|
| 1 | +--- |
| 2 | +id: bitwarden |
| 3 | +title: Bitwarden |
| 4 | +sidebar_label: Bitwarden |
| 5 | +description: The Bitwarden app for Sumo Logic helps monitor and accelerate incident response in credential and secret management workflows. |
| 6 | +--- |
| 7 | + |
| 8 | +import useBaseUrl from '@docusaurus/useBaseUrl'; |
| 9 | + |
| 10 | +<img src={useBaseUrl('img/integrations/security-threat-detection/bitwarden.png')} alt="thumbnail icon" width="125"/> |
| 11 | + |
| 12 | +The Sumo Logic app for Bitwarden provides comprehensive visibility into user activity, security events, and administrative changes within your Bitwarden environment. It enables security analysts to track key actions such as user logins, failed two-step verifications, master password resets, and decryption key migrations. The app includes contextual data—like IP addresses, device types, and geolocation—to help detect suspicious behavior and potential threats. Visualizations such as event trends and geo heatmaps reveal usage patterns and regional access anomalies. |
| 13 | + |
| 14 | +A major strength of the app is its ability to highlight high-risk activities through event summaries and filtered views of critical actions, such as vault exports or SSO deactivation. It also includes preconfigured alerts to proactively detect security threats like data exfiltration, account compromise, or policy violations. |
| 15 | + |
| 16 | +:::info |
| 17 | +This app includes [built-in monitors](#bitwarden-monitors). For details on creating custom monitors, refer to the [Create monitors for Bitwarden app](#create-monitors-for-bitwarden-app). |
| 18 | +::: |
| 19 | + |
| 20 | +## Log types |
| 21 | + |
| 22 | +This app uses Sumo Logic’s [Bitwarden Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/bitwarden-source/) to collect the [event logs](https://bitwarden.com/help/event-logs/) from the Bitwarden platform. |
| 23 | + |
| 24 | +### Sample log messages |
| 25 | + |
| 26 | +```json title="Event Log" |
| 27 | +{ |
| 28 | + "actingUserEmail": "[email protected]", |
| 29 | + "actingUserId": "9aaa2aeb-6cf1-48a0-8e2e-b28e015b71d6", |
| 30 | + "actingUserName": "frank", |
| 31 | + "date": "2025-04-23T22:42:44-0700226Z", |
| 32 | + "device": 9, |
| 33 | + "deviceName": "ChromeBrowser", |
| 34 | + "groupId": null, |
| 35 | + "groupName": "", |
| 36 | + "installationId": null, |
| 37 | + "ipAddress": "103.149.48.189", |
| 38 | + "itemId": null, |
| 39 | + "memberId": null, |
| 40 | + "object": "event", |
| 41 | + "policyId": null, |
| 42 | + "secretId": null, |
| 43 | + "serviceAccountId": null, |
| 44 | + "type": 1009, |
| 45 | + "typeName": "Created_item_item-identifier" |
| 46 | +} |
| 47 | +``` |
| 48 | + |
| 49 | +### Sample queries |
| 50 | + |
| 51 | +```sql title="Event Breakdown" |
| 52 | +_sourceCategory=Labs/bitwarden |
| 53 | +| json "actingUserName", "date", "object", "type", "typeName", "ipAddress","deviceName","actingUserEmail" as user_name, date, object, event_code, event_name, ip, device_name, user_email |
| 54 | +| lookup event_name from https://sumologic-app-data.s3.us-east-1.amazonaws.com/bitwarden_events.csv on event_code=event_code |
| 55 | +| lookup latitude, longitude,country_name, country_code from geo://location on ip = ip |
| 56 | + |
| 57 | + |
| 58 | +| count by event_name |
| 59 | +| sort by _count |
| 60 | +``` |
| 61 | + |
| 62 | +## Collection configuration and app installation |
| 63 | + |
| 64 | +import CollectionConfiguration from '../../reuse/apps/collection-configuration.md'; |
| 65 | + |
| 66 | +<CollectionConfiguration/> |
| 67 | + |
| 68 | +:::important |
| 69 | +Use the [Cloud-to-Cloud Integration for Bitwarden](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/bitwarden-source/) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Bitwarden app is properly integrated and configured to collect and analyze your Bitwarden data. |
