BitSight Event Collector

Details

ID	`BitSight Event Collector`
Provider	BitSight
Category	Analytics & SIEM
From Version	6.9.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Use this integration to fetch BitSight security findings as events in Cortex XSIAM. This is important for organizations that wish to integrate BitSight programmatically into their security operations.

When configured as a fetching integration, it will continuously fetch new findings starting from the current day. The manual bitsight-get-events command fetches findings from the last 2 days (48 hours).

This is the default integration for this content pack when configured by the Data Onboarder in Cortex XSIAM.

Configure BitSight Event Collector in Cortex

Parameter	Description	Required	Default Value
Server URL	REST API Endpoint of BitSight server.	True	https://api.bitsighttech.com
API Key	BitSight API token.	True	-
Company’s GUID	Optional. If provided, findings for this company and its subsidiaries will be collected. If omitted, the collector attempts to use `myCompany.guid`.	False	-
Trust any certificate (not secure)		False	-
Use system proxy settings		False	-
Max events per fetch	Maximum number of findings to fetch at a time.	False	1000
Events Fetch Interval	Interval between fetch operations.	False	5

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

bitsight-get-events

Gets findings as events from BitSight Event Collector. The command fetches findings from the last 2 days (48 hours).

Base Command

bitsight-get-events

Input

Argument Name	Description	Required	Default Value
limit	The number of events to return.	Optional	5
guid	Override the Company GUID for this command only.	Optional	-
should_push_events	Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: true, false.	Required	false

Context Output

There is no context output for this command.

Notes

API Date Format Limitation: The BitSight API returns first_seen timestamps in date-only format (YYYY-MM-DD) without hours or minutes. The integration converts these to full timestamps in the _time field for XSIAM compatibility. This means all events will show timestamps like 2025-08-30T00:00:00 (midnight UTC) regardless of when during that day the finding was actually discovered.

Configuration parameters

base_url — Server URL (required)
credentials — API Key (required)
guid — Company's GUID
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
max_fetch — Max events per fetch
isFetchEvents — Fetch events
eventFetchInterval — Events Fetch Interval

Commands (1)

bitsight-get-events
Gets BitSight findings events from the last 2 days (48 hours).

Source

BitSightEventCollector.py BitSightEventCollector_test.py BitSightEventCollector.yml BitSightEventCollector_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: BitSight
sectionorder:
- Connect
- Collect
commonfields:
  id: BitSight Event Collector
  version: -1
configuration:
- name: base_url
  display: Server URL
  required: true
  defaultvalue: https://api.bitsighttech.com
  type: 0
  additionalinfo: REST API Endpoint of BitSight server.
  section: Connect
- display: API Key
  name: credentials
  required: true
  type: 9
  hiddenpassword: true
  section: Connect
- additionalinfo: Optional. GUID of the company. If provided, findings for this company and its subsidiaries will be collected.
  display: Company's GUID
  name: guid
  required: false
  type: 0
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
  advanced: true
- additionalinfo: Maximum number of findings to fetch per run.
  defaultvalue: 1000
  display: Max events per fetch
  name: max_fetch
  required: false
  type: 0
  section: Collect
- display: Fetch events
  name: isFetchEvents
  required: false
  type: 8
  section: Collect
- defaultvalue: 5
  display: Events Fetch Interval
  name: eventFetchInterval
  required: false
  type: 19
  section: Collect
description: Use this integration to fetch BitSight findings as events in XSIAM.
display: BitSight Event Collector
name: BitSight Event Collector
supportlevelheader: xsoar
script:
  commands:
  - arguments:
    - description: The number of events to return.
      name: limit
      defaultValue: 5
    - description: Optional. Override the Company GUID to collect for this command only.
      name: guid
    - auto: PREDEFINED
      defaultValue: "false"
      description: Set this argument to true in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - "true"
      - "false"
      required: true
    description: Gets BitSight findings events from the last 2 days (48 hours).
    name: bitsight-get-events
  runonce: false
  script: "-"
  type: python
  subtype: python3
  isfetchevents: true
  dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- marketplacev2
- platform
fromversion: 6.9.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam