Real time monitoring of Bitbucket workspace / Audit & Events monitoring via SIEM

[Roche I_ Randhir]

We would like to understand the feasibility of integrating SIEM with Bitbucket Workspace. Could you outline the possible approach for this integration? Additionally, is the purchase of Atlassian Guard required to enable 24x7 real-time monitoring? Please also provide details on the applicable licensing model.

Randhir

[Ben]

Hi @Roche I_ Randhir 

Audit logging is offered in both Bitbucket Cloud, as well as Atlassian Guard - so a Guard subscription is not required (although the Guard audit logs are much more granular and are exportable):

• https://support.atlassian.com/bitbucket-cloud/kb/bitbucket-cloud-audit-log-events/

I'll need some clarification on your integration question, however. Are you referring to integrating an existing third-party application? If so - may I know the name of it? Understanding your use case in greater detail will allow me to provide more effective guidance.

Cheers!

- Ben (Bitbucket Cloud Support)

[Roche I_ Randhir]

The integration what we are looking for is to with LogRhythm (SIEM Tool)

Thanks

Randhir

[Ben]

Hi @Roche I_ Randhir 

Thank you for clarifying.

Whilst the Bitbucket Cloud product does provide a general audit log, it is not exportable. Therefore, in this instance it appears you'll need exported audit logs/audit log API capabilities (which is only supported via Atlassian Guard.

Whilst I don't have integration information/guidance specifically for LogRhythm - you can find more information on the export feature as well as the audit log API in the documentation below:

• https://www.atlassian.com/blog/bitbucket/bitbucket-audit-logs-are-now-available-in-atlassian-access
• https://developer.atlassian.com/cloud/admin/organization/rest/api-group-events/#api-v1-orgs-orgid-events-get

I hope this helps.

Cheers!

- Ben (Bitbucket Cloud Support)