In short
Bitdefender GravityZone XDR is Bitdefender's extended detection and response. It builds on GravityZone EDR, which correlates detections across endpoints into one incident, visualises the attack chain and maps it to MITRE ATT&CK, then adds native sensors for identity, productivity apps such as Microsoft 365, network, cloud and business applications, all in one GravityZone console.
Get a quote for Bitdefender GravityZone XDR
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What GravityZone XDR is
Bitdefender GravityZone is Bitdefender's business security platform: one agent on each device and one cloud console for prevention, detection, response, patching and encryption. GravityZone XDR is the detection and response layer that spans more than endpoints.
Bitdefender describes GravityZone XDR as connecting signals from different, scattered tools over time, then delivering context through automated evidence collection, root cause analysis and recommended response actions. Its central correlation engine uses machine learning to find relationships between affected systems, objects and events collected by its sensors, and presents the result as an interactive graph of the incident with a human-readable synopsis.
Two points set it apart from many XDR products:
- Native sensors: Bitdefender builds its own sensors rather than relying on custom integrations and hand-written detection rules, and each sensor is set up through guided steps
- Written for smaller teams: each incident comes with a plain-language explanation and recommended responses, so teams without a dedicated analyst can still act
For the platform as a whole, see Bitdefender GravityZone on our Cloud Security site.
The EDR foundation
XDR starts with the endpoint. GravityZone EDR records activity on each device and looks for patterns that point to an attack in progress. Bitdefender lists:
| Capability | What it gives you |
|---|---|
| Cross-endpoint correlation | Related detections on different devices are combined into one incident instead of a list of separate alerts |
| Attack-chain visualisation | A real-time graphical view of where the attack started, how it spread and what it touched |
| MITRE ATT&CK mapping | The tactics and techniques involved in each incident, described against the MITRE ATT&CK framework |
| Historical and live search | Hunt for indicators of compromise across past telemetry and query endpoints as they are now |
| Guided response | Recommended actions and response workflows launched from the incident |
EDR uses the same agent as GravityZone's prevention layers, so there is nothing extra to install. For how EDR works in general, see our endpoint detection and response guide.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
GravityZone XDR sensors
On top of EDR, Bitdefender sells XDR sensors for other parts of your environment. Each is a separate add-on, so you choose the coverage you need:
| Sensor | What it watches | Example detections and responses |
|---|---|---|
| XDR Identity | Active Directory, Microsoft Entra ID and other cloud identity providers | Behavioural anomalies, credential compromise and lateral movement, with single-click responses |
| XDR Productivity | Microsoft 365 and other productivity platforms | Phishing, brute force and unusual behaviour, with responses such as deleting emails or suspending accounts |
| XDR Network | Network traffic | Lateral movement, exfiltration, port scanning and brute force, including attacks on IoT and unmanaged devices |
| XDR Cloud | Public cloud environments such as Microsoft Azure | Suspicious activity such as encryption being removed, anomalies and login failures |
| XDR Business Applications | Atlassian Cloud applications such as Confluence, Jira and Bitbucket | Security events in those applications, with monitoring and response |
Identity and productivity are the sensors most small and mid-sized organisations look at first, because so many attacks start with a stolen Microsoft 365 password. If identity is your main concern, compare with dedicated identity threat detection and response.
How correlation works in practice
Imagine a phishing email lands in a mailbox, the user enters their password on a fake sign-in page, and the attacker signs in from abroad and then connects to a file server from the user's laptop.
Without XDR, that could be four alerts in three consoles, or none at all. With the productivity, identity, network and endpoint sensors in place, GravityZone XDR aims to link those events into one incident, showing the email, the risky sign-in, the network connection and the process on the laptop in a single graph, with recommended responses such as suspending the account and isolating the device.
That is the practical promise of extended detection and response: less time stitching evidence together, faster decisions. It still needs someone to make those decisions, which is where Bitdefender MDR comes in.
Is Bitdefender GravityZone XDR the right fit for you?
We will check it against your systems and requirements and recommend the right option.
XDR, EDR or MDR: where to start
More sensors watched by nobody add little. Our usual advice:
- Start with EDR on every endpoint, including servers, so you have the foundation and the attack-chain view.
