[Idea] Add support for Bitdefender Endpoint Security #711

perplexityjeff · 2024-07-11T09:31:25Z

perplexityjeff
Jul 11, 2024

Your idea

Currently it does not seem to support Bitdefender Endpoint Security information retrieval. It would be nice if the GLPI agent could support the retrieval of this information.

However the product has a command line which outputs the information you want and possibly can use 🥳:

Installation located in: C:\Program Files\Bitdefender\Endpoint Security

Retrieve the antivirus version: product.console.exe /c GetVersion product
Retrieve the signature database version: product.console.exe /c GetVersion antivirus

Its also possible to retrieve the update status using the GetUpdateStatus function

For more information https://www.bitdefender.com/business/support/en/77209-36849-using-the-command-line-interface.html

Thank you,

Jeff

g-bougard · 2024-07-11T12:32:12Z

g-bougard
Jul 11, 2024
Maintainer

Hello @perplexityjeff

indeed BitDefender is still supported by the agent, see:

glpi-agent/lib/GLPI/Agent/Task/Inventory/Win32/AntiVirus.pm

Line 404 in 89fdc0d

sub _setBitdefenderInfos {

Here are 2 possible reasons why it is not inventoried in your case:

our inventory method is outdated
you're running on a Windows Server. And in that case, WMI objects related to installed AV are not available.

Can you share the output of the following command run from an administrative console and from the agent installation folder ?
You can of course obfuscate any sensible data from the output.

glpi-inventory --debug --debug --partial antivirus

0 replies

perplexityjeff · 2024-07-11T12:36:49Z

perplexityjeff
Jul 11, 2024
Author

Hi @g-bougard,

Here is the output from an endpoint (not a server), which is were I found the issue originally.

[debug] Running GLPI::Agent::Task::Inventory::Win32::AntiVirus
[debug] Found Bitdefender Endpoint Security Tools Antimalware (state=0x41000)
[debug2] Added Bitdefender Endpoint Security Tools Antimalware
[debug] Found Windows Defender (state=0x60100)
[debug2] Added Windows Defender
[debug] Running GLPI::Agent::Task::Inventory::Win32::Chassis
{
   "action": "inventory",
   "content": {
      "antivirus": [
         {
            "enabled": true,
            "guid": "{C967C14B-D2D7-2194-E177-0073E88DFFC1}",
            "name": "Bitdefender Endpoint Security Tools Antimalware",
            "uptodate": true
         },
         {
            "base_version": "1.409.482.0",
            "company": "Microsoft Corporation",
            "enabled": false,
            "guid": "{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}",
            "name": "Windows Defender",
            "uptodate": true
         }
      ],
      "bios": {
         "bdate": "<HIDDEN>",
         "bmanufacturer": "American Megatrends Inc.",
         "bversion": "P5.80",
         "mmanufacturer": "ASRock",
         "mmodel": "AB350M Pro4"
      },
      "hardware": {
         "chassis_type": "Desktop",
         "memory": 16315,
         "name": "<HIDDEN>",
         "uuid": "6BC28570-7C7A-0000-0000-000000000000",
         "vmsystem": "Physical",
         "winlang": "2057",
         "winowner": "<HIDDEN>",
         "winprodid": "00330-80000-00000-AA240",
         "winprodkey": "<HIDDEN>",
         "workgroup": "<HIDDEN>"
      },
      "versionclient": "GLPI-Inventory_v1.10"
   },
   "deviceid": "<HIDDEN>-2024-07-11-14-34-22",
   "itemtype": "Computer",
   "partial": true
}
[info] Inventory dumped on standard output

0 replies

perplexityjeff · 2024-07-11T12:39:52Z

perplexityjeff
Jul 11, 2024
Author

Here is the output from a server.

[debug] Running GLPI::Agent::Task::Inventory::Win32::Chassis
{
   "action": "inventory",
   "content": {
      "bios": {
         "assettag": "<HIDDEN>",
         "bdate": "<HIDDEN>",
         "bmanufacturer": "Microsoft Corporation",
         "bversion": "Hyper-V",
         "mmanufacturer": "Microsoft Corporation",
         "mmodel": "Virtual Machine",
         "msn": "<HIDDEN>",
         "smanufacturer": "Microsoft Corporation",
         "smodel": "Virtual Machine",
         "ssn": "<HIDDEN>"
      },
      "hardware": {
         "chassis_type": "Desktop",
         "memory": 16383,
         "name": "<HIDDEN>",
         "uuid": "CEBAE258-0769-407D-B0BF-3A0B601F8FC9",
         "vmsystem": "Hyper-V",
         "winlang": "1033",
         "winowner": "<HIDDEN>",
         "winprodid": "00377-80000-00000-AA539",
         "winprodkey": "<HIDDEN>",
         "workgroup": "<HIDDEN>"
      },
      "versionclient": "GLPI-Inventory_v1.10"
   },
   "deviceid": "<HIDDEN>-2024-07-11-14-37-17",
   "itemtype": "Computer",
   "partial": true
}
[info] Inventory dumped on standard output

0 replies

g-bougard · 2024-07-11T14:40:52Z

g-bougard
Jul 11, 2024
Maintainer

So you should see it on Windows Desktop assets. But I agree, some datas may be missing.

It seems you have nothing in registry under HKEY_LOCAL_MACHINE/SOFTWARE/BitDefender/About. They probably changed their installation process. Can you share an export of HKEY_LOCAL_MACHINE/SOFTWARE/BitDefender ?

Otherwise, can you share outputs of the commands you think we can use ?

For the Windows Server case, I implemented a service based detection but it have to be updated for BitDefender. On the related server, can you check the output of wmic path Win32_Service get /format:list and share the entries related to BitDefender ?

0 replies

perplexityjeff · 2024-07-12T06:18:26Z

perplexityjeff
Jul 12, 2024
Author

Hi @g-bougard,

There is no 'About' folder that I can find in the registry when searching for Bitdefender however here is the registry output from an endpoint device (not a server).

Here is an export of Bitdefender installed on an endpoint (not a server). Please note the install version in the file is not my current version rather the version which I at the time installed: https://imds.stackstorage.com/s/53GXh6paO5LBhoXy

Here is the output of the commands using the product.console.exe found in C:\Program Files\Bitdefender\Endpoint Security. It just outputs text with the information as the link above states. Worth noting that this (in my case) also works on a server:

The installed product version:

The installed AV database version:

Current update status of product version:

Current update status of AV database version:

Here is an export of the services related to Bitdefender installed on a server using the command you mentioned:
https://imds.stackstorage.com/s/zm1XoKVLt0r5gRrW

Thank you,

Jeff

0 replies

g-bougard · 2024-07-12T12:13:45Z

g-bougard
Jul 12, 2024
Maintainer

Hi @perplexityjeff

thank you for the shared datas.

I tried to update Bitdefender support and include Windows Server OS support in the last commit.

You can test the development build using the Windown-Build-x64 artifact archive from this GH Actions build: https://github.com/glpi-project/glpi-agent/actions/runs/9905997671
Or you can wait for next nightly build.

I saw in the documentation you linked this AV can also be installed on linux & MacOS. Do you have such kind of device with the AV installed to see if we can also add the support for these OS ?

0 replies

perplexityjeff · 2024-07-15T06:46:26Z

perplexityjeff
Jul 15, 2024
Author

Hi @g-bougard,

Thank you for the update. I've just tried nightly and here is the update from my end on both a client and a server.

On a client:

[Mon Jul 15 08:27:16 2024][debug] Running GLPI::Agent::Task::Inventory::Win32::AntiVirus
[Mon Jul 15 08:27:16 2024][debug2] Looking for AntiVirusProduct class WMI objects
[Mon Jul 15 08:27:16 2024][debug2] Looking for AntiVirusProduct class WMI objects
[Mon Jul 15 08:27:16 2024][debug] Found Bitdefender Endpoint Security Tools Antimalware (state=0x41000)
[Mon Jul 15 08:27:16 2024][debug2] executing "C:\Program Files\Bitdefender\Endpoint Security\product.console.exe" /c GetVersion product
[Mon Jul 15 08:27:17 2024][debug2] executing "C:\Program Files\Bitdefender\Endpoint Security\product.console.exe" /c GetVersion antivirus
[Mon Jul 15 08:27:17 2024][debug2] Added Bitdefender Endpoint Security Tools Antimalware v7.9.13.423

The duplicate is interesting but I am not bothered by it just letting you know what I am seeing.

