Skip to content

Bitwarden Event Logs

Overview

Bitwarden Event Logs provide an audit trail of authentication, vault usage, organization administration, policy changes, and secrets management activity.

  • Vendor: Bitwarden
  • Supported environment: SaaS and on-premises
  • Detection based on: Telemetry
  • Supported application or feature: Event Logs and Event Management (Generic HEC)

Configure

Generic HEC integration setup in Bitwarden

Follow the official Bitwarden guide to configure Event Management forwarding with Generic HEC.

Bitwarden documentation - HTTP Event Collector

Create the intake in Sekoia.io

  1. Open your Sekoia.io workspace for your region, then go to the intake page and create a new intake from the format Bitwarden Event Logs.

  2. Copy the generated Sekoia intake URL and intake key.

    Warning

    The intake URL depends on your region. For the FRA1 region, the domain is intake.sekoia.io. For any other region, replace it with your region's HTTP-intake domain—for example:

    https://app.usa1.sekoia.io/api/v1/intake-http

    You can find your region's domain here: https://docs.sekoia.com/getting_started/regions/

  3. In Bitwarden Admin Console, open Integrations > Event Management, select Generic HEC, then paste:

  4. Endpoint URL: the Sekoia intake URL
  5. Token: the Sekoia intake key
  6. Save the integration.

Validate event ingestion

  1. Trigger a test event from Bitwarden (for example, a successful login).
  2. In Sekoia.io, open your intake and verify incoming events are received.
  3. Confirm normalized fields are populated, including event.code, event.action, user.id, and source.ip.

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1102",
        "typeName": "Cipher_Deleted",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "53346505-2478-5954-0938-639445164520",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "63433685-1129-5365-9291-307766514122",
        "installationId": "",
        "date": "2026-10-29T14:12:15.5678901Z",
        "deviceName": "Chrome",
        "device": "9",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1108",
        "typeName": "Cipher_ClientToggledPasswordVisible",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "e31a8c04-9812-4c21-b1e9-a3f1012de22a",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "69342302-7372-5446-0534-410088376301",
        "installationId": "",
        "date": "2026-10-29T14:32:10.1230000Z",
        "deviceName": "Chrome Extension",
        "device": "2",
        "ipAddress": "192.168.1.120",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "Jane Smith",
                "email": "jane.smith@example.org",
                "type": "Admin"
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1101",
        "typeName": "Cipher_Updated",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "26902048-2171-5399-9494-223083753413",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "63433685-1129-5365-9291-307766514122",
        "installationId": "",
        "date": "2026-10-29T14:12:20.6789012Z",
        "deviceName": "",
        "device": "",
        "ipAddress": "",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1300",
        "typeName": "Collection_Created",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "49592089-1612-5901-8305-563971413203",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "69342302-7372-5446-0534-410088376301",
        "installationId": "",
        "date": "2026-10-29T14:12:40.7890123Z",
        "deviceName": "Chrome",
        "device": "9",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "Jane Smith",
                "email": "jane.smith@example.org",
                "type": "Admin"
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1616",
        "typeName": "Organization_CollectionManagement_AllowAdminAccessToAllCollectionItemsEnabled",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "69342302-7372-5446-0534-410088376301",
        "installationId": "",
        "date": "2026-10-29T14:13:40.4444444Z",
        "deviceName": "Chrome",
        "device": "9",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "Jane Smith",
                "email": "jane.smith@example.org",
                "type": "Admin"
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1114",
        "typeName": "Cipher_ClientAutofilled",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "95025527-4378-5000-0022-676165103353",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "63433685-1129-5365-9291-307766514122",
        "installationId": "",
        "date": "2026-10-29T14:16:00.1357913Z",
        "deviceType": "Firefox Extension",
        "device": "3",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "2003",
        "typeName": "OrganizationDomain_NotVerified",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "",
        "installationId": "",
        "date": "2026-10-29T02:00:00.6666666Z",
        "deviceName": "Server",
        "device": "22",
        "ipAddress": "",
        "systemUser": "2",
        "domainName": "corp.example.org",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "",
                "email": "",
                "type": ""
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1000",
        "typeName": "User_LoggedIn",
        "memberId": "",
        "organizationId": "",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "",
        "installationId": "",
        "date": "2026-10-29T14:15:00.0000000Z",
        "deviceName": "",
        "device": "",
        "ipAddress": "",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "",
                "email": "",
                "type": ""
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": ""
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1401",
        "typeName": "Group_Updated",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "14755408-0494-5740-0137-903672455227",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "69342302-7372-5446-0534-410088376301",
        "installationId": "",
        "date": "2026-10-29T14:13:00.8901234Z",
        "deviceName": "Chrome",
        "device": "9",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "Jane Smith",
                "email": "jane.smith@example.org",
                "type": "Admin"
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": "Engineering"
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1111",
        "typeName": "Cipher_ClientCopiedPassword",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "69520243-0052-5223-1111-985817155144",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "63433685-1129-5365-9291-307766514122",
        "installationId": "",
        "date": "2026-10-29T10:02:33.2718281Z",
        "deviceType": "Chrome Extension",
        "device": "2",
        "ipAddress": "192.168.1.120",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": ""
    }
}

{
    "Event": "{\"Date\":\"2026-10-29T08:30:00.1122334Z\",\"Type\":1111,\"UserId\":null,\"OrganizationId\":\"org-12345678\",\"InstallationId\":null,\"ProviderId\":null,\"CipherId\":\"63548008-4792-5593-9820-754724344547\",\"CollectionId\":null,\"GroupId\":null,\"PolicyId\":null,\"OrganizationUserId\":null,\"ProviderUserId\":null,\"ProviderOrganizationId\":null,\"ActingUserId\":\"63433685-1129-5365-9291-307766514122\",\"DeviceType\":9,\"IpAddress\":\"198.51.100.42\",\"IdempotencyId\":\"20163122-3236-5387-0233-334192116230\",\"SystemUser\":null,\"DomainName\":null,\"SecretId\":null,\"ProjectId\":null,\"ServiceAccountId\":null,\"GrantedServiceAccountId\":null,\"SendId\":null,\"AccessRequestId\":null,\"AccessLeaseId\":null}",
    "Source": "Bitwarden",
    "Index": "main",
    "bw_serviceName": "Splunk"
}