- Decide who watches it. If nobody can respond out of hours, add Bitdefender MDR before adding more sensors.
- Add XDR Identity and XDR Productivity if email and account compromise are your main risks, which they are for most Microsoft 365 users.
- Add Network, Cloud or Business Applications where you have the matching exposure, such as unmanaged devices on the network or workloads in public cloud.
Bitdefender also packages detection and response for service providers as Secure (EDR and Advanced Threat Security), Secure Plus (adds MDR) and Secure Extra (adds XDR Identity and XDR Productivity). We recommend the combination that fits your risk and in-house skills, confirmed at quote.
Requirements and deployment
GravityZone EDR uses the Bitdefender agent already on your Windows, macOS and Linux devices, enabled by policy from the console, so there is no second agent to roll out. Before it is switched on, we can check older machines against Bitdefender's current requirements and remove any antivirus product being replaced.
The XDR sensors connect differently. Identity and productivity sensors link to your directory and Microsoft 365 tenant through guided set-up and need an administrator to grant access. The network sensor needs somewhere to see traffic, and the cloud sensor needs access to the cloud accounts you want watched. We plan each one with you so the right people approve the access.
Once data is flowing, we review the first incidents together, tune out noise from legitimate admin tools and agree which responses should run automatically. Our EDR deployment guide sets out the same pilot-then-enforce approach in more detail.
How we supply GravityZone
Forever Systems supplies GravityZone Cloud MSP Security with EDR, XDR, MDR, Patch Management and Full Disk Encryption add-ons, delivered from our multi-tenant GravityZone console on Bitdefender's monthly, usage-based licensing for service providers; billing terms are confirmed at quote. There are no licence keys to track: devices enrol with an installer tied to your company in the console. Bitdefender also packages detection and response for providers as Secure, Secure Plus and Secure Extra, described above.
Licensing detail is on our Bitdefender GravityZone EDR licensing page. If you are buying GravityZone mainly as antivirus, see our sister site endpointprotection.uk.
Contact us to talk about Bitdefender GravityZone XDR. We can enable EDR, review the first incidents with you, add the sensors that matter and agree which responses should be automatic.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What is Bitdefender GravityZone XDR?
GravityZone XDR is Bitdefender's extended detection and response. It builds on GravityZone EDR and adds native sensors for identity, productivity apps, network, cloud and business applications, correlating their signals into incidents with a visual attack chain and recommended responses.
What is the difference between Bitdefender EDR and XDR?
GravityZone EDR collects and correlates data from endpoints. XDR adds sensors for identities, productivity platforms such as Microsoft 365, networks, cloud environments and business applications, so incidents that cross those areas appear as one story.
What sensors does GravityZone XDR have?
Bitdefender lists XDR Identity, XDR Productivity, XDR Network, XDR Cloud and XDR Business Applications. Each is a separate add-on on top of the EDR foundation.
Does GravityZone XDR need a separate agent?
No. Endpoint detection uses the same Bitdefender agent as GravityZone's prevention. The other sensors connect to your identity provider, Microsoft 365, network or cloud environments through guided set-up.
Do I need Bitdefender MDR with XDR?
Not necessarily, but someone must act on incidents. If you have nobody to watch alerts out of hours, Bitdefender MDR is often a better first step than adding more sensors.
How much does Bitdefender GravityZone XDR cost?
It depends on the endpoints covered and the sensors and services chosen. We do not publish prices: ask us for a quote.
Still have a question about Bitdefender GravityZone XDR?
Ask us and a member of our team will reply by email.
More endpoint security guides
Falcon Insight XDRCrowdStrike's EDR, unified with identity, cloud and mobile telemetry, and how we supply Falcon.
Vigilance MDRSentinelOne's managed detection and response service, now Wayfinder MDR, explained.
WatchGuard EPDRWatchGuard EPDR is now Endpoint Security 360: the renamed editions, features and modules.WatchGuard MDRWatchGuard's 24/7 MDR service: Core MDR, Core MDR for Microsoft, Total MDR and Open MDR compared.
Bitdefender MDRBitdefender's managed detection and response on GravityZone: what its SOC does and what you agree up front.