BitSight Event Collector
This Integration is part of the Bitsight Pack.#
Supported versions
Available on Cortex XSIAM.
Use this integration to fetch BitSight security findings as events in Cortex XSIAM. This is important for organizations that wish to integrate BitSight programmatically into their security operations.
When configured as a fetching integration, it will continuously fetch new findings starting from the current day. The manual bitsight-get-events command fetches findings from the last 2 days (48 hours) by default, or from an explicit date range when start_date and/or end_date are provided.
Configure BitSight Event Collector in Cortex#
| Parameter | Description | Required | Default Value |
|---|---|---|---|
| Server URL | REST API Endpoint of BitSight server. | True | https://api.bitsighttech.com |
| API Key | BitSight API token. | True | - |
| Company's GUID | Optional. If provided, findings for this company and its subsidiaries will be collected. If omitted, the collector attempts to use myCompany.guid. | False | - |
| Trust any certificate (not secure) | False | - | |
| Use system proxy settings | False | - | |
| Max events per fetch | Maximum number of findings to fetch at a time. | False | 1000 |
| Events Fetch Interval | Interval between fetch operations. | False | 5 |
Commands#
You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
bitsight-get-events#
Gets findings as events from BitSight Event Collector. By default, the command fetches findings from the last 2 days (48 hours). When start_date and/or end_date are provided, it fetches findings from that date range instead. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
Base Command#
bitsight-get-events
Input#
| Argument Name | Description | Required | Default Value |
|---|---|---|---|
| limit | The number of events to return. | Optional | 5 |
| guid | Override the Company GUID for this command only. | Optional | - |
| should_push_events | Set this argument to True in order to create events, otherwise the command will only display them. Possible values are: true, false. | Required | false |
| start_date | The start date on or after which findings were first seen. Accepts free text (e.g., "2 days ago", "1 week ago") or a date (e.g., 2026-08-31). Defaults to 2 days before end_date. When start_date or end_date is provided, this date range is used instead of the default 2-day lookback. | Optional | - |
| end_date | The end date on or before which findings were first seen. Accepts free text (e.g., "now", "1 day ago") or a date (e.g., 2026-09-