{
    "bw_serviceName": "Splunk",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "OrganizationUser_UpdatedGroups",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "memberId": "63433685-1129-5365-9291-307766514122",
        "actingUserId": "69342302-7372-5446-0534-410088376301",
        "installationId": "",
        "date": "2026-10-29T09:41:07.3141592Z",
        "device": "Chrome",
        "ipAddress": "198.51.100.42",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "actingUserName": "Jane Smith",
        "actingUserEmail": "jane.smith@example.org",
        "actingUserType": "Admin",
        "userName": "John Doe",
        "userEmail": "john.doe@example.org",
        "userType": "User",
        "groupName": ""
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1500",
        "typeName": "OrganizationUser_Invited",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "20138202-4204-5432-8065-855428611310",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "",
        "installationId": "",
        "date": "2026-10-29T14:13:05.9012345Z",
        "deviceName": "Server",
        "device": "22",
        "ipAddress": "",
        "systemUser": "1",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "",
                "email": "",
                "type": ""
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1503",
        "typeName": "OrganizationUser_Removed",
        "memberId": "63433685-1129-5365-9291-307766514122",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "20138202-4204-5432-8065-855428611310",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "69342302-7372-5446-0534-410088376301",
        "installationId": "",
        "date": "2026-10-29T14:13:20.2222222Z",
        "deviceName": "Chrome",
        "device": "9",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "Jane Smith",
                "email": "jane.smith@example.org",
                "type": "Admin"
            },
            "member": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1502",
        "typeName": "OrganizationUser_Updated",
        "memberId": "63433685-1129-5365-9291-307766514122",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "20138202-4204-5432-8065-855428611310",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "69342302-7372-5446-0534-410088376301",
        "installationId": "",
        "date": "2026-10-29T14:13:10.1111111Z",
        "deviceName": "Chrome",
        "device": "9",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "Jane Smith",
                "email": "jane.smith@example.org",
                "type": "Admin"
            },
            "member": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1700",
        "typeName": "Policy_Updated",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "03757203-3504-5022-9505-651204604408",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "48398861-7694-5114-1592-813193405245",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "69342302-7372-5446-0534-410088376301",
        "installationId": "",
        "date": "2026-10-29T14:13:45.5555555Z",
        "deviceName": "Chrome",
        "device": "9",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "Jane Smith",
                "email": "jane.smith@example.org",
                "type": "Admin"
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "2100",
        "typeName": "Secret_Retrieved",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "",
        "installationId": "",
        "date": "2026-10-29T14:14:00.7777777Z",
        "deviceName": "SDK",
        "device": "21",
        "ipAddress": "10.0.4.55",
        "systemUser": "",
        "domainName": "",
        "secretId": "94219396-1911-5436-1253-354062881605",
        "projectId": "75321928-4921-5130-8820-100745768422",
        "serviceAccountId": "15125118-3949-5055-0103-605374006322",
        "enrichment_details": {
            "actingUser": {
                "name": "",
                "email": "",
                "type": ""
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "2510",
        "typeName": "Send_Accessed_Text",
        "memberId": "63433685-1129-5365-9291-307766514122",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "",
        "installationId": "",
        "date": "2026-10-29T14:14:20.9999999Z",
        "deviceName": "Firefox",
        "device": "10",
        "ipAddress": "203.0.113.9",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "",
                "email": "",
                "type": ""
            },
            "member": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "2501",
        "typeName": "Send_Created_Text_WithEmailVerification",
        "memberId": "63433685-1129-5365-9291-307766514122",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "63433685-1129-5365-9291-307766514122",
        "installationId": "",
        "date": "2026-10-29T14:14:10.8888888Z",
        "deviceName": "Linux",
        "device": "8",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "member": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "2300",
        "typeName": "ServiceAccount_UserAdded",
        "memberId": "20138202-4204-5432-8065-855428611310",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "69342302-7372-5446-0534-410088376301",
        "installationId": "",
        "date": "2026-10-29T14:14:05.7654321Z",
        "deviceName": "Chrome",
        "device": "9",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "15125118-3949-5055-0103-605374006322",
        "enrichment_details": {
            "actingUser": {
                "name": "Jane Smith",
                "email": "jane.smith@example.org",
                "type": "Admin"
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1608",
        "typeName": "Organization_SponsorshipsSynced",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "",
        "installationId": "12345678-9012-3456-7890-123456789012",
        "date": "2026-10-29T03:00:00.4242424Z",
        "deviceName": "",
        "device": "",
        "ipAddress": "",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "",
                "email": "",
                "type": ""
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "source": "other-application",
    "severity": "info",
    "message": "Service started"
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "2700",
        "typeName": "Unknown_FutureEvent",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "69342302-7372-5446-0534-410088376301",
        "installationId": "",
        "date": "2026-10-29T14:14:50.1212121Z",
        "deviceName": "Chrome",
        "device": "9",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "Jane Smith",
                "email": "jane.smith@example.org",
                "type": "Admin"
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "9999",
        "typeName": "",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "69342302-7372-5446-0534-410088376301",
        "installationId": "",
        "date": "2026-10-29T14:14:50.1212121Z",
        "deviceName": "Chrome",
        "device": "9",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "Jane Smith",
                "email": "jane.smith@example.org",
                "type": "Admin"
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1007",
        "typeName": "User_ClientExportedVault",
        "memberId": "63433685-1129-5365-9291-307766514122",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "63433685-1129-5365-9291-307766514122",
        "installationId": "",
        "date": "2026-10-29T14:12:00.4567890Z",
        "deviceName": "Windows",
        "device": "6",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "member": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1005",
        "typeName": "User_FailedLogIn",
        "memberId": "63433685-1129-5365-9291-307766514122",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "63433685-1129-5365-9291-307766514122",
        "installationId": "",
        "date": "2026-10-29T14:11:02.2345678Z",
        "deviceName": "macOS",
        "device": "7",
        "ipAddress": "203.0.113.77",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "member": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1006",
        "typeName": "User_FailedLogIn2fa",
        "memberId": "63433685-1129-5365-9291-307766514122",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "63433685-1129-5365-9291-307766514122",
        "installationId": "",
        "date": "2026-10-29T14:11:30.3456789Z",
        "deviceName": "iOS",
        "device": "1",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "member": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1000",
        "typeName": "User_LoggedIn",
        "memberId": "63433685-1129-5365-9291-307766514122",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "63433685-1129-5365-9291-307766514122",
        "installationId": "",
        "date": "2026-10-29T14:10:05.1234567Z",
        "deviceName": "Chrome",
        "device": "9",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "member": {
                "name": "John Doe",
                "email": "john.doe@example.org",
                "type": "User"
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1602",
        "typeName": "Organization_ClientExportedVault",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "69342302-7372-5446-0534-410088376301",
        "installationId": "",
        "date": "2026-10-29T14:35:00.0000000Z",
        "deviceName": "Android",
        "device": "0",
        "ipAddress": "10.0.1.10",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "Jane Smith",
                "email": "jane.smith@example.org",
                "type": "Admin"
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

{
    "bw_serviceName": "Generic HEC",
    "source": "bitwarden",
    "service": "event-logs",
    "event": {
        "object": "event",
        "type": "1601",
        "typeName": "Organization_PurgedVault",
        "memberId": "",
        "organizationId": "org-12345678",
        "providerId": "",
        "itemId": "",
        "collectionId": "",
        "groupId": "",
        "policyId": "",
        "organizationUserId": "",
        "providerUserId": "",
        "providerOrganizationId": "",
        "actingUserId": "69342302-7372-5446-0534-410088376301",
        "installationId": "",
        "date": "2026-10-29T14:13:30.3333333Z",
        "deviceName": "Chrome",
        "device": "9",
        "ipAddress": "198.51.100.42",
        "systemUser": "",
        "domainName": "",
        "secretId": "",
        "projectId": "",
        "serviceAccountId": "",
        "enrichment_details": {
            "actingUser": {
                "name": "Jane Smith",
                "email": "jane.smith@example.org",
                "type": "Admin"
            },
            "member": {
                "name": "",
                "email": "",
                "type": ""
            },
            "group": {
                "name": ""
            },
            "organization": {
                "name": "Example Corp"
            }
        }
    }
}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Authentication logs User sign-in attempts, password changes, and two-factor authentication events.
Application logs Vault items, Bitwarden Send, organization administration, and Secrets Manager activity.

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind event
Category ``
Type ``

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1102\",\"typeName\":\"Cipher_Deleted\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"53346505-2478-5954-0938-639445164520\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"63433685-1129-5365-9291-307766514122\",\"installationId\":\"\",\"date\":\"2026-10-29T14:12:15.5678901Z\",\"deviceName\":\"Chrome\",\"device\":\"9\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Cipher_Deleted",
        "category": [
            "file"
        ],
        "code": "1102",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "deletion"
        ]
    },
    "@timestamp": "2026-10-29T14:12:15.567890Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 9,
                "type_name": "Chrome"
            },
            "item": {
                "id": "53346505-2478-5954-0938-639445164520"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "john.doe@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "john.doe@example.org",
        "full_name": "John Doe",
        "id": "63433685-1129-5365-9291-307766514122",
        "name": "john.doe@example.org",
        "roles": [
            "User"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1108\",\"typeName\":\"Cipher_ClientToggledPasswordVisible\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"e31a8c04-9812-4c21-b1e9-a3f1012de22a\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"69342302-7372-5446-0534-410088376301\",\"installationId\":\"\",\"date\":\"2026-10-29T14:32:10.1230000Z\",\"deviceName\":\"Chrome Extension\",\"device\":\"2\",\"ipAddress\":\"192.168.1.120\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"Jane Smith\",\"email\":\"jane.smith@example.org\",\"type\":\"Admin\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Cipher_ClientToggledPasswordVisible",
        "category": [
            "file"
        ],
        "code": "1108",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-10-29T14:32:10.123000Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 2,
                "type_name": "Chrome Extension"
            },
            "item": {
                "id": "e31a8c04-9812-4c21-b1e9-a3f1012de22a"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "192.168.1.120"
        ],
        "user": [
            "jane.smith@example.org"
        ]
    },
    "source": {
        "address": "192.168.1.120",
        "ip": "192.168.1.120"
    },
    "user": {
        "email": "jane.smith@example.org",
        "full_name": "Jane Smith",
        "id": "69342302-7372-5446-0534-410088376301",
        "name": "jane.smith@example.org",
        "roles": [
            "Admin"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1101\",\"typeName\":\"Cipher_Updated\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"26902048-2171-5399-9494-223083753413\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"63433685-1129-5365-9291-307766514122\",\"installationId\":\"\",\"date\":\"2026-10-29T14:12:20.6789012Z\",\"deviceName\":\"\",\"device\":\"\",\"ipAddress\":\"\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Cipher_Updated",
        "category": [
            "file"
        ],
        "code": "1101",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "change"
        ]
    },
    "@timestamp": "2026-10-29T14:12:20.678901Z",
    "bitwarden": {
        "password_manager": {
            "item": {
                "id": "26902048-2171-5399-9494-223083753413"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "user": [
            "john.doe@example.org"
        ]
    },
    "user": {
        "email": "john.doe@example.org",
        "full_name": "John Doe",
        "id": "63433685-1129-5365-9291-307766514122",
        "name": "john.doe@example.org",
        "roles": [
            "User"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1300\",\"typeName\":\"Collection_Created\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"49592089-1612-5901-8305-563971413203\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"69342302-7372-5446-0534-410088376301\",\"installationId\":\"\",\"date\":\"2026-10-29T14:12:40.7890123Z\",\"deviceName\":\"Chrome\",\"device\":\"9\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"Jane Smith\",\"email\":\"jane.smith@example.org\",\"type\":\"Admin\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Collection_Created",
        "category": [
            "file"
        ],
        "code": "1300",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "creation"
        ]
    },
    "@timestamp": "2026-10-29T14:12:40.789012Z",
    "bitwarden": {
        "password_manager": {
            "collection": {
                "id": "49592089-1612-5901-8305-563971413203"
            },
            "device": {
                "type_id": 9,
                "type_name": "Chrome"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "jane.smith@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "jane.smith@example.org",
        "full_name": "Jane Smith",
        "id": "69342302-7372-5446-0534-410088376301",
        "name": "jane.smith@example.org",
        "roles": [
            "Admin"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1616\",\"typeName\":\"Organization_CollectionManagement_AllowAdminAccessToAllCollectionItemsEnabled\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"69342302-7372-5446-0534-410088376301\",\"installationId\":\"\",\"date\":\"2026-10-29T14:13:40.4444444Z\",\"deviceName\":\"Chrome\",\"device\":\"9\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"Jane Smith\",\"email\":\"jane.smith@example.org\",\"type\":\"Admin\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Organization_CollectionManagement_AllowAdminAccessToAllCollectionItemsEnabled",
        "category": [
            "configuration"
        ],
        "code": "1616",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "change"
        ]
    },
    "@timestamp": "2026-10-29T14:13:40.444444Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 9,
                "type_name": "Chrome"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "jane.smith@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "jane.smith@example.org",
        "full_name": "Jane Smith",
        "id": "69342302-7372-5446-0534-410088376301",
        "name": "jane.smith@example.org",
        "roles": [
            "Admin"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1114\",\"typeName\":\"Cipher_ClientAutofilled\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"95025527-4378-5000-0022-676165103353\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"63433685-1129-5365-9291-307766514122\",\"installationId\":\"\",\"date\":\"2026-10-29T14:16:00.1357913Z\",\"deviceType\":\"Firefox Extension\",\"device\":\"3\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Cipher_ClientAutofilled",
        "category": [
            "file"
        ],
        "code": "1114",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-10-29T14:16:00.135791Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 3,
                "type_name": "Firefox Extension"
            },
            "item": {
                "id": "95025527-4378-5000-0022-676165103353"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "john.doe@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "john.doe@example.org",
        "full_name": "John Doe",
        "id": "63433685-1129-5365-9291-307766514122",
        "name": "john.doe@example.org",
        "roles": [
            "User"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"2003\",\"typeName\":\"OrganizationDomain_NotVerified\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"\",\"installationId\":\"\",\"date\":\"2026-10-29T02:00:00.6666666Z\",\"deviceName\":\"Server\",\"device\":\"22\",\"ipAddress\":\"\",\"systemUser\":\"2\",\"domainName\":\"corp.example.org\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "OrganizationDomain_NotVerified",
        "category": [
            "configuration"
        ],
        "code": "2003",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "failure",
        "type": [
            "change"
        ]
    },
    "@timestamp": "2026-10-29T02:00:00.666666Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 22,
                "type_name": "Server"
            },
            "domain": {
                "name": "corp.example.org"
            },
            "system_user": {
                "id": 2,
                "name": "DomainVerification"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1000\",\"typeName\":\"User_LoggedIn\",\"memberId\":\"\",\"organizationId\":\"\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"\",\"installationId\":\"\",\"date\":\"2026-10-29T14:15:00.0000000Z\",\"deviceName\":\"\",\"device\":\"\",\"ipAddress\":\"\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"\"}}}}",
    "event": {
        "action": "User_LoggedIn",
        "category": [
            "authentication"
        ],
        "code": "1000",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "@timestamp": "2026-10-29T14:15:00Z",
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1401\",\"typeName\":\"Group_Updated\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"14755408-0494-5740-0137-903672455227\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"69342302-7372-5446-0534-410088376301\",\"installationId\":\"\",\"date\":\"2026-10-29T14:13:00.8901234Z\",\"deviceName\":\"Chrome\",\"device\":\"9\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"Jane Smith\",\"email\":\"jane.smith@example.org\",\"type\":\"Admin\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"Engineering\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Group_Updated",
        "category": [
            "iam"
        ],
        "code": "1401",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "change",
            "group"
        ]
    },
    "@timestamp": "2026-10-29T14:13:00.890123Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 9,
                "type_name": "Chrome"
            }
        }
    },
    "group": {
        "id": "14755408-0494-5740-0137-903672455227",
        "name": "Engineering"
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "jane.smith@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "jane.smith@example.org",
        "full_name": "Jane Smith",
        "id": "69342302-7372-5446-0534-410088376301",
        "name": "jane.smith@example.org",
        "roles": [
            "Admin"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1111\",\"typeName\":\"Cipher_ClientCopiedPassword\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"69520243-0052-5223-1111-985817155144\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"63433685-1129-5365-9291-307766514122\",\"installationId\":\"\",\"date\":\"2026-10-29T10:02:33.2718281Z\",\"deviceType\":\"Chrome Extension\",\"device\":\"2\",\"ipAddress\":\"192.168.1.120\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\"}}",
    "event": {
        "action": "Cipher_ClientCopiedPassword",
        "category": [
            "file"
        ],
        "code": "1111",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-10-29T10:02:33.271828Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 2,
                "type_name": "Chrome Extension"
            },
            "item": {
                "id": "69520243-0052-5223-1111-985817155144"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678"
    },
    "related": {
        "ip": [
            "192.168.1.120"
        ]
    },
    "source": {
        "address": "192.168.1.120",
        "ip": "192.168.1.120"
    },
    "user": {
        "id": "63433685-1129-5365-9291-307766514122"
    }
}

{
    "message": "{\"Event\":\"{\\\"Date\\\":\\\"2026-10-29T08:30:00.1122334Z\\\",\\\"Type\\\":1111,\\\"UserId\\\":null,\\\"OrganizationId\\\":\\\"org-12345678\\\",\\\"InstallationId\\\":null,\\\"ProviderId\\\":null,\\\"CipherId\\\":\\\"63548008-4792-5593-9820-754724344547\\\",\\\"CollectionId\\\":null,\\\"GroupId\\\":null,\\\"PolicyId\\\":null,\\\"OrganizationUserId\\\":null,\\\"ProviderUserId\\\":null,\\\"ProviderOrganizationId\\\":null,\\\"ActingUserId\\\":\\\"63433685-1129-5365-9291-307766514122\\\",\\\"DeviceType\\\":9,\\\"IpAddress\\\":\\\"198.51.100.42\\\",\\\"IdempotencyId\\\":\\\"20163122-3236-5387-0233-334192116230\\\",\\\"SystemUser\\\":null,\\\"DomainName\\\":null,\\\"SecretId\\\":null,\\\"ProjectId\\\":null,\\\"ServiceAccountId\\\":null,\\\"GrantedServiceAccountId\\\":null,\\\"SendId\\\":null,\\\"AccessRequestId\\\":null,\\\"AccessLeaseId\\\":null}\",\"Source\":\"Bitwarden\",\"Index\":\"main\",\"bw_serviceName\":\"Splunk\"}",
    "event": {
        "action": "Cipher_ClientCopiedPassword",
        "category": [
            "file"
        ],
        "code": "1111",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-10-29T08:30:00.112233Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 9,
                "type_name": "Chrome"
            },
            "item": {
                "id": "63548008-4792-5593-9820-754724344547"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "id": "63433685-1129-5365-9291-307766514122"
    }
}

{
    "message": "{\"bw_serviceName\":\"Splunk\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"OrganizationUser_UpdatedGroups\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"memberId\":\"63433685-1129-5365-9291-307766514122\",\"actingUserId\":\"69342302-7372-5446-0534-410088376301\",\"installationId\":\"\",\"date\":\"2026-10-29T09:41:07.3141592Z\",\"device\":\"Chrome\",\"ipAddress\":\"198.51.100.42\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"actingUserName\":\"Jane Smith\",\"actingUserEmail\":\"jane.smith@example.org\",\"actingUserType\":\"Admin\",\"userName\":\"John Doe\",\"userEmail\":\"john.doe@example.org\",\"userType\":\"User\",\"groupName\":\"\"}}",
    "event": {
        "action": "OrganizationUser_UpdatedGroups",
        "category": [
            "iam"
        ],
        "code": "1504",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "change",
            "user"
        ]
    },
    "@timestamp": "2026-10-29T09:41:07.314159Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_name": "Chrome"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "jane.smith@example.org",
            "john.doe@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "jane.smith@example.org",
        "full_name": "Jane Smith",
        "id": "69342302-7372-5446-0534-410088376301",
        "name": "jane.smith@example.org",
        "roles": [
            "Admin"
        ],
        "target": {
            "email": "john.doe@example.org",
            "full_name": "John Doe",
            "id": "63433685-1129-5365-9291-307766514122",
            "name": "john.doe@example.org",
            "roles": [
                "User"
            ]
        }
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1500\",\"typeName\":\"OrganizationUser_Invited\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"20138202-4204-5432-8065-855428611310\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"\",\"installationId\":\"\",\"date\":\"2026-10-29T14:13:05.9012345Z\",\"deviceName\":\"Server\",\"device\":\"22\",\"ipAddress\":\"\",\"systemUser\":\"1\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "OrganizationUser_Invited",
        "category": [
            "iam"
        ],
        "code": "1500",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "creation",
            "user"
        ]
    },
    "@timestamp": "2026-10-29T14:13:05.901234Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 22,
                "type_name": "Server"
            },
            "organization_user": {
                "id": "20138202-4204-5432-8065-855428611310"
            },
            "system_user": {
                "id": 1,
                "name": "SCIM"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1503\",\"typeName\":\"OrganizationUser_Removed\",\"memberId\":\"63433685-1129-5365-9291-307766514122\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"20138202-4204-5432-8065-855428611310\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"69342302-7372-5446-0534-410088376301\",\"installationId\":\"\",\"date\":\"2026-10-29T14:13:20.2222222Z\",\"deviceName\":\"Chrome\",\"device\":\"9\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"Jane Smith\",\"email\":\"jane.smith@example.org\",\"type\":\"Admin\"},\"member\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "OrganizationUser_Removed",
        "category": [
            "iam"
        ],
        "code": "1503",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "deletion",
            "user"
        ]
    },
    "@timestamp": "2026-10-29T14:13:20.222222Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 9,
                "type_name": "Chrome"
            },
            "organization_user": {
                "id": "20138202-4204-5432-8065-855428611310"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "jane.smith@example.org",
            "john.doe@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "jane.smith@example.org",
        "full_name": "Jane Smith",
        "id": "69342302-7372-5446-0534-410088376301",
        "name": "jane.smith@example.org",
        "roles": [
            "Admin"
        ],
        "target": {
            "email": "john.doe@example.org",
            "full_name": "John Doe",
            "id": "63433685-1129-5365-9291-307766514122",
            "name": "john.doe@example.org",
            "roles": [
                "User"
            ]
        }
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1502\",\"typeName\":\"OrganizationUser_Updated\",\"memberId\":\"63433685-1129-5365-9291-307766514122\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"20138202-4204-5432-8065-855428611310\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"69342302-7372-5446-0534-410088376301\",\"installationId\":\"\",\"date\":\"2026-10-29T14:13:10.1111111Z\",\"deviceName\":\"Chrome\",\"device\":\"9\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"Jane Smith\",\"email\":\"jane.smith@example.org\",\"type\":\"Admin\"},\"member\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "OrganizationUser_Updated",
        "category": [
            "iam"
        ],
        "code": "1502",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "change",
            "user"
        ]
    },
    "@timestamp": "2026-10-29T14:13:10.111111Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 9,
                "type_name": "Chrome"
            },
            "organization_user": {
                "id": "20138202-4204-5432-8065-855428611310"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "jane.smith@example.org",
            "john.doe@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "jane.smith@example.org",
        "full_name": "Jane Smith",
        "id": "69342302-7372-5446-0534-410088376301",
        "name": "jane.smith@example.org",
        "roles": [
            "Admin"
        ],
        "target": {
            "email": "john.doe@example.org",
            "full_name": "John Doe",
            "id": "63433685-1129-5365-9291-307766514122",
            "name": "john.doe@example.org",
            "roles": [
                "User"
            ]
        }
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1700\",\"typeName\":\"Policy_Updated\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"03757203-3504-5022-9505-651204604408\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"48398861-7694-5114-1592-813193405245\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"69342302-7372-5446-0534-410088376301\",\"installationId\":\"\",\"date\":\"2026-10-29T14:13:45.5555555Z\",\"deviceName\":\"Chrome\",\"device\":\"9\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"Jane Smith\",\"email\":\"jane.smith@example.org\",\"type\":\"Admin\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Policy_Updated",
        "category": [
            "configuration"
        ],
        "code": "1700",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "change"
        ]
    },
    "@timestamp": "2026-10-29T14:13:45.555555Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 9,
                "type_name": "Chrome"
            },
            "policy": {
                "id": "48398861-7694-5114-1592-813193405245"
            },
            "provider": {
                "id": "03757203-3504-5022-9505-651204604408"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "jane.smith@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "jane.smith@example.org",
        "full_name": "Jane Smith",
        "id": "69342302-7372-5446-0534-410088376301",
        "name": "jane.smith@example.org",
        "roles": [
            "Admin"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"2100\",\"typeName\":\"Secret_Retrieved\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"\",\"installationId\":\"\",\"date\":\"2026-10-29T14:14:00.7777777Z\",\"deviceName\":\"SDK\",\"device\":\"21\",\"ipAddress\":\"10.0.4.55\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"94219396-1911-5436-1253-354062881605\",\"projectId\":\"75321928-4921-5130-8820-100745768422\",\"serviceAccountId\":\"15125118-3949-5055-0103-605374006322\",\"enrichment_details\":{\"actingUser\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Secret_Retrieved",
        "category": [
            "file"
        ],
        "code": "2100",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-10-29T14:14:00.777777Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 21,
                "type_name": "SDK"
            },
            "project": {
                "id": "75321928-4921-5130-8820-100745768422"
            },
            "secret": {
                "id": "94219396-1911-5436-1253-354062881605"
            },
            "service_account": {
                "id": "15125118-3949-5055-0103-605374006322"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "10.0.4.55"
        ]
    },
    "source": {
        "address": "10.0.4.55",
        "ip": "10.0.4.55"
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"2510\",\"typeName\":\"Send_Accessed_Text\",\"memberId\":\"63433685-1129-5365-9291-307766514122\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"\",\"installationId\":\"\",\"date\":\"2026-10-29T14:14:20.9999999Z\",\"deviceName\":\"Firefox\",\"device\":\"10\",\"ipAddress\":\"203.0.113.9\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"member\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Send_Accessed_Text",
        "category": [
            "file"
        ],
        "code": "2510",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-10-29T14:14:20.999999Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 10,
                "type_name": "Firefox"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "203.0.113.9"
        ],
        "user": [
            "john.doe@example.org"
        ]
    },
    "source": {
        "address": "203.0.113.9",
        "ip": "203.0.113.9"
    },
    "user": {
        "target": {
            "email": "john.doe@example.org",
            "full_name": "John Doe",
            "id": "63433685-1129-5365-9291-307766514122",
            "name": "john.doe@example.org",
            "roles": [
                "User"
            ]
        }
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"2501\",\"typeName\":\"Send_Created_Text_WithEmailVerification\",\"memberId\":\"63433685-1129-5365-9291-307766514122\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"63433685-1129-5365-9291-307766514122\",\"installationId\":\"\",\"date\":\"2026-10-29T14:14:10.8888888Z\",\"deviceName\":\"Linux\",\"device\":\"8\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"member\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Send_Created_Text_WithEmailVerification",
        "category": [
            "file"
        ],
        "code": "2501",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "creation"
        ]
    },
    "@timestamp": "2026-10-29T14:14:10.888888Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 8,
                "type_name": "Linux"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "john.doe@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "john.doe@example.org",
        "full_name": "John Doe",
        "id": "63433685-1129-5365-9291-307766514122",
        "name": "john.doe@example.org",
        "roles": [
            "User"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"2300\",\"typeName\":\"ServiceAccount_UserAdded\",\"memberId\":\"20138202-4204-5432-8065-855428611310\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"69342302-7372-5446-0534-410088376301\",\"installationId\":\"\",\"date\":\"2026-10-29T14:14:05.7654321Z\",\"deviceName\":\"Chrome\",\"device\":\"9\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"15125118-3949-5055-0103-605374006322\",\"enrichment_details\":{\"actingUser\":{\"name\":\"Jane Smith\",\"email\":\"jane.smith@example.org\",\"type\":\"Admin\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "ServiceAccount_UserAdded",
        "category": [
            "iam"
        ],
        "code": "2300",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "change",
            "user"
        ]
    },
    "@timestamp": "2026-10-29T14:14:05.765432Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 9,
                "type_name": "Chrome"
            },
            "organization_user": {
                "id": "20138202-4204-5432-8065-855428611310"
            },
            "service_account": {
                "id": "15125118-3949-5055-0103-605374006322"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "jane.smith@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "jane.smith@example.org",
        "full_name": "Jane Smith",
        "id": "69342302-7372-5446-0534-410088376301",
        "name": "jane.smith@example.org",
        "roles": [
            "Admin"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1608\",\"typeName\":\"Organization_SponsorshipsSynced\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"\",\"installationId\":\"12345678-9012-3456-7890-123456789012\",\"date\":\"2026-10-29T03:00:00.4242424Z\",\"deviceName\":\"\",\"device\":\"\",\"ipAddress\":\"\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Organization_SponsorshipsSynced",
        "category": [
            "configuration"
        ],
        "code": "1608",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "change"
        ]
    },
    "@timestamp": "2026-10-29T03:00:00.424242Z",
    "bitwarden": {
        "password_manager": {
            "installation": {
                "id": "12345678-9012-3456-7890-123456789012"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    }
}

{
    "message": "{\"source\":\"other-application\",\"severity\":\"info\",\"message\":\"Service started\"}",
    "event": {
        "action": "Unknown_EventType",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "unknown"
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"2700\",\"typeName\":\"Unknown_FutureEvent\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"69342302-7372-5446-0534-410088376301\",\"installationId\":\"\",\"date\":\"2026-10-29T14:14:50.1212121Z\",\"deviceName\":\"Chrome\",\"device\":\"9\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"Jane Smith\",\"email\":\"jane.smith@example.org\",\"type\":\"Admin\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Unknown_FutureEvent",
        "code": "2700",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "unknown"
    },
    "@timestamp": "2026-10-29T14:14:50.121212Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 9,
                "type_name": "Chrome"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "jane.smith@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "jane.smith@example.org",
        "full_name": "Jane Smith",
        "id": "69342302-7372-5446-0534-410088376301",
        "name": "jane.smith@example.org",
        "roles": [
            "Admin"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"9999\",\"typeName\":\"\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"69342302-7372-5446-0534-410088376301\",\"installationId\":\"\",\"date\":\"2026-10-29T14:14:50.1212121Z\",\"deviceName\":\"Chrome\",\"device\":\"9\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"Jane Smith\",\"email\":\"jane.smith@example.org\",\"type\":\"Admin\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Unknown_EventType_9999",
        "code": "9999",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "unknown"
    },
    "@timestamp": "2026-10-29T14:14:50.121212Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 9,
                "type_name": "Chrome"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "jane.smith@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "jane.smith@example.org",
        "full_name": "Jane Smith",
        "id": "69342302-7372-5446-0534-410088376301",
        "name": "jane.smith@example.org",
        "roles": [
            "Admin"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1007\",\"typeName\":\"User_ClientExportedVault\",\"memberId\":\"63433685-1129-5365-9291-307766514122\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"63433685-1129-5365-9291-307766514122\",\"installationId\":\"\",\"date\":\"2026-10-29T14:12:00.4567890Z\",\"deviceName\":\"Windows\",\"device\":\"6\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"member\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "User_ClientExportedVault",
        "category": [
            "file"
        ],
        "code": "1007",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-10-29T14:12:00.456789Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 6,
                "type_name": "Windows"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "john.doe@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "john.doe@example.org",
        "full_name": "John Doe",
        "id": "63433685-1129-5365-9291-307766514122",
        "name": "john.doe@example.org",
        "roles": [
            "User"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1005\",\"typeName\":\"User_FailedLogIn\",\"memberId\":\"63433685-1129-5365-9291-307766514122\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"63433685-1129-5365-9291-307766514122\",\"installationId\":\"\",\"date\":\"2026-10-29T14:11:02.2345678Z\",\"deviceName\":\"macOS\",\"device\":\"7\",\"ipAddress\":\"203.0.113.77\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"member\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "User_FailedLogIn",
        "category": [
            "authentication"
        ],
        "code": "1005",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "failure",
        "type": [
            "start"
        ]
    },
    "@timestamp": "2026-10-29T14:11:02.234567Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 7,
                "type_name": "macOS"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "203.0.113.77"
        ],
        "user": [
            "john.doe@example.org"
        ]
    },
    "source": {
        "address": "203.0.113.77",
        "ip": "203.0.113.77"
    },
    "user": {
        "email": "john.doe@example.org",
        "full_name": "John Doe",
        "id": "63433685-1129-5365-9291-307766514122",
        "name": "john.doe@example.org",
        "roles": [
            "User"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1006\",\"typeName\":\"User_FailedLogIn2fa\",\"memberId\":\"63433685-1129-5365-9291-307766514122\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"63433685-1129-5365-9291-307766514122\",\"installationId\":\"\",\"date\":\"2026-10-29T14:11:30.3456789Z\",\"deviceName\":\"iOS\",\"device\":\"1\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"member\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "User_FailedLogIn2fa",
        "category": [
            "authentication"
        ],
        "code": "1006",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "failure",
        "type": [
            "start"
        ]
    },
    "@timestamp": "2026-10-29T14:11:30.345678Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 1,
                "type_name": "iOS"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "john.doe@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "john.doe@example.org",
        "full_name": "John Doe",
        "id": "63433685-1129-5365-9291-307766514122",
        "name": "john.doe@example.org",
        "roles": [
            "User"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1000\",\"typeName\":\"User_LoggedIn\",\"memberId\":\"63433685-1129-5365-9291-307766514122\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"63433685-1129-5365-9291-307766514122\",\"installationId\":\"\",\"date\":\"2026-10-29T14:10:05.1234567Z\",\"deviceName\":\"Chrome\",\"device\":\"9\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"member\":{\"name\":\"John Doe\",\"email\":\"john.doe@example.org\",\"type\":\"User\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "User_LoggedIn",
        "category": [
            "authentication"
        ],
        "code": "1000",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "@timestamp": "2026-10-29T14:10:05.123456Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 9,
                "type_name": "Chrome"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "john.doe@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "john.doe@example.org",
        "full_name": "John Doe",
        "id": "63433685-1129-5365-9291-307766514122",
        "name": "john.doe@example.org",
        "roles": [
            "User"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1602\",\"typeName\":\"Organization_ClientExportedVault\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"69342302-7372-5446-0534-410088376301\",\"installationId\":\"\",\"date\":\"2026-10-29T14:35:00.0000000Z\",\"deviceName\":\"Android\",\"device\":\"0\",\"ipAddress\":\"10.0.1.10\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"Jane Smith\",\"email\":\"jane.smith@example.org\",\"type\":\"Admin\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Organization_ClientExportedVault",
        "category": [
            "file"
        ],
        "code": "1602",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-10-29T14:35:00Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 0,
                "type_name": "Android"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "10.0.1.10"
        ],
        "user": [
            "jane.smith@example.org"
        ]
    },
    "source": {
        "address": "10.0.1.10",
        "ip": "10.0.1.10"
    },
    "user": {
        "email": "jane.smith@example.org",
        "full_name": "Jane Smith",
        "id": "69342302-7372-5446-0534-410088376301",
        "name": "jane.smith@example.org",
        "roles": [
            "Admin"
        ]
    }
}

{
    "message": "{\"bw_serviceName\":\"Generic HEC\",\"source\":\"bitwarden\",\"service\":\"event-logs\",\"event\":{\"object\":\"event\",\"type\":\"1601\",\"typeName\":\"Organization_PurgedVault\",\"memberId\":\"\",\"organizationId\":\"org-12345678\",\"providerId\":\"\",\"itemId\":\"\",\"collectionId\":\"\",\"groupId\":\"\",\"policyId\":\"\",\"organizationUserId\":\"\",\"providerUserId\":\"\",\"providerOrganizationId\":\"\",\"actingUserId\":\"69342302-7372-5446-0534-410088376301\",\"installationId\":\"\",\"date\":\"2026-10-29T14:13:30.3333333Z\",\"deviceName\":\"Chrome\",\"device\":\"9\",\"ipAddress\":\"198.51.100.42\",\"systemUser\":\"\",\"domainName\":\"\",\"secretId\":\"\",\"projectId\":\"\",\"serviceAccountId\":\"\",\"enrichment_details\":{\"actingUser\":{\"name\":\"Jane Smith\",\"email\":\"jane.smith@example.org\",\"type\":\"Admin\"},\"member\":{\"name\":\"\",\"email\":\"\",\"type\":\"\"},\"group\":{\"name\":\"\"},\"organization\":{\"name\":\"Example Corp\"}}}}",
    "event": {
        "action": "Organization_PurgedVault",
        "category": [
            "file"
        ],
        "code": "1601",
        "dataset": "bitwarden.event_logs",
        "kind": "event",
        "outcome": "success",
        "type": [
            "deletion"
        ]
    },
    "@timestamp": "2026-10-29T14:13:30.333333Z",
    "bitwarden": {
        "password_manager": {
            "device": {
                "type_id": 9,
                "type_name": "Chrome"
            }
        }
    },
    "observer": {
        "product": "Password Manager",
        "vendor": "Bitwarden"
    },
    "organization": {
        "id": "org-12345678",
        "name": "Example Corp"
    },
    "related": {
        "ip": [
            "198.51.100.42"
        ],
        "user": [
            "jane.smith@example.org"
        ]
    },
    "source": {
        "address": "198.51.100.42",
        "ip": "198.51.100.42"
    },
    "user": {
        "email": "jane.smith@example.org",
        "full_name": "Jane Smith",
        "id": "69342302-7372-5446-0534-410088376301",
        "name": "jane.smith@example.org",
        "roles": [
            "Admin"
        ]
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
bitwarden.password_manager.collection.id keyword Unique identifier of the organization collection.
bitwarden.password_manager.device.type_id long Numeric identifier of the client device type (Bitwarden DeviceType enum).
bitwarden.password_manager.device.type_name keyword Display name of the client device type (e.g. Chrome Extension, iOS, Windows CLI).
bitwarden.password_manager.domain.name keyword Claimed or verified domain name associated with the organization.
bitwarden.password_manager.installation.id keyword Unique identifier of the self-hosted Bitwarden installation.
bitwarden.password_manager.item.id keyword Unique identifier of the Bitwarden vault item (cipher).
bitwarden.password_manager.organization_user.id keyword Unique identifier of the organization membership (OrganizationUser) concerned by the event.
bitwarden.password_manager.policy.id keyword Unique identifier of the Bitwarden enterprise policy.
bitwarden.password_manager.project.id keyword Unique identifier of the Bitwarden Secrets Manager project.
bitwarden.password_manager.provider.id keyword Unique identifier of the Bitwarden provider (MSP).
bitwarden.password_manager.secret.id keyword Unique identifier of the Bitwarden Secrets Manager secret.
bitwarden.password_manager.service_account.id keyword Unique identifier of the Bitwarden Secrets Manager service account (machine account).
bitwarden.password_manager.system_user.id long Numeric identifier of the system actor (EventSystemUser enum: 0 Unknown, 1 SCIM, 2 DomainVerification, 3 PublicApi, 4 TwoFactorDisabled, 5 BitwardenPortal, 6 Pam).
bitwarden.password_manager.system_user.name keyword Name of the system actor that performed the event (EventSystemUser enum).
event.action keyword The action captured by the event.
event.category keyword Event category. The second categorization field in the hierarchy.
event.code keyword Identification code for this event.
event.dataset keyword Name of the dataset.
event.kind keyword The kind of the event. The highest categorization field in the hierarchy.
event.outcome keyword The outcome of the event. The lowest level categorization field in the hierarchy.
event.type keyword Event type. The third categorization field in the hierarchy.
group.id keyword Unique identifier for the group on the system/platform.
group.name keyword Name of the group.
observer.product keyword The product name of the observer.
observer.vendor keyword Vendor name of the observer.
organization.id keyword Unique identifier for the organization.
organization.name keyword Organization name.
source.ip ip IP address of the source.
user.email keyword User email address.
user.full_name keyword User's full name, if available.
user.id keyword Unique identifier of the user.
user.name keyword Short name or login of the user.
user.roles keyword Array of user roles at the time of the event.
user.target.email keyword User email address.
user.target.full_name keyword User's full name, if available.
user.target.id keyword Unique identifier of the user.
user.target.name keyword Short name or login of the user.
user.target.roles keyword Array of user roles at the time of the event.

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.

Further readings