TEAM: Huntress Managed Security Information and Event Management (SIEM)
PRODUCT: SIEM
ENVIRONMENT: REST API
SUMMARY: Configuration Guide for Bitwarden Password Manager

• Vendor Information
• Device Configuration Checklist
  • Bitwarden Portal Steps
  • Huntress Portal Steps
• Example Log Messages
  • User Logon

Vendor Information

Device Configuration Checklist

Bitwarden Portal Steps

1. Log into the Bitwarden web app
2. Open the Admin Console using the product switcher button in the bottom left
3. 
4. Navigate to your organization's Settings -> Organization Info screen
5. Click the View API key button
6. 
7. Make note of the client_id and client_secret values. These will be used in the Huntress Portal configuration steps below.

Note: Treat the client_id and client_secret values as sensitive information. Do not share these values in insecure locations.

Huntress Portal Steps

1. Open the Huntress Portal
2. Click on SIEM on the left navigation menu
3. Click Source Management
4. 
5. Click Add Source
6. Choose Bitwarden
7. 
8. Click Add on the right side of the screen
9. Set the configuration details
   1. Select the appropriate Organization from the drop down menu
   2. Enter a unique Name for the Bitwarden source
   3. (Optional) Enter a description for the source
   4. Enter the client_id value from the Bitwarden Portal steps
   5. Enter the client_secret value from the Bitwarden Portal steps
10. 
11. Click Save

Example Log Messages

User Logon

{
"object": "list",
"data": [
{
"object": "event",
"type": 1000,
"itemId": "string",
"collectionId": "string",
"groupId": "string",
"policyId": "string",
"memberId": "string",
"actingUserId": "string",
"date": "2020-11-04T15:01:21.698Z",
"device": 0,
"ipAddress": "xxx.xx.xxx.x"
}
],
"continuationToken": "string"
}