Bitdefender XDR Sensor for MDR (Add-On) Cloud

What is included in Bitdefender XDR Sensor for MDR (Add-On) Cloud?

AWS sensor – Collects CloudTrail and AWS Config events into GravityZone.
Azure Cloud sensor – Collects subscription activity through a registered Entra ID application.
Google Cloud sensor – Collects activity events from Google Cloud Platform projects.
MDR analyst coverage – Bitdefender SOC analysts triage the resulting cloud detections.
Correlation with endpoints – Cloud events are correlated with endpoint and identity telemetry.
Important – No agent protection for cloud workloads is included here.

What are the main benefits of Bitdefender XDR Sensor for MDR (Add-On) Cloud?

This add-on is a separately licensed sensor that brings Amazon Web Services, Microsoft Azure and Google Cloud Platform activity data into the GravityZone XDR correlation engine, where Bitdefender vendor documentation lists it as the GravityZone XDR Sensor for MDR Cloud. It is set up and managed centrally in GravityZone Control Center under Configuration and Sensors Management, and the events it delivers land in the same incidents the Bitdefender MDR security operations centre works on.

Cloud blind spot closed – Control plane actions become visible next to endpoint events.
Fewer parallel consoles – Cloud detections appear in the same incident view.
Analyst time saved – The SOC triages cloud alerts instead of your team.
Faster attack reconstruction – Incidents show how a login led to cloud changes.
Multi-cloud coverage – AWS, Microsoft Azure and Google Cloud are all supported.
Evidence for reporting – Incident timelines document what happened and when.

Best antivirus? Why Windows Defender alone is not enough
Explains where built-in protection stops and why detection and response layers exist above it.

Which company size is Bitdefender XDR Sensor for MDR (Add-On) Cloud suitable for?

The deciding factor is not headcount but whether you actually run workloads in a public cloud and already pay for a managed detection service. A company with three virtual machines in Azure and no MDR subscription gains nothing from this add-on; a company with a growing AWS footprint and an existing MDR contract closes a real gap with it.

Does Bitdefender XDR Sensor for MDR (Add-On) Cloud meet the requirements of Swiss cybersecurity legislation?

The revised Information Security Act obliges operators of critical infrastructure in Switzerland to report cyberattacks to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery, and most other companies are not covered by that duty at all. Where cloud infrastructure is part of what you operate, this sensor shortens the time needed to establish the facts, because the incident already contains the surrounding cloud activity instead of requiring someone to pull CloudTrail or Azure activity logs by hand under time pressure. The MDR service contributes the second half of that: analysts who look at the detection at three in the morning rather than the next working day. What the add-on does not do is decide whether you are in scope, file anything with BACS, or protect the workloads themselves, which still requires the security agent on the instances. It also produces no register of your reporting obligations, so the organisational side stays with you. This text is not legal advice, and whether your organisation falls under the reporting obligation should be clarified with qualified legal counsel.

Does Bitdefender XDR Sensor for MDR (Add-On) Cloud meet the requirements of European cybersecurity legislation?

No product makes a company compliant with the NIS 2 Directive, because the directive addresses risk management measures and governance, not software features. NIS 2 asks entities in scope to cover risk analysis and security policies, incident handling, business continuity and backup, supply chain security, vulnerability handling, cyber hygiene and training, cryptography, and access control including multi-factor authentication. This add-on contributes to exactly one of those categories: incident handling, through continuous collection of cloud activity, correlation with endpoint and identity events, and documented incident timelines that can be shown to an auditor. It contributes nothing to backup and business continuity, staff training, cryptography, access control, or the assessment of your own suppliers. Those measures require separate products and, more decisively, written processes that someone in your organisation owns.

Does Bitdefender XDR Sensor for MDR (Add-On) Cloud help with security questionnaires from large customers?

Partly, and only in one section of a typical questionnaire. It gives you a defensible answer to items on 24/7 monitoring, on whether cloud infrastructure activity is logged and reviewed, on who performs alert triage, and on whether incidents can be reconstructed after the fact, since the sensor plus the MDR service means a named provider does the watching rather than an unstaffed mailbox. It answers nothing on encryption at rest, backup and restore testing, patch timelines, identity and access management, multi-factor authentication, staff awareness training, penetration testing, or cloud misconfiguration reviews. The misconfiguration item is the one that most often trips buyers up, because it looks like something a cloud sensor should cover and it is not: posture management sits in Bitdefender Cloud Security (CSPM+), a separate product. Where several gaps remain, adding the matching modules from the same GravityZone family is usually cheaper and less work to evidence than assembling answers from three different vendors with three different report formats.

What is the difference between XDR Sensor Cloud and XDR Sensor for MDR Cloud?

The decisive difference is who looks at the alerts. Both variants collect the same cloud activity data and feed the same GravityZone XDR correlation engine, so the technical coverage is not what separates them. The plain XDR Sensor Cloud assumes your own team opens the console and works the incidents. The MDR variant is intended for tenants where the Bitdefender MDR service is active, so the cloud telemetry falls inside what the security operations centre monitors, and setup includes confirming that the company is correctly enrolled in the MDR service with the required permissions granted. If you have no MDR subscription, the MDR variant is the wrong article.

Which limitations should you know before buying?

This sensor reads the cloud platform's own activity and configuration logs; it does not protect the virtual machines and containers running inside those accounts, which still need the Bitdefender security agent and, for container environments, the separate container protection add-on. Cloud posture management and misconfiguration scanning belong to a different product, Bitdefender Cloud Security (CSPM+), and are licensed on their own. Identity events from Microsoft Entra ID are collected by the identity sensors rather than the cloud sensor, and that distinction is the single most common reason for an unplanned second purchase. Setup is not a one-click integration either: AWS expects CloudTrail, AWS Config, an S3 bucket, an SQS queue and an IAM policy with defined permissions, while Azure expects a registered Entra ID application holding the Reader role on the subscription, so plan a maintenance slot with someone who has cloud administrator rights. Finally, GravityZone Cloud runs on several separate cloud instances, so if the location of processed data is a requirement in your organisation, confirm which instance your tenant sits on before you order.

Data loss is expensive: How backups help you avoid outages
Covers the recovery side that detection and response services deliberately leave out.

Frequently asked questions about Bitdefender XDR Sensor for MDR (Add-On) Cloud

What happens if the sensor loses its permissions?

The Sensors Management page shows a status for every integration: Active, Disabled, Action needed or Offline. Action needed and Offline usually mean one or more permissions are missing, and the sensor stops processing data until they are restored, which is worth putting on a monitoring checklist rather than discovering during an incident.

Can a compromised AWS account be shut down from the console?

In AWS Control Tower environments, access keys belonging to a compromised IAM account can be disabled and removed from the Management Account, either from the alert details panel or from the Response tab of the incident. Which further response actions are available depends on the permissions you granted during integration.

Does this sensor replace a SIEM?

No. It delivers cloud events into GravityZone incidents for detection and correlation, not long-term log storage and free-form search across arbitrary sources. For that, Bitdefender offers the separate Security Data Lake product, along with integrations to SIEM platforms such as Splunk, Microsoft Sentinel and IBM QRadar.