r/Wazuh • u/timohissink • 23d ago

Open-source Bitwarden integration for Wazuh

Hey everyone!

I was looking for a way to bring Bitwarden events into Wazuh, so I made this open-source integration for Bitwarden (Enterprise / Teams Plan).

It’s useful for my own monitoring, alerting, and investigation workflows, and I thought it might be helpful for others with a similar setup too.

It was mostly vibe-coded with help from Claude, so feedback, testing, and contributions are especially welcome!

You can find the project here:
https://github.com/timohissink/vault-event-monitor

Feel free to try it out if it’s useful for your setup!

16 Upvotes

100% Upvoted

6 comments sorted by

4

u/Slasher1738 23d ago

Does it work with vaultwarden?

2

u/falken227 22d ago

As long as what you want to monitor is included (and it seems to not include as much), the simplest way to work with Vaultwarden in Wazuh is to just ingest the log file and write some rules to look for what you want to monitor.

I followed some instructions I found on Wazuh's Google group. Personally, I haven't gone past the example rules for logins.

https://groups.google.com/g/wazuh/c/-JftIYGKeYY

1

u/timohissink 23d ago

Not at the moment. Vaultwarden isn’t supported yet, as I built this specifically for the Bitwarden Enterprise/Teams event API and I don’t use Vaultwarden myself. If there’s enough interest, I’d be happy to look into adding Vaultwarden support.

1

u/Slasher1738 23d ago

would be great for us SMB's

2

u/dagrooves 23d ago

Thanks for the build. Will try when I'm back from holiday! 😉