Gravityzone ASim parsers

[gbarbieru]

Required items, please complete

Change(s):

• Added support for Bitdefender GravityZone events in ASim parsers (ASim Alert Events)

Reason for Change(s):

• Support for upcoming Bitdefender GravityZone solution Gravityzone Solution v3.0.0 #13299

Version Updated:

• No

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

Before going into this topic I want to disclose that development in my team is done on Linux workstations and the available tooling and guides offered by Microsoft kinda lack in this department. Due to time constraints additional effort in making them work on Linux environments was abandoned and testing was eventually done on Microsoft Sentinel accounts via end-to-end testing.

• KQL: Tested using smoke tests directly on a Microsoft Sentinel account. No issues so far. Failed to test locally.
• YAML: Failed to test locally. We hope they can be tested by the github actions.

[github-actions]

🔒 Security Approval Required

This fork PR requires manual approval before automated testing can run.

For security, a maintainer must:

1. 📝 Review the code changes carefully
2. ✅ Verify file types - This PR should only contain .yml, .yaml, or .json files. Check for any executable scripts (.ps1, .py, .sh, .exe, etc.) which are not allowed in this context.
3. 🏷️ Add the SafeToRun label if the changes are safe to execute

Note: If new commits are added later, simply remove and re-add the SafeToRun label.

---

🤖 Automated security check • Created: 2025-12-16T13:18:38.466Z
Learn more: GitHub Security Lab - Preventing PWN Requests

[github-actions]

🔒 Security Approval Required

This fork PR requires manual approval before automated testing can run.

For security, a maintainer must:

1. 📝 Review the code changes carefully
2. ✅ Verify file types - This PR should only contain .yml, .yaml, or .json files. Check for any executable scripts (.ps1, .py, .sh, .exe, etc.) which are not allowed in this context.
3. 🏷️ Add the SafeToRun label if the changes are safe to execute

Note: If new commits are added later, simply remove and re-add the SafeToRun label.

---

🤖 Automated security check • Created: 2025-12-16T13:22:46.444Z
Learn more: GitHub Security Lab - Preventing PWN Requests

[github-actions]

🔒 Security Approval Required

This fork PR requires manual approval before automated testing can run.

For security, a maintainer must:

1. 📝 Review the code changes carefully
2. ✅ Verify file types - This PR should only contain .yml, .yaml, or .json files. Check for any executable scripts (.ps1, .py, .sh, .exe, etc.) which are not allowed in this context.
3. 🏷️ Add the SafeToRun label if the changes are safe to execute

Note: If new commits are added later, simply remove and re-add the SafeToRun label.

---

🤖 Automated security check • Created: 2025-12-16T13:57:55.516Z
Learn more: GitHub Security Lab - Preventing PWN Requests

[github-actions]

🔒 Security Approval Required

This fork PR requires manual approval before automated testing can run.

For security, a maintainer must:

1. 📝 Review the code changes carefully
2. ✅ Verify file types - This PR should only contain .yml, .yaml, or .json files. Check for any executable scripts (.ps1, .py, .sh, .exe, etc.) which are not allowed in this context.
3. 🏷️ Add the SafeToRun label if the changes are safe to execute

Note: If new commits are added later, simply remove and re-add the SafeToRun label.

---

🤖 Automated security check • Created: 2025-12-19T11:45:44.889Z
Learn more: GitHub Security Lab - Preventing PWN Requests

[gbarbieru]

hello. any updates on this one?
i see that the checks fail with "System.IO.IOException: No space left on device" which seem to be more a test / env error than 'my code' error

[v-atulyadav]

Hi @gbarbieru,
Could you please pull the latest changes from the master branch and push the updated branch again? Thanks

[gbarbieru]

hi @v-atulyadav . done!

[gbarbieru]

hi @v-atulyadav !
there seems to be some problems with the checks that i'm not sure they have to do anything with my code

[rvirjoghe-bd]

The task "Run ASim Template Validation tests" seems stuck and fails

[rvirjoghe-bd]

Hello @v-atulyadav,

There seems to be a problem with the available space to run the checks

[v-atulyadav]

Hi @gbarbieru,
Validation failing for the below.

[rvirjoghe-bd]

@v-atulyadav hello, am I reading this wrong or is that error message not related to any changes that we made? What can we do to fix it? Do we need to merge master again into the PR?