On a server:

[Mon Jul 15 08:32:14 2024][debug] Running GLPI::Agent::Task::Inventory::Win32::AntiVirus
[Mon Jul 15 08:32:14 2024][debug2] Win32::OLE ERROR: Invalid namespace
[Mon Jul 15 08:32:14 2024][debug2] Looking for AntiVirusProduct class WMI objects
[Mon Jul 15 08:32:14 2024][debug2] Looking for Win32_Service class WMI objects
[Mon Jul 15 08:32:15 2024][debug2] executing "C:\Program Files\Bitdefender\Endpoint Security\product.console.exe" /c GetVersion product
[Mon Jul 15 08:32:16 2024][debug2] executing "C:\Program Files\Bitdefender\Endpoint Security\product.console.exe" /c GetVersion antivirus
[Mon Jul 15 08:32:16 2024][debug2] executing "C:\Program Files\Bitdefender\Endpoint Security\product.console.exe" /c GetUpdateStatus product
[Mon Jul 15 08:32:16 2024][debug2] executing "C:\Program Files\Bitdefender\Endpoint Security\product.console.exe" /c GetUpdateStatus antivirus
[Mon Jul 15 08:32:16 2024][debug2] Added Bitdefender Endpoint Security v7.9.13.423

Looks good to me! I'll create an Ubuntu VM for you to install Bitdefender on and let you know what I can find. MacOS is a bit harder for me as I have no experience in it but [joke] if you send me 1500 euros I'll buy a MacBook for myself to test [joke].

I'll let you know if I have an update regarding the product installed on Ubuntu. Thank you thus far for adding the support. ;)

1 reply

g-bougard Jul 15, 2024
Maintainer

Hi @perplexityjeff

thank you for your feedback. I'm really happy to see your AV correctly detected on Windows Server.

For the duplicate on Windows Desktop, this may be a server-side problem. Don't forget to upgrade your glpi server, latest is currently 10.0.16. I tried myself on a 10.0.16 test instance and the AV is replaced as expected. But I only tried with guessed json. Can you generate a partial json on a Windows Desktop like you did before ? We have a deduplication algorithm agent-side during inventory but it is based on name & version. As before you didn't have version, maybe something is still wrong agent-side and the partial inventory will tell us if the error is agent-side or server-side.

MacOS is a bit harder for me as I have no experience in it but [joke] if you send me 1500 euros I'll buy a MacBook for myself to test [joke].

Can I suggest you to find that 1500 euros, buy the machine, make the tests and finally donate it to the project (me for instance) in few months so it will help me to enhance MacOS support 😉

perplexityjeff · 2024-07-15T11:34:53Z

perplexityjeff
Jul 15, 2024
Author

Hi @g-bougard,

Here are the results when running the installed endpoint on Ubuntu. It seems that the default installation path is /opt/bitdefender-security-tools/. /bin after that is where the application it uses is located.

I think the easiest would be for you to perform the following command sudo ./bduitool get ps. This command returns the current versions of the engine and the product as well as if it is up to date.

Also about the duplication thing on the Windows client; I am running 10.0.16 server of GLPI. Please see attached the information you requested from the command.

[debug] Running GLPI::Agent::Task::Inventory::Win32::AntiVirus
[debug] Found Bitdefender Endpoint Security Tools Antimalware (state=0x41000)
[debug2] executing "C:\Program Files\Bitdefender\Endpoint Security\product.console.exe" /c GetVersion product
[debug2] executing "C:\Program Files\Bitdefender\Endpoint Security\product.console.exe" /c GetVersion antivirus
[debug2] Added Bitdefender Endpoint Security Tools Antimalware v7.9.13.423
[debug] Found Windows Defender (state=0x60100)
[debug2] Added Windows Defender
[debug] Running GLPI::Agent::Task::Inventory::Win32::Chassis
{
   "action": "inventory",
   "content": {
      "antivirus": [
         {
            "base_version": "7.97156",
            "company": "Bitdefender",
            "enabled": true,
            "guid": "{C967C14B-D2D7-2194-E177-0073E88DFFC1}",
            "name": "Bitdefender Endpoint Security Tools Antimalware",
            "uptodate": true,
            "version": "7.9.13.423"
         },
         {
            "base_version": "1.409.482.0",
            "company": "Microsoft Corporation",
            "enabled": false,
            "guid": "{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}",
            "name": "Windows Defender",
            "uptodate": true
         }
      ],
      "bios": {
         "bdate": "2019-04-19",
         "bmanufacturer": "American Megatrends Inc.",
         "bversion": "P5.80",
         "mmanufacturer": "ASRock",
         "mmodel": "AB350M Pro4"
      },
      "hardware": {
         "chassis_type": "Desktop",
         "memory": 16315,
         "name": "<HIDDEN>",
         "uuid": "6BC28570-7C7A-0000-0000-000000000000",
         "vmsystem": "Physical",
         "winlang": "2057",
         "winowner": "<HIDDEN>",
         "winprodid": "00330-80000-00000-AA240",
         "winprodkey": "<HIDDEN>",
         "workgroup": "<HIDDEN>"
      },
      "versionclient": "GLPI-Inventory_v1.11-gitbf2b6565"
   },
   "deviceid": "<HIDDEN>-2024-07-15-13-00-15",
   "itemtype": "Computer",
   "partial": true
}
[info] Inventory dumped on standard output

If you require anything else please let me know.

