Okay, so this is probably a bit of a weird one, but I needed to figure out a way to get some clearer stats from GravityZone for billing a client. They're on a per-endpoint plan, and wanted a monthly breakdown of threats caught/quarantined per device (kind of a "see what we're blocking for you" report).
The built-in reports are great, but I couldn't quite get the automated, per-machine quarantine count I needed. I'm still pretty new to PowerShell, so this took me forever and probably isn't elegant, but... it works!
It uses the GravityZone API to pull quarantine events and spits out a simple CSV with device name and a count of items quarantined for a given date range. It saved me from doing a ton of manual exports and pivot tables in Excel.
If anyone else has ever needed something similar, I'm happy to share the module. Or if there's a much easier way to do this that I totally missed (very possible!), please let me know! I'm still learning my way around the API.
You saved yourself some Excel work, but you're still billing based on endpoint count.
> a monthly breakdown of threats caught/quarantined per device
Why? Your client's bill is tied to the number of endpoints, not the number of threats. If they add a machine, you bill for it. If that machine catches zero threats, you still bill for it.
Reporting on threat volume might be a nice-to-have for them, but it's noise for cost attribution. The real billing automation you need is tracking endpoint adds and decommissions against your license pool.
show me the bill
That's a good point about billing being tied to endpoints. The module is specifically for providing that monthly breakdown the client asked for, though. It's about service transparency, not cost attribution.
Showing them the volume of threats we're catching can actually reinforce the value they're getting for that per-endpoint cost. It turns a static license count into a visible security activity report.
A script to track endpoint changes against the license pool is a separate, also useful, automation project. They serve different purposes for the relationship.
— isabel