EDR Provider Framework

The EDR provider framework is a common way for Breeze to connect to Endpoint Detection and Response products. A provider supplies the vendor-specific parts (credentials, tenant and endpoint discovery, detections); Breeze supplies the shared parts: tenant-to-organization mapping, endpoint-to-device linking, the incidents feed, the device page section, alerts, and the customer portal summary.

Currently two providers are available:

Provider	Key
Bitdefender GravityZone	bitdefender
Emsisoft (cloud Management Console)	emsisoft

Huntress and SentinelOne keep their own dedicated integrations; see EDR Integrations.

Note

Response actions arrived in v0.124.0 and are off until you turn them on. Each connection card has an Allow response actions switch; while it is off, the device page shows the provider’s data read-only. Changing it, like any connection setting, needs a partner user with full organization access and MFA. The switch, the actions and their history are only visible when the web image is built with PUBLIC_ENABLE_EDR_INTEGRATIONS=true, which the published image does not set — see the flag note in EDR Integrations.

Connecting a provider

1. Set your scope selector to All orgs. Connections are partner-level and require a partner admin with all-organization access.
2. Go to Integrations, open the Security tab, and select EDR providers.
3. Choose the provider and give the connection a name.
4. Fill in the credential fields. The fields come from the provider, so they differ per product. Secret values are encrypted at rest and are never shown again after saving.
5. Enter the Access URL if the provider asks for one.
6. Save, then use Test connection to confirm Breeze can reach the vendor. An initial sync is scheduled automatically.

A connection reports its own health: connected, needs re-authentication, or error, along with the last inventory and detection sync times. You can pause a connection, trigger a manual sync, or delete it. Deleting is permanent and asks you to confirm the number of detections and endpoints that will be removed.

The connection card also carries two switches (v0.124.0), both off by default:

• Allow response actions — lets technicians who hold device execute permission isolate and release devices and run scans on endpoints managed through this connection. Turning it on asks you to confirm.
• Push events — the provider notifies Breeze about new events, which triggers a sync sooner than the regular schedule; scheduled syncs keep running. It needs the server’s public URL set and HTTPS, and the connection active. If the provider already pushes to another destination (for example a SIEM), Breeze asks before replacing that feed. A Send test event button checks the path; the card shows when the last push event arrived.

Mapping vendor tenants to organizations

Providers expose their own customer or company structure, called tenants. Each tenant must be mapped to a Breeze organization before its data is attributed to that customer.

• Breeze may show a suggested match when a tenant name matches an organization name. Suggestions are never applied automatically; you confirm each one.
• You can leave a tenant deliberately unmapped.
• Unmapping a tenant detaches its data from the organization again.
• A tenant that disappears from the vendor is flagged missing since with the date it was last seen, rather than being silently removed.

Until a tenant is mapped, its endpoints and detections are not visible to any organization.

Linking endpoints to devices

During each sync Breeze tries to match vendor endpoints to enrolled devices. Endpoints that cannot be matched are listed as unlinked, and endpoints that match more than one device are listed as ambiguous. From the connection’s endpoint list you can link an endpoint to the correct device, or unlink one that was matched wrongly.

Emsisoft (cloud Management Console)

The Emsisoft connection reads from the cloud Emsisoft Management Console (EMC). The on-premises Enterprise Console is not supported. This first release is read-only: Breeze shows endpoints, protection health and incidents, and does not start scans or change verdicts.

Key setup. Create a dedicated EMC user in your partner account, give it access to every workspace Breeze should see, and create the API key from that user’s profile. Paste the key into the API key field; there is no Access URL. A key from a user who belongs to more than one partner account is refused, because Breeze needs one stable account to attach the connection to. If the key can list workspaces but not read their devices (a licence-manager role, for example), Test connection still succeeds and notes it, and only the affected workspaces report an error.

What syncs.

• Each EMC workspace is a tenant. Map it to an organization like any other tenant. Workspace names are the only suggestion signal, because Emsisoft has no external-code field.
• The device list gives names; operating system, domain, IP addresses, online state and protection health come from a per-device lookup that refreshes a batch of devices each inventory run. A device that runs no Emsisoft agent (network-discovered or an unused seat) is never reported as protected.
• Incidents arrive as detections: one row for each involved device, all linked to the same incident. Breeze checks the last 30 days of incidents every run. Emsisoft has no “closed” state, so an incident shows as Mitigated (an action was taken on every signal), False positive (marked benign in the console), In progress, or Open; it is never shown as resolved.
• Because Emsisoft does not report when a verdict changes, Breeze also re-checks open incidents on each inventory run, about 20 per workspace per hour, oldest check first. A verdict changed in the console weeks later appears within a few inventory cycles. An incident the vendor no longer returns stays open rather than being closed on its own.

Matching to devices. Emsisoft gives Breeze a device name only (no MAC address or serial number), so Breeze links an endpoint only when the name is unique on both sides: exactly one device in the organization has that name, and exactly one Emsisoft record carries it. Duplicates stay ambiguous and are listed for manual linking. Linking one of two same-name devices by hand does not link the other one automatically.

Not included. Isolation is not available for Emsisoft. Detections are polled every 15 minutes and inventory every 60; both intervals lengthen automatically for partners with many workspaces so the connection stays inside the vendor’s request limits.

Where the data appears

Location	What you see
Security → EDR → Other EDR tab	Detections from framework providers. The tab carries the provider name when only one provider is connected.
Incidents	An incidents feed of framework detections, with Promote to incident to open a Breeze incident from a detection.
Device page → EDR section	Endpoint health, isolation state and detections for the linked device. With Allow response actions on for the connection, Isolate device, Release isolation and Run scan buttons (isolating and releasing confirm first, with an optional reason; running any response action asks you to verify with MFA), plus a Recent response actions history showing each request as Queued, In progress, Succeeded or Failed. One response action runs at a time per device.
Alerts	Alerts raised from framework detections.
Customer portal	An optional generic status and threat count; see below.

Reading coverage correctly

Every detection list reports coverage. An empty list with incomplete coverage (a tenant not yet mapped, a sync that failed, or a sync that has not run) does not mean there are no threats, and Breeze says so instead of showing an all-clear. Sync health is visible to partner users only; organization-scoped users see a note saying so rather than the sync details.

Customer portal

The portal flag enableEdrVisibility controls whether an organization’s portal users see EDR information. It is off by default and is included when you use Enable all visibility.

When on, customers see a generic Managed endpoint protection status and threat counts from connected providers. Vendor and product names are never shown in the portal.

To change it, open Settings → Organizations, choose the organization, open the Customer Portal tab, and toggle Endpoint protection (EDR). See Customer Portal for the full visibility list.