[joke] I'll think about the MacOS, but I'd rather buy a Framework instead, sorry :( [joke]

Thanks,

Jeff

4 replies

g-bougard Jul 15, 2024
Maintainer

Hi @perplexityjeff

indeed, as I said, you still can test this AV inventory with current nightly build.

I'm only using /opt/bitdefender-security-tools/bin/bduitool path, this is even the condition I implemented to run this inventory part. I think I can use this default path. I should only find a way to run the command from another that if the installation process permits to install it somewhere else.

Using sudo is really not a good idea as the command can require a user interaction on wrong configuration. And in that case, it can make the inventory blocks and we don't want that to happen.

For the duplicated in GLPI, as you show, this is not the agent fault. So I don't see how to reproduce actually. Anyway, this remains a server-side issue. Since ~~v1.6~~ v1.8, the agent supports to postpone full inventory only sending partial inventory for identified changed parts. Can you try to force a full inventory to see if this resets all the installed and linked AV on the asset ? To do do, you can run from an administrative console and from the agent installation folder the following command:

glpi-agent --force --full-inventory-postpone=0

If this changes nothing, you still can remove the old mostly empty entry manually by clicking on it and selecting "Remove permanently" button. Then restart a full inventory to be sure it won't come back on next run. That not versioned entry of Bitdefender AV still remains in database because of new inventory of older agent anyway.
Finally, you may also check server-side if you have an error in GLPI php-errors.log while you submit this machine inventory.

perplexityjeff Jul 15, 2024
Author

I was sadly only able to get output on Ubuntu when using sudo in front of it but I'll test the GLPI agent and will report back!

The command you mentioned for the Windows endpoint to force a full inventory fixed the duplicate entries, thanks!

g-bougard Jul 15, 2024
Maintainer

As agent service runs with root privileges on linux, it should still obtain the expected output when running using the full path command.

perplexityjeff Jul 15, 2024
Author

Hi @g-bougard,

I've tested GLPI agent using Ubuntu and the results seem good from what I can see.

perplexityjeff · 2024-07-16T07:37:33Z

perplexityjeff
Jul 16, 2024
Author

Hi @g-bougard,

I think we can close this discussion?

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Idea] Add support for Bitdefender Endpoint Security #711

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 9 comments 5 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

Select a reply

[Idea] Add support for Bitdefender Endpoint Security #711

perplexityjeff Jul 11, 2024

Your idea

Replies: 9 comments · 5 replies

g-bougard Jul 11, 2024 Maintainer

perplexityjeff Jul 11, 2024 Author

perplexityjeff Jul 11, 2024 Author

g-bougard Jul 11, 2024 Maintainer

perplexityjeff Jul 12, 2024 Author

g-bougard Jul 12, 2024 Maintainer

perplexityjeff Jul 15, 2024 Author

g-bougard Jul 15, 2024 Maintainer

perplexityjeff Jul 15, 2024 Author

g-bougard Jul 15, 2024 Maintainer

perplexityjeff Jul 15, 2024 Author

g-bougard Jul 15, 2024 Maintainer

perplexityjeff Jul 15, 2024 Author

perplexityjeff Jul 16, 2024 Author

perplexityjeff
Jul 11, 2024

Replies: 9 comments 5 replies

g-bougard
Jul 11, 2024
Maintainer

perplexityjeff
Jul 11, 2024
Author

perplexityjeff
Jul 11, 2024
Author

g-bougard
Jul 11, 2024
Maintainer

perplexityjeff
Jul 12, 2024
Author

g-bougard
Jul 12, 2024
Maintainer

perplexityjeff
Jul 15, 2024
Author

g-bougard Jul 15, 2024
Maintainer

perplexityjeff
Jul 15, 2024
Author

g-bougard Jul 15, 2024
Maintainer

perplexityjeff Jul 15, 2024
Author

g-bougard Jul 15, 2024
Maintainer

perplexityjeff Jul 15, 2024
Author

perplexityjeff
Jul 16, 2024
Author