Hi @yasinmnk
SecOps offers various ways to ingest data, but the method you use will depend on the export options supported by the vendor. It's important to note that even if SecOps has parser or data label support for a source, it doesn’t necessarily mean a native ingestion option is available.
For Bitwarden Events, parser support is available using the ingestion label: BITWARDEN_EVENTS.
It seems like Bitwarden Events may fall into this category. It might be worth verifying with Bitwarden to see if they offer additional export options, such as webhooks, forwarding data to a cloud provider storage solution (e.g., GCS), or offer some sort of syslog service. Based on their documentation, it appears event data is only exported via an API.
In cases like this, Google provides a limited number of ingestion scripts to assist with collecting data from sources where ingestion is restricted to API-only access. Unfortunately, there isn’t an existing ingestion script for this service. This means custom development may be required from your team to create a script or service that pulls data from the Bitwarden API and forwards it to Google SecOps.
Potential approaches include:
- Writing a script that pushes logs via a webhook.
- Leveraging the Ingestion API to forward data directly to your SecOps instance.
Here are helpful links for reference:
LinkedIn
Twitter