| 70 | +::: |
| 71 | + |
| 72 | +### Create a new collector and install the app |
| 73 | + |
| 74 | +import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md'; |
| 75 | + |
| 76 | +<AppCollectionOPtion1/> |
| 77 | + |
| 78 | +### Use an existing collector and install the app |
| 79 | + |
| 80 | +import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md'; |
| 81 | + |
| 82 | +<AppCollectionOPtion2/> |
| 83 | + |
| 84 | +### Use an existing source and install the app |
| 85 | + |
| 86 | +import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md'; |
| 87 | + |
| 88 | +<AppCollectionOPtion3/> |
| 89 | + |
| 90 | +## Viewing the Bitwarden dashboards |
| 91 | + |
| 92 | +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; |
| 93 | + |
| 94 | +<ViewDashboards/> |
| 95 | + |
| 96 | +### Security |
| 97 | + |
| 98 | +The **Bitwarden - Security** dashboard offers security analysts a centralized view of critical user and system activity. It highlights high-risk events such as SSO disablement, master password resets, failed two-step verifications, and decryption key migrations. Visual tools like event timelines and geographic heatmaps help quickly identify anomalies. The dashboard also enforces security policies by flagging access from embargoed regions and tracking users who disable two-step login. |
| 99 | + |
| 100 | +Detailed login and invitation data supports monitoring of access patterns and potential insider threats. Each panel is optimized for real-time investigation and auditing, enhancing the ability to detect and respond to suspicious behavior. The dashboard improves visibility, accountability, and response time for security incidents in the Bitwarden.<br/><img src='https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Bitwarden/Bitwarden+-+Security.png' alt="Bitwarden-Security" /> |
| 101 | + |
| 102 | +## Create monitors for Bitwarden app |
| 103 | + |
| 104 | +import CreateMonitors from '../../reuse/apps/create-monitors.md'; |
| 105 | + |
| 106 | +<CreateMonitors/> |
| 107 | + |
| 108 | +### Bitwarden monitors |
| 109 | + |
| 110 | +| Name | Description | Trigger Type (Critical / Warning / MissingData) | Alert Condition | |
| 111 | +|:--|:--|:--|:--| |
| 112 | +| `Events from Embargoed Geo Location` | This alert is triggered when a Bitwarden event is detected originating from a geo-location that is on an embargo list. This alert helps security teams detect potential violations of compliance policies or identify suspicious access attempts from high-risk regions. | Critical | Count > 0 | |
| 113 | +| `Exported Organization Vault` | This alert is triggered when a user exports the entire organization's vault data. This is a high-risk activity that could indicate potential data exfiltration or insider threat behavior and should be reviewed immediately by security personnel. | Critical | Count > 0 | |
| 114 | +| `Organization Disabled SSO` | This alert is triggered when the Single Sign-On (SSO) is disabled for the organization, which could reduce the security posture and increase the risk of unauthorized access. This alert ensures that administrators are immediately aware of any change that affects the organization’s authentication method. | Critical | Count > 0 | |
| 115 | + |
| 116 | +## Upgrading the Bitwarden app (Optional) |
| 117 | + |
| 118 | +import AppUpdate from '../../reuse/apps/app-update.md'; |
| 119 | + |
| 120 | +<AppUpdate/> |
| 121 | + |
| 122 | +## Uninstalling the Bitwarden app (Optional) |
| 123 | + |
| 124 | +import AppUninstall from '../../reuse/apps/app-uninstall.md'; |
| 125 | + |
| 126 | +<AppUninstall/> |
0 commit comments