.For more information regarding available scanning technologies, refer to“Scanning Engines” (p. 4)

Warning

9. Security Server Assignment.When customizing your local network's scan engines using Private Cloud(Security Server), you are required to select the locally installed security serversyouwant to use and to configure their priority underSecurity Server Assignmentsection:

● Click the Security Server list in the table header. The list of detected SecurityServers is displayed.

● Select an entity.

● Click the Add button from the Actions column header.The Security Server is added to the list.

● Follow the same steps to add several security servers, if available. In thiscase, you can configure their priority using the up and down arrowsavailable at the right side of each entity. When the first Security Server isunavailable, the next one will be used and so on.

● To delete one entity from the list, click the corresponding Delete buttonat the upper side of the table.

You can choose to encrypt the connection to Security Server by selecting theUse SSL option.For EC2 instances, the Bitdefender Security Server hosted in the correspondingAWS region is automatically assigned, so there is no need to configure theSecurity Server Assignment section.


10. SelectScan before installation if youwant tomake sure themachines are cleanbefore installing the client on them. An on-the cloud quick scanwill be performedon the target machines before starting the installation.

11. On Windows endpoints, Bitdefender Endpoint Security Tools is installed in thedefault installation directory. Select Use custom installation path if you wantto install Bitdefender Endpoint Security Tools in a different location. In thiscase, enter the desiredpath in the corresponding field. UseWindowsconventionswhen entering the path (for example, D:\folder). If the specified folder doesnot exist, it will be created during the installation.

12. If you want to, you can set a password to prevent users from removingprotection. Select Set uninstall password and enter the desired password inthe corresponding fields.

13. If the target endpoints are in Network Inventory under Custom Groups, you canchoose to move them in a specified folder immediately after the security agentdeployment finishes.Select Use custom folder and choose a folder in the corresponding table.

14. Under Deployer section, choose the entity to which the target endpoints willconnect for installing and updating the client:

● Bitdefender Cloud, if youwant to update the clients directly from the Internet.In this case, you can also define the proxy settings, if target endpointsconnect to the Internet via proxy. Select Use proxy for communication andenter the required proxy settings in the fields below.

● Endpoint Security Relay, if you want to connect the endpoints to a relayclient installed in your network. All machineswith relay role detected in yournetwork will show-up in the table displayed below. Select the relay machinethat you want. Connected endpoints will communicate with Control Centeronly via the specified relay.

ImportantPort 7074 must be open for the deployment through Bitdefender EndpointSecurity Tools Relay to work.

15. Click Save.

The new created package will be added to the list of packages.


NoteThe settings configured within an installation package will apply to endpointsimmediately after installation. As soon as a policy is applied to the client, the settingsconfigured within the policy will be enforced, replacing certain installation packagesettings (such as communication servers or proxy settings).

Downloading Installation PackagesTo download the installation packages of the security agents:

1. Log in to Control Center from the endpoint on which you want to installprotection.


3. Select the installation package you want to download.

4. Click the Download button at the upper side of the table and select the typeof installer you want to use. Two types of installation files are available:

● Downloader. The downloader first downloads the full installation kit fromthe Bitdefender cloud servers and then starts the installation. It is small insize and it can be run both on 32-bit and 64-bit systems (which makes iteasy to distribute). On the downside, it requires an active Internet connection.

● Full Kit. The full installation kits are bigger in size and they have to be runon the specific operating system type.The full kit is to be used to install protection on endpoints with slow or noInternet connection. Download this file to an Internet-connected endpoint,then distribute it to other endpoints using external storage media or anetwork share.

NoteAvailable full kit versions:

– Windows OS: 32-bit and 64-bit systems

– Linux OS: 32-bit and 64-bit systems

– Mac OS X: only 64-bit systemsMake sure to use the correct version for the system you install on.

5. Save the file to the endpoint.


WarningThe downloader executable must not be renamed, otherwise it will not be ableto download the installation files from Bitdefender server.

Send Installation Packages Download Links by EmailYoumay need to quickly informother users that an installation package is availableto download. In this case, follow the steps described hereinafter:


2. Select the installation package that you want.

3. Click the Send download links button at the upper side of the table. Aconfiguration window will appear.

4. Enter the email of each user you want to receive the installation packagedownload link. Press Enter after each email.

Please make sure that each entered email address is valid.

5. If you want to view the download links before sending them by email, click theInstallation links button.

6. Click Send. An email containing the installation link is sent to each specifiedemail address.

Running Installation PackagesFor the installation towork, the installation packagemust be run using administratorprivileges.The package installs differently on each operating system as follows:

● On Windows and MAC operating systems:

1. On the target endpoint, download the installation file from Control Centeror copy it from a network share.

2. If you have downloaded the full kit, extract the files from the archive.

3. Run the executable file.

4. Follow the on-screen instructions.

● On Linux operating systems:



2. Download or copy the installation file to the target endpoint.

3. If you have downloaded the full kit, extract the files from the archive.

4. Gain root privileges by running the sudo su command.

5. Change permissions to the installation file so that you can execute it:

# chmod +x installer

6. Run the installation file:

# ./installer

7. To check that the agent has been installed on the endpoint, run thiscommand:

$ service bd status

Once the security agent has been installed, the endpoint will show up asmanagedin Control Center (Network page) within a few minutes.

3.3.3. Remote InstallationControl Center allows you to remotely install the security agent on endpointsdetected in the network by using installation tasks.Once you have locally installed the first client with relay role, it may take a fewminutes for the rest of the network endpoints to become visible in the ControlCenter. From this point, you can remotely install the security agent on endpointsunder your management by using installation tasks from Control Center.Bitdefender Endpoint Security Tools includes an automatic network discoverymechanism that allows detecting other endpoints in the same network. Detectedendpoints are displayed as unmanaged in the Network page.

Remote Installation RequirementsFor remote installation to work:

● Bitdefender Endpoint Security Tools Relay must be installed in your network.


● Each target endpoint must allow remote connection as described herein:

– On Windows OS: the admin$ administrative share must be enabled.Configure each target workstation to use advanced file sharing.

– On Linux OS: SSH must be enabled.

– On MAC OS: remote login must be enabled.

● Temporarily turn off User Account Control on all endpoints running Windowsoperating systems that include this security feature (Windows Vista, Windows7, Windows Server 2008 etc.). If the endpoints are in a domain, you can use agroup policy to turn off User Account Control remotely.

● Disable or shutdown firewall protection on endpoints. If the endpoints are in adomain, you can use a group policy to turn off Windows Firewall remotely.

Running Remote Installation TasksTo run a remote installation task:


2. Go to the Network page.

3. Select the desired group from the left-side pane. The entities contained in theselected group are displayed in the right-side pane table.

NoteOptionally, you can apply filters to display unmanaged endpoints only. Click theFiltersmenu and select the following options: Unmanaged from the Security taband All items recursively from the Depth tab.When working with EC2 instances, you can also add the EC2 Instances option inthe Type tab, while applying all the other above mentioned criteria.

4. Select the entities (endpoints or groups of endpoints) on which you want toinstall protection.

5. Click the Tasks button at the upper side of the table and choose Install.The Install Client wizard is displayed.


Installing Bitdefender Endpoint Security Tools from the Tasks menu

6. Under Options section, configure the installation time:

● Now, to launch the deployment immediately.

● Scheduled, to set up the deployment recurrence interval. In this case, selectthe time interval that you want (hourly, daily or weekly) and configure itaccording to your needs.

NoteFor example, when certain operations are required on the target machinebefore installing the client (such as uninstalling other software and restartingthe OS), you can schedule the deployment task to run every 2 hours. The taskwill start on each target machine every 2 hours until the deployment issuccessful.

7. If you want target endpoints to automatically restart for completing theinstallation, select Automatically reboot (if needed).

8. Under the Credentials Manager section, specify the administrative credentialsrequired for remote authentication on target endpoints. You can add thecredentials by entering the user and password for each target operating system.For Linux systems you can also use a private key instead of the password.


ImportantFor Windows 8.1 stations, you need to provide the credentials of the built-inadministrator account or a domain administrator account. To learn more, referto this KB article.

To add the required OS credentials:

a. Enter the user name of an administrator account in the corresponding fieldsfrom the table header.UseWindowsconventionswhenentering the nameof a domain user account,for example, [email protected] or domain\user. To make sure thatentered credentials will work, add them in both forms ([email protected] domain\user).

NoteIf computers are in a domain, it suffices to enter the credentials of the domainadministrator.UseWindows conventionswhen entering the name of a domain user account,for example, [email protected] or domain\user. To make sure thatentered credentials will work, add them in both forms ([email protected] domain\user).

b. Select the authentication type from the menu:

● Password, to use the administrator's password.

● Upload .pem file, to use a private key.

c. If you authenticate using a password, enter the password in the field nextto the menu.

d. If you authenticate using a private key, click the Browse button and selectthe .pem file containing the corresponding private key.

e. Optionally, you can add a description that will help you identify each accountmore easily.

f. Click the Add button. The account is added to the list of credentials.


http://www.bitdefender.com/support/how-to-troubleshoot-endpoint-security-deployment-on-windows-8-1-stations-1289.html

NoteSpecified credentials are automatically saved to your Credentials Managerso that you do not have to enter them the next time. To access the CredentialsManager, just point to your username in the upper-right corner of the console.

ImportantIf the provided credentials are invalid, the client deployment will fail on thecorresponding endpoints. Make sure to update the entered OS credentials inthe Credentials Manager when these are changed on the target endpoints.

9. Select the check boxes corresponding to the accounts you want to use.

NoteAwarningmessage is displayed as long as you have not selected any credentials.This step is mandatory to remotely install the security agent on endpoints.

10. Under Deployer section, configure the relay to which the target endpoints willconnect for installing and updating the client:

● All machines with relay role detected in your network will show-up in thetable available under the Deployer section. Each new client must beconnected to at least one relay client from the same network, that will serveas communication and update server. Select the relay that you want to linkwith the target endpoints. Connected endpoints will communicate withControl Center only via the specified relay.

ImportantPort 7074 must be open, for the deployment through the relay agent to work.


● If target endpoints communicate with the relay agent via proxy, you alsoneed to define the proxy settings. In this case, select Use proxy forcommunication and enter the required proxy settings in the fields below.

11. You need to select one installation package for the current deployment. ClicktheUse package list and select the installation package that youwant. You canfind here all the installation packages previously created for your account andalso the default installation package available with Control Center.

12. If needed, you can modify some of the selected installation package's settingsby clicking the button Customize next to the Use package field.The installation package's settings will appear below and you can make thechanges that you need. To find out more about editing installation packages,refer to “Creating Installation Packages” (p. 28).If you want to save the modifications as a new package, select the Save aspackage option placed at the bottom of the package settings list, and enter aname for the new installation package.

13. Click Save. A confirmation message will appear.

You can view and manage the task in the Network > Tasks page.

3.3.4. Support for On-access Scanning on Linux VirtualMachinesThe Linux version of Bitdefender Endpoint Security Tools includes on-accessscanning capabilities thatworkwith specific Linux distributions and kernel versions.Please check the system requirements to verify how on-access scanning willfunction on your Linux machine(s). Next you will learn how to manually compilethe DazukoFS module.

Manually compile the DazukoFS moduleFollow the steps below to compile DazukoFS for the system's kernel version andthen load the module:

1. Download the proper kernel headers.

● On Ubuntu systems, run this command:

$ sudo apt-get install linux-headers-'uname -r'


● On RHEL/CentOS systems, run this command:

$ sudo yum install kernel-devel kernel-headers-'uname -r'

2. On Ubuntu systems, you need build-essential:

$ sudo apt-get install build-essential

3. Copy and extract the DazukoFS source code in a preferred directory:

# mkdir temp# cd temp# cp /opt/BitDefender/share/src/dazukofs-source.tar.gz# tar -xzvf dazukofs-source.tar.gz# cd dazukofs-3.1.4

4. Compile the module:

# make

5. Install and load the module:

# make dazukofs_install

Requirements for using on-access scanning with DazukoFS

For DazukoFS and on-access scanning to work together, a series of conditionsmust be met. Please check if any of the statements below apply to your Linuxsystem and follow the guidelines to avoid issues.

● The SELinux policy must be either disabled or set to permissive. To check andadjust the SELinux policy setting, edit the /etc/selinux/config file.

● Bitdefender Endpoint Security Tools is exclusively compatiblewith theDazukoFSversion included in the installation package. If DazukoFS is already installedon the system, remove it prior to installing Bitdefender Endpoint Security Tools.


● DazukoFS supports certain kernel versions. If the DazukoFS package shippedwith Bitdefender Endpoint Security Tools is not compatible with the system'skernel version, the module will fail to load. In such case, you can either updatethe kernel to the supported version or recompile the DazukoFSmodule for yourkernel version. You can find the DazukoFS package in the Bitdefender EndpointSecurity Tools installation directory:/opt/BitDefender/share/modules/dazukofs/dazukofs-modules.tar.gz

● When sharing files using dedicated servers such as NFS, UNFSv3 or Samba,you have to start the services in the following order:

1. Enable on-access scanning via policy from Control Center.For more information, refer to GravityZone Administrator's Guide.

2. Start the network sharing service.For NFS:

# service nfs start

For UNFSv3:

# service unfs3 start

For Samba:

# service smbd start

ImportantFor the NFS service, DazukoFS is compatible only with NFS User Server.

3.3.5. How Network Discovery WorksSecurity for Endpoints includes an automatic network discovery mechanismintended to detect workgroup computers.Security for Endpoints relies on theMicrosoft Computer Browser service to performnetwork discovery. The Computer Browser service is a networking technology usedby Windows-based computers to maintain updated lists of domains, workgroups,


and the computers within them and to supply these lists to client computers uponrequest. Computers detected in the network by the Computer Browser service canbe viewed by running the net view command in a command prompt window.

The Net view command

To enable network discovery, you must have Bitdefender Endpoint Security Toolsalready installed on at least one computer in the network. This computer will beused to scan the network.

ImportantControl Center does not use network information from Active Directory or from thenetwork map feature available in Windows Vista and later. Network map relies on adifferent network discovery technology: the Link Layer Topology Discovery (LLTD)protocol.

Control Center is not actively involved in the Computer Browser service operation.Bitdefender Endpoint Security Tools only queries the Computer Browser servicefor the list of workstations and servers currently visible in the network (known asthe browse list) and then sends it to Control Center. Control Center processes thebrowse list, appending newly detected computers to its Unmanaged Computerslist. Previously detected computers are not deleted after a new network discoveryquery, so youmust manually exclude & delete computers that are no longer on thenetwork.The initial query for the browse list is carried out by the first Bitdefender EndpointSecurity Tools installed in the network.

● If Bitdefender Endpoint Security Tools is installed on a workgroup computer,only computers from that workgroup will be visible in Control Center.

● If Bitdefender Endpoint Security Tools is installed on a domain computer, onlycomputers from that domain will be visible in Control Center. Computers from


other domains can be detected if there is a trust relationship with the domainwhere Bitdefender Endpoint Security Tools is installed.

Subsequent network discovery queries are performed regularly every hour. Foreach newquery, Control Center divides themanaged computers space into visibilityareas and then designates one Bitdefender Endpoint Security Tools in each areato perform the task. A visibility area is a group of computers that detect each other.Usually, a visibility area is defined by a workgroup or domain, but this depends onthe network topology and configuration. In some cases, a visibility area mightconsist of multiple domains and workgroups.If a selected Bitdefender Endpoint Security Tools fails to perform the query, ControlCenter waits for the next scheduled query, without choosing another BitdefenderEndpoint Security Tools to try again.For full network visibility, Bitdefender Endpoint Security Tools must be installedon at least one computer in each workgroup or domain in your network. Ideally,Bitdefender Endpoint Security Tools should be installed on at least one computerin each subnetwork.

More about the Microsoft Computer Browser ServiceQuick facts about the Computer Browser service:

● Works independent of Active Directory.

● Runs exclusively over IPv4 networks and operates independently within theboundaries of a LAN group (workgroup or domain). A browse list is compiledand maintained for each LAN group.

● Typically uses connectionless server broadcasts to communicate betweennodes.

● Uses NetBIOS over TCP/IP (NetBT).

● Requires NetBIOS name resolution. It is recommended to have a WindowsInternet Name Service (WINS) infrastructure up and running in the network.

● Is not enabled by default in Windows Server 2008 and 2008 R2.

For detailed information on the Computer Browser service, check the ComputerBrowser Service Technical Reference on Microsoft Technet.


http://technet.microsoft.com/en-us/library/cc778351%28v=ws.10%29

http://technet.microsoft.com/en-us/library/cc778351%28v=ws.10%29

Network Discovery RequirementsIn order to successfully discover all the computers (servers andworkstations) thatwill be managed from Control Center, the following are required:

● Computersmust be joined in aworkgroup or domain and connected via an IPv4local network. Computer Browser service does not work over IPv6 networks.

● Several computers in each LAN group (workgroup or domain) must be runningthe Computer Browser service. Primary Domain Controllers must also run theservice.

● NetBIOS over TCP/IP (NetBT) must be enabled on computers. Local firewallmust allow NetBT traffic.

● File sharing must be enabled on computers. Local firewall must allow filesharing.

● A Windows Internet Name Service (WINS) infrastructure must be set up andworking properly.

● For Windows Vista and later, network discovery must be turned on (ControlPanel > Network and Sharing Center > Change Advanced Sharing Settings).To be able to turn on this feature, the following services must first be started:– DNS Client– Function Discovery Resource Publication– SSDP Discovery– UPnP Device Host

● In environments with multiple domains, it is recommended to set up trustrelationships between domains so that computers can access browse listsfrom other domains.

Computers from which Bitdefender Endpoint Security Tools queries the ComputerBrowser service must be able to resolve NetBIOS names.

NoteThe network discovery mechanism works for all supported operating systems,including Windows Embedded versions, provided the requirements are met.


3.4. Installing Protection on Exchange ServersSecurity for Exchange automatically integrates with the Exchange Servers,depending on the server role. For each role only the compatible features areinstalled, as described herein:

MicrosoftExchange2010/2007Microsoft Exchange2016/2013

MailboxHubEdgeMailboxEdgeFeatures

Transport Levelxxxx

xxxx

xxxx

xxxx

Antimalware FilteringAntispam FilteringContent FilteringAttachment FilteringExchange Store

xxOn-demandantimalware scanning

3.4.1. Preparing for InstallationBefore installing Security for Exchange, make sure all requirements are met,otherwise Bitdefender Endpoint Security Tools might be installed without theExchange Protection module.For the Exchange Protection module to run smoothly and to prevent conflicts andunwanted results, remove any antimalware and email filtering agents.Bitdefender Endpoint Security Tools automatically detects and removes most ofthe antimalware products and disables the antimalware agent built in ExchangeServer since the 2013 version. For details regarding the detected security softwarelist, refer to this KB article.You can manually re-enable the built-in Exchange antimalware agent at any time,nevertheless it is not recommended to do so.


http://www.bitdefender.com/support/Removing-security-software-incompatible-with-GravityZone-Security-for-Endpoints-1123.html

3.4.2. Installing Protection on Exchange ServersTo protect your Exchange Servers, you must install Bitdefender Endpoint SecurityTools with Exchange Protection role on each of them.Youhave several options to deployBitdefender Endpoint Security Tools onExchangeServers:

● Local installation, by downloading and running the installation package on theserver.

● Remote installation, by running an Install task.

● Remote, by running theReconfigure Client task, if Bitdefender Endpoint SecurityTools already offers file system protection on the server.

For detailed installation steps, refer to “Installing Security Agents” (p. 25).

3.5. Credentials ManagerThe Credentials Manager helps you define the credentials required for remoteauthentication on different operating systems in your network.To open the Credentials Manager, click your username in the upper-right corner ofthe page and choose Credentials Manager.

The Credentials Manager menu

3.5.1. Adding Credentials to the Credentials ManagerWith the Credentials Manager you can manage the administrator credentialsrequired for remote authentication during installation tasks sent to computers andvirtual machines in your network.To add a set of credentials:


Credentials Manager

1. Enter the user name and password of an administrator account for each targetoperating system in the corresponding fields at the upper side of the tableheading. Optionally, you can add a description that will help you identify eachaccount more easily. If computers are in a domain, it suffices to enter thecredentials of the domain administrator.Use Windows conventions when entering the name of a user account:

● For ActiveDirectorymachines use these syntaxes:[email protected] domain\username. To make sure that entered credentials will work,add them in both forms ([email protected]\username).

● For Workgroup machines, it suffices to enter only the user name, withoutthe workgroup name.

2. Click the Add button at the right side of the table. The new set of credentialsis added to the table.

NoteIf you have not specified the authentication credentials, you will be required toenter themwhen you run installation tasks. Specified credentials are automaticallysaved to your Credentials Manager so that you do not have to enter them thenext time.

3.5.2. Deleting Credentials from Credentials ManagerTo delete obsolete credentials from the Credentials Manager:

1. Point to the row in the table containing the credentials you want to delete.


2. Click the Delete button at the right side of the corresponding table row. Theselected account will be deleted.


4. INTEGRATIONSAs Bitdefender customer using Control Center to manage the security of yourcompany, you have the possibility to integrate Control Center with third partysolutions, such as Amazon EC2 Services.You can configure your third-party solutions integration in the Integrations page,which you can access by pointing to your username in the upper-right corner ofthe console and choosing Integrations.

4.1. Integrating with ConnectWiseControl Center provides a specific integration functionality for partners withConnectWise accounts, allowing to efficientlymonitor Bitdefender security servicesdelivered to customer companies via ConnectWise platform, based on automatedticketing and billing procedures.For a complete guidance on how to integrate GravityZone Control Center withConnectWise, refer to the ConnectWise Integration Guide.

4.2. Integrating with Amazon EC2 Services

4.2.1. About Amazon EC2 Integration in Control CenterFrom GravityZone Control Center, administrators are enabled to integrate with theAmazon Elastic Compute Cloud (EC2) service and centrally deploy, manage andmonitor Bitdefender security on their instance inventory. Proprietary scanningservers are hosted by Bitdefender in the AWS Cloud to ensure an optimal footprinton the protected instances and to eliminate the scanning overhead occurring withtraditional security software.

Integrations 50

http://download.bitdefender.com/SMB/Cloud/GravityZone/en_US/Bitdefender_ConnectWiseIntegration_PartnersGuide_enUS.pdf

Bitdefender Control Center manages Amazon EC2 instances through dedicatedfeatures, such as:

● Integrated EC2 inventory grouped by Amazon regions and Availability Zones.Once the Amazon EC2 integration has been configured, the Amazon instancesbelonging to the provided user account credentials are imported in ControlCenter under the network inventory. A custom Amazon EC2 group will bedisplayed, containing all the Amazon regions and their Availability Zones, whichcontain instances.You can differentiate between online and offline instances by their icon:

– Offline instances

– Online instances

● Specific EC2 filtering in the network view:

– Filtering endpoints by EC2 instances type

– Filtering endpoints byEC2 tagsdefined in yourAmazonmanagement console

– Filtering EC2 instances by their power status (running, stopped, terminated)

● Automatic (default) scan modes for EC2 instances set on Central Scan withBitdefender Security Server hosted in the corresponding AWS region, withfallback on Hybrid Scan (with Light Engines using in-the-cloud scanning and,partially, the local signatures).

NoteIt is recommended to use the default scan modes for EC2 instances becausethese are specifically designed for a small footprint and low resourceconsumption.For instanceswith powerful resources, you can also configure the EC2 instancesto use Private cloud scanning with Bitdefender Security Server hosted in thecorresponding AWS region, with fallback on Local Scanning (Full Engines usingsignatures and engines stored locally).

● Grouping terminated instances in a specific folder of the network tree. Previouslymanaged (protected) instances that were terminated from the Amazonmanagement console are stored under Terminated Managed Instances groupplaced in Amazon EC2 folder. You can still obtain information about theseinstances via reports. If no longer needed, terminated instances can be deletedfrom the network inventory.

Integrations 51

4.2.2. Configuring the Amazon EC2 Integration in ControlCenterSecurity for AmazonWebServices integration requires the access key ID and secretaccess key of your AWS account or of an AWS Identity and Access Management(IAM) user.To configure your Amazon EC2 integration:


2. Click your username in the upper-right corner of the console and chooseIntegrations. The integrations page will show up.

3. Click the Add button at the upper side of the table.

4. Click the Add Amazon EC2 Integration link. A configurationwindowwill appear.

5. Enter your Amazon user access keys in the available fields.

NoteIt is recommended to set up integrationwith your AWS account using the accesskey of an IAM user created specifically for this purpose.Your Amazon user linked to the provided credentialsmust have at least read-onlyrights on Amazon EC2.

6. Click Save.

7. The AWS License Agreement is displayed. You must read and agree with thelicense terms to be able to continue.

8. Control Center will check if the provided AWS keys are valid. If so, your Amazoninstances will be imported in Control Center and the integration is done.From this point, you can view and manage your Amazon instances from theNetwork page, under Custom Groups > Amazon EC2 node. Here, your AmazonEC2 instances are grouped under their Amazon regions and the correspondingAvailability Zones. Control Center automatically synchronizes with AmazonEC2 inventory every 15 minutes. You can also manually synchronize withAmazon inventory using the Synchronize with Amazon EC2 button placed atthe upper side of the Network page.If the provided Amazon access credentials are not valid, you will be notifiedand prompted to enter them again.

Integrations 52

4.2.3. Subscribing to Security for Amazon Web ServicesAs a direct Bitdefender customer, you can anytime configure your Security forAmazon Web Services from the Integrations page.Once the Amazon EC2 Integration has been configured, you will start to use thisservice in trial mode for 30 days. You will receive by email a confirmation of yoursubscription for 30-days trial of your Amazon EC2 services. During the trial period,you will be able to fully protect and manage any number of instances using thesecurity services available with GravityZone Control Center.If you want to continue using this service after the trial period, you will need tolicense your AWS subscription by authorizing payments to Bitdefender from yourAmazon Payments account. This is a one-time operation during your credit cardvalidity period and it fulfills two functions: licensing of your AWS subscription andpayment authorization with your Amazon Payments account for subsequentmonthly billing.After licensing your AWS subscription, you will be charged monthly based on yourusage.

WarningIf you do not subscribewithin the trial period, yourmanaged instanceswill be expiredafter 30 days from your subscription and they will no longer be protected.

Licensing your AWS Subscription



3. Under the AWS Subscription section, click the Pay with Amazon widget.

4. You will be redirected to the Amazon Sign In page. Log in using your AmazonPayments account.

NoteYou must configure your browser to accept third-party cookies for the Amazonwidget to work.

Integrations 53

5. Configure your Amazon Payment method by selecting a valid credit card andenabling the optionUsemy selected paymentmethod for future purchases andpayments to this merchant.

6. Click Save. Your AWS subscription is now Licensed.

NoteIf the selected credit card has expired, you will need to re-license your AWSsubscription by following the above-mentioned steps.

Cancelling your AWS SubscriptionYou can cancel your AWS subscription, at any time, directly from your ControlCenter company account. When you cancel your AWS subscription:

● All the Bitdefender security agents installed on your instances are expired andthose instances remain unprotected immediately.

● The payment authorization for your subscription on Amazon Payments isautomatically canceled. However, you will be charged for your current monthusage, up to the time when you unsubscribe.

To unsubscribe:



3. Under the AWS Subscription section, click the Cancel Subscription button.

4. You will have to confirm your action by clicking Yes. Your AWS subscription isnow Canceled.

You can anytime subscribe again to the service by following the licensingprocedure.

Editing your AWS Subscription



3. Under the AWS Subscription section, click the Pay with Amazon widget.

4. Log in using your Amazon Payments account.

Integrations 54

5. Make the changes that you need.

6. Click Save.

NoteAfter editing your AWS Subscription, you will receive two emails from AmazonPayments, which will confirm the cancellation of the previous authorization and thesetting-up of a new payment method.

4.3. Removing IntegrationsTo remove an integration you no longer need:

1. In the Integrations page, select the check box corresponding to the solutionyou want to remove.

2. Click the Delete button at the upper side of table. After confirming the action,the selected integration will be removed from Control Center.

ImportantAfter deleting an integration, all your clients installed on the correspondingplatform will be expired, meaning that they will no longer communicate withBitdefender Cloud Services and Control Center and they will be removed fromControl Center.

Integrations 55

5. GETTING HELPBitdefender strives to provide its customers with an unparalleled level of fast andaccurate support. If you experience any issue with or if you have any questionabout your Bitdefender product, go to our online Support Center. It provides severalresources that you can use to quickly find a solution or an answer. Or, if you prefer,you can contact the Bitdefender Customer Care team. Our support representativeswill answer your questions in a timely manner and they will provide you with theassistance you need.

NoteYou can find out information about the support services we provide and our supportpolicy at the Support Center.

5.1. Bitdefender Support CenterBitdefender Support Center is the place where you will find all the assistance youneed with your Bitdefender product.You can use several resources to quickly find a solution or an answer:

● Knowledge Base Articles

● Bitdefender Support Forum

● Product Documentation

You can also use your favorite search engine to find out more information aboutcomputer security, the Bitdefender products and the company.

Knowledge Base ArticlesThe Bitdefender Knowledge Base is an online repository of information about theBitdefender products. It stores, in an easily accessible format, reports on the resultsof the ongoing technical support and bugfixing activities of the Bitdefender supportand development teams, along with more general articles about virus prevention,the management of Bitdefender solutions with detailed explanations, and manyother articles.The Bitdefender Knowledge Base is open to the public and freely searchable. Theextensive information it contains is yet another means of providing Bitdefendercustomers with the technical knowledge and insight they need. All valid requestsfor information or bug reports coming fromBitdefender clients eventually find their

Getting Help 56

http://www.bitdefender.com/support/business.html


way into the Bitdefender Knowledge Base, as bugfix reports, workaroundcheatsheets or informational articles to supplement product helpfiles.The Bitdefender Knowledge Base for business products is available any time athttp://www.bitdefender.com/support/business.html.

Bitdefender Support ForumThe Bitdefender Support Forum provides Bitdefender users with an easy way toget help and to help others. You can post any problem or question related to yourBitdefender product.Bitdefender support techniciansmonitor the forum for new posts in order to assistyou. Youmay also get an answer or a solution fromamore experiencedBitdefenderuser.Before posting your problem or question, please search the forum for a similar orrelated topic.The Bitdefender Support Forum is available at http://forum.bitdefender.com, in 5different languages: English, German, French, Spanish and Romanian. Click theBusiness Protection link to access the section dedicated to business products.

Product DocumentationProduct documentation is the most complete source of information about yourproduct.You can check and download the latest version of documentation for Bitdefenderbusiness products at Support Center, in the Documentation section available oneach product support page.

5.2. Asking for AssistanceYou can contact us for assistance through our online Support Center:

1. Go to http://www.bitdefender.com/support/contact-us.html.

2. Use the contact form to open an email support ticket or access other availablecontact options.

5.3. Using Support ToolThe GravityZone Support Tool is designed to help users and support technicianseasily obtain the information needed for troubleshooting. Run the Support Tool on

Getting Help 57


http://forum.bitdefender.com


http://www.bitdefender.com/support/contact-us.html

affected computers and send the resulting archive with the troubleshootinginformation to the Bitdefender support representative.

5.3.1. Using Support Tool on Windows Operating Systems1. Download the Support Tool and distribute it to the affected computers. To

download the Support Tool:

a. Connect to Control Center using your account.

b. Click the Help and Support link in the lower-left corner of the console.

c. The download links are available in the Support section. Two versions areavailable: one for 32-bit systems and the other for 64-bit systems. Makesure to use the correct versionwhen running the Support Tool on a computer.

2. Run the Support Tool locally on each of the affected computers.

a. Select the agreement check box and click Next.

b. Complete the submission form with the necessary data:

i. Enter your email address.

ii. Enter your name.

iii. Choose your country from the corresponding menu.

iv. Enter a description of the issue you encountered.

v. Optionally, you can try to reproduce the issue before starting to collectdata. In this case, proceed as follows:

A. Enable the option Try to reproduce the issue before submitting.

B. Click Next.

C. Select the type of issue you have experienced.

D. Click Next.

E. Reproduce the issue on your computer.When done, return to SupportTool and select the option I have reproduced the issue.

c. ClickNext. TheSupport Tool gathers product information, information relatedto other applications installed on themachine and the software andhardwareconfiguration.

d. Wait for the process to complete.

Getting Help 58

e. Click Finish to close the window. A zip archive has been created on yourdesktop.Send the zip archive together with your request to the Bitdefender supportrepresentative using the email support ticket form available in theHelp andSupport page of the console.

5.3.2. Using Support Tool on Linux Operating SystemsFor Linux operating systems, the Support Tool is integrated with the Bitdefendersecurity agent.To gather Linux system information usingSupport Tool, run the following command:

# /opt/BitDefender/bin/bdconfigure

using the following available options:

● --help to list all Support Tool commands

● enablelogs to enable product and communication module logs (all serviceswill be automatically restarted)

● disablelogs to disable product and communicationmodule logs (all serviceswill be automatically restarted)

● deliverall to create an archive containing the product and communicationmodule logs, delivered to the /tmp folder in the following format:bitdefender_machineName_timeStamp.tar.gz.

1. You will be prompted if you want to disable logs. If needed, the services areautomatically restarted.

2. You will be prompted if you want to delete logs.

● deliverall -default delivers the same information as with the previousoption, but default actionswill be taken on logs, without the user to be prompted(the logs are disabled and deleted).

To report a GravityZone issue affecting your Linux systems, follow the next steps,using the options previously described:

1. Enable product and communication module logs.

2. Try to reproduce the issue.

Getting Help 59

3. Disable logs.

4. Create the logs archive.

5. Open an email support ticket using the form available on the Help & Supportpage of Control Center, with a description of the issue and having the logsarchive attached.

The Support Tool for Linux delivers the following information:

● The etc, var/log, /var/crash (if available) and var/epag folders from/opt/BitDefender, containing the Bitdefender logs and settings

● The /tmp/bdinstall.log file, containing installation information

● The network.txt file, containing network settings / machine connectivityinformation

● The system.txt file, containing general system information (distribution andkernel versions, available RAM and free hard-disk space)

● The users.txt file, containing user information

● Other information concerning the product related to the system, such as externalconnections of processes and CPU usage

● System logs

5.3.3. Using Support Tool on Mac Operating SystemsWhen sumbitting a request to the Bitdefender Technical Support Team, you needto provide the following:

● A detailed description of the issue you are encountering.

● A screenshot (if applicable) of the exact error message that appears.

● The Support Tool log.

