Bitwarden Password Manager

Details

ID	`Bitwarden Password Manager`
Provider	Bitwarden
Category	Analytics & SIEM
From Version	8.6.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

This integration collects event logs from Bitwarden Password Manager to Cortex XSIAM.
This integration was integrated and tested with version 2024.6.2 of Bitwarden Password Manager.

Configure Bitwarden Password Manager in Cortex

Parameter	Required
Server URL (e.g., https://example.bitwarden.com)	True
Self-hosted Bitwarden Instance	False
Client ID	True
Client Secret	True
Trust any certificate (not secure)	False
Use system proxy settings	False
Maximum number of events per fetch	False

Note: Enable the “Self-hosted Bitwarden Instance” parameter if you are using a self-hosted Bitwarden server. For self-hosted instances, the authentication endpoint will be constructed from your Server URL (e.g., https://your-domain.com/identity/connect/token). For cloud-hosted instances (default), the integration uses Bitwarden’s cloud authentication endpoints.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

bitwarden-get-events

Gets events from Bitwarden.

Base Command

bitwarden-get-events

Input

Argument Name	Description	Required
start	The start date from which to filter events. (e.g., 2024-07-10T08:08:46.76)	Optional
end	The end date from which to filter events. (e.g., 2024-07-11T08:09:47.08)	Optional
limit	The number of events to return. Default is 500.	Optional
should_push_events	Set this argument to True in order to save events to XSIAM, otherwise the command will only display them. Possible values are: true, false. Default is false.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (e.g., https://example.bitwarden.com) (required)
self_hosted — Self-hosted Bitwarden Instance
credentials — Client ID (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
max_fetch_events — Maximum number of events per fetch

Commands (1)

bitwarden-get-events
Gets events from Bitwarden.

Source

BitwardenPasswordManager.py BitwardenPasswordManager_test.py BitwardenPasswordManager.yml BitwardenPasswordManager_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: Bitwarden
sectionorder:
- Connect
- Collect
commonfields:
  id: Bitwarden Password Manager
  version: -1
configuration:
- defaultvalue: https://api.bitwarden.com
  display: Server URL (e.g., https://example.bitwarden.com)
  name: url
  required: true
  type: 0
  section: Connect
- display: Self-hosted Bitwarden Instance
  name: self_hosted
  type: 8
  required: false
  defaultvalue: 'false'
  section: Connect
  additionalinfo: Enable this if you are using a self-hosted Bitwarden instance. For self-hosted instances, the authentication endpoint will be constructed from your Server URL.
- displaypassword: Client Secret
  name: credentials
  required: true
  type: 9
  display: Client ID
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Maximum number of events per fetch
  defaultvalue: '500'
  name: max_fetch_events
  required: false
  type: 0
  advanced: true
  section: Collect
description: This integration collects event logs from Bitwarden Password Manager to Cortex XSIAM.
display: Bitwarden Password Manager
name: Bitwarden Password Manager
script:
  commands:
  - arguments:
    - description: The start date from which to filter events. (e.g., 2024-07-10T08:08:46.76).
      name: start
      required: false
    - description: The end date from which to filter events. (e.g., 2024-07-11T08:09:47.08).
      name: end
      required: false
    - description: Set this argument to True in order to create events, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'true'
      - 'false'
      required: false
    - description: The number of events to return. Default is 500.
      name: limit
      required: false
    description: Gets events from Bitwarden.
    name: bitwarden-get-events
  runonce: false
  script: '-'
  type: python
  subtype: python3
  isfetchevents: true
  dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- marketplacev2
- platform
fromversion: 8.6.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam