Bitdefender GravityZone Security Data Lake

Why do you need a security data lake?

An incident leaves traces in five places, and the team reviews them in five consoles. Firewall, domain controller, cloud and endpoint logs all exist, but each in its own format and with its own retention; when you need to establish what happened the week before detection, some of the data is already gone and the rest has to be pieced together by hand, after the fact. A classic SIEM solves this at the price of a separate platform, rules to maintain and a fee for every gigabyte.

Bitdefender GravityZone Security Data Lake is an add-on to the GravityZone console that combines SIEM functions with data lake storage: it collects logs from endpoints, networks, cloud and third-party tools, normalises them into a common schema, correlates them with GravityZone telemetry and keeps them in retention tiers so that data for investigations and audits stays available without paying the full cost of live searching.

How does it work?

Collection and normalisation

Sources forward logs to the platform: the GravityZone agent delivers workstation and server telemetry, while third-party tools, applications and cloud services send their events through ready integrations or generic channels such as Syslog. Every event is parsed into a common schema, so a firewall entry and an EDR entry can be set side by side in one query without writing translators.

Retention tiers and restore

Data lands in hot, warm and archive tiers. What is current is available for immediate searching; less critical logs go to the cheaper warehouse instead of loading the live tier. When an investigation or an audit reaches back in time, archived data is restored selectively - only the range and the sources that are needed. Retention stops being a trade-off between cost and what the team would like to be able to check six months from now.

Correlation, prioritisation and response

Normalised events are correlated with GravityZone telemetry, and the Asset Risk Model - based on directory and vulnerability assessment integrations - assigns a risk score to assets and incidents. New incidents queue up according to that score, so the analyst starts with what concerns the most critical assets. Dashboards and alerts show the state of the environment, and if the organization uses Bitdefender MDR, the vendor’s analysts work on the same data.

Key features

Data sources

• GravityZone telemetry from workstations and servers
• Third-party tool logs through ready integrations
• Generic channels (e.g. Syslog) for sources outside the integration list
• Firewalls: Palo Alto, Check Point, Cisco ASA, Fortinet, Juniper, pfSense, SonicWall

Storage and search

• Normalisation into a common schema on ingest
• Hot, warm and archive tiers with separate retention rules
• Selective restore of archived data for investigations or audits
• Automated log management with flexible retention for compliance requirements

Analysis and prioritisation

• Correlation of events from many sources in one place
• Asset Risk Model: risk score for assets and incidents, alert noise reduction
• Dashboards and alerts in the GravityZone console
• Enriched context for Bitdefender MDR analysts: third-party data in investigations and threat hunting

Security Data Lake versus XDR and EDR

Security Data Lake is a layer above GravityZone XDR, not its replacement. XDR correlates telemetry from Bitdefender’s own sensors and builds incidents from it; the data lake adds the logs of everything that has no GravityZone agent - firewalls, switches, applications, cloud services - and keeps them longer than detection alone requires. The EDR, XDR and SIEM comparison table is on the XDR page; here one thing matters: if the question is “what else do we see beyond endpoints and how long do we keep it”, the answer is the data lake.

Requirements and licensing

Model: a separate add-on to cloud-based GravityZone licences. The vendor lists Business Security Premium, Business Security Enterprise and the Bitdefender MDR, MDR Plus, MXDR and MXDR Plus services as the base (for the services, the MDR base licence is required).

Exclusion: the add-on cannot be purchased for GravityZone EDR Cloud - this is the only explicit exclusion on the vendor’s page and worth checking before a budget is planned.

Sources: the list of ready integrations grows; for sources outside it, the generic channel remains. Which of your systems have an integration and which will go through Syslog is established by an nFlo sales representative before quoting.

Who is it for?

• Organizations standardising on GravityZone - logs from beyond the endpoints in the same console, with no separate SIEM to maintain
• Bitdefender MDR customers - the vendor’s analysts see firewalls and cloud, not just workstations
• Essential and important entities under the KSC Act - retention and the ability to reconstruct the course of events for reporting and audits
• Companies with a limited SOC team - prioritisation by asset risk instead of an alert queue; where a 24/7 team on a heterogeneous stack is needed, the nFlo SOC complements it

How does GravityZone Security Data Lake support NIS2 and the KSC Act?

In the NIS2/KSC Act map, Security Data Lake is the data layer: what monitoring rests on and what incident documentation is built from - two of the twelve areas of Article 21 of NIS2 and Article 8 of the Polish National Cybersecurity System Act (KSC Act) whose full mapping we describe in our article on how GravityZone supports NIS2 and the KSC Act:

• Continuous monitoring and threat detection - firewall, cloud and application logs land in one normalised set next to GravityZone telemetry; correlation and the Asset Risk Model show which events concern critical assets, and dashboards and alerts give evidence that the whole environment is observed, not only the endpoints.
• Incident management and response - tiered retention and selective archive restore make it possible to reconstruct the course of an event even from weeks earlier; the same data set yields the material for the incident report and for the post-incident review.

Which of these areas is your gap is what we establish in the NIS2 Readiness Check service.

Who is in scope, deadlines and penalties are covered in our NIS2 knowledge hub. GravityZone does not replace an ISMS, formal risk management, audits or the organization’s own accountability for NIS2 and KSC Act obligations - it supports their technical side.

Why deploy with nFlo?

• We check whether your GravityZone licence allows the add-on before anyone calculates a budget
• We inventory the log sources and select integrations or Syslog channels for each of them
• We set retention rules for reporting and audit requirements, not for default values
• We combine the data lake with the nFlo SOC where a team of analysts is needed on the whole stack, not only on GravityZone