To gather Mac system information using Support Tool:

1. Download the ZIP archive containing the Support Tool.

2. Unzip the archive. This will extract the BDProfiler.tool file.

3. Open a Terminal window.

4. Navigate to the location of the BDProfiler.tool file.

Getting Help 60

http://www.bitdefender.com/files/KnowledgeBase/file/Support_Tool_MACOS.zip

For example:

cd /Users/Bitdefender/Desktop;

5. Add execute permissions to the file:

chmod +x BDProfiler.tool;

6. Run the tool.For example:

/Users/Bitdefender/Desktop/BDProfiler.tool;

7. Press Y and enter the password when asked to provide the administratorpassword.Wait for a couple of minutes until the tool finishes generating the log. You willfind the resulted archive file (Bitdefenderprofile_output.zip) in the same folderwith the tool.

5.4. Contact InformationEfficient communication is the key to a successful business. During the past 10years Bitdefender has established an unquestionable reputation by constantlystriving for better communication so as to exceed the expectations of our clientsand partners. Should you have any questions, do not hesitate to contact us.

5.4.1. Web AddressesSales Department: [email protected] Center: http://www.bitdefender.com/support/business.htmlDocumentation: [email protected] Distributors: http://www.bitdefender.com/partnersPartner Program: [email protected] Relations: [email protected] Submissions: [email protected] Submissions: [email protected] Abuse: [email protected]

Getting Help 61




http://www.bitdefender.com/partners






5.4.2. Local DistributorsThe Bitdefender local distributors are ready to respond to any inquiries regardingtheir areas of operation, both in commercial and in general matters.To find a Bitdefender distributor in your country:

1. Go to http://www.bitdefender.com/partners.

2. Go to Partner Locator.

3. The contact information of theBitdefender local distributors should be displayedautomatically. If this does not happen, select the country you reside in to viewthe information.

4. If you do not find a Bitdefender distributor in your country, feel free to contactus by email at [email protected].

5.4.3. Bitdefender OfficesThe Bitdefender offices are ready to respond to any inquiries regarding their areasof operation, both in commercial and in generalmatters. Their respective addressesand contacts are listed below.

United StatesBitdefender, LLCPO Box 667588Pompano Beach, Fl 33066United StatesPhone (sales&technical support): 1-954-776-6262Sales: [email protected]: http://www.bitdefender.comSupport Center: http://www.bitdefender.com/support/business.html

FrancePROFIL TECHNOLOGY49, Rue de la Vanne92120 MontrougeFax: +33 (0)1 47 35 07 09Phone: +33 (0)1 47 35 72 73Email: [email protected]: http://www.bitdefender.fr

Getting Help 62

http://www.bitdefender.com/partners






http://www.bitdefender.fr

Support Center: http://www.bitdefender.fr/support/professionnel.html

SpainBitdefender España, S.L.U.Avda. Diagonal, 357, 1º 1ª08037 BarcelonaEspañaFax: (+34) 93 217 91 28Phone (office&sales): (+34) 93 218 96 15Phone (technical support): (+34) 93 502 69 10Sales: [email protected]: http://www.bitdefender.esSupport Center: http://www.bitdefender.es/support/business.html

GermanyBitdefender GmbHAirport Office CenterRobert-Bosch-Straße 259439 HolzwickedeDeutschlandPhone (office&sales): +49 (0)2301 91 84 222Phone (technical support): +49 (0)2301 91 84 444Sales: [email protected]: http://www.bitdefender.deSupport Center: http://www.bitdefender.de/support/business.html

UK and IrelandGenesis Centre Innovation WayStoke-on-Trent, StaffordshireST6 4BFUKPhone (sales&technical support): (+44) 203 695 3415Email: [email protected]: [email protected]: http://www.bitdefender.co.ukSupport Center: http://www.bitdefender.co.uk/support/business.html

Getting Help 63

http://www.bitdefender.fr/support/professionnel.html


http://www.bitdefender.es

http://www.bitdefender.es/support/business.html


http://www.bitdefender.de

http://www.bitdefender.de/support/business.html



http://www.bitdefender.co.uk

http://www.bitdefender.co.uk/support/business.html

RomaniaBITDEFENDER SRLDV24 Offices, Building A24 Delea Veche Street024102 Bucharest, Sector 2Fax: +40 21 2641799Phone (sales&technical support): +40 21 2063470Sales: [email protected]: http://www.bitdefender.roSupport Center: http://www.bitdefender.ro/support/business.html

United Arab EmiratesBitdefender FZ-LLCDubai Internet City, Building 17Office # 160Dubai, UAEPhone (sales&technical support): 00971-4-4588935 / 00971-4-4589186Fax: 00971-4-44565047Sales: [email protected]: http://www.bitdefender.com/worldSupport Center: http://www.bitdefender.com/support/business.html

Getting Help 64


http://www.bitdefender.ro

http://www.bitdefender.ro/support/business.html


http://www.bitdefender.com/world


Documents

GravityZone - BITDEFENDER FOR MALAYSIA · Bitdefender GravityZone Installation Guide Publicationdate2016.07.21 ... OS LocalScanning HybridScanning CentralizedScanning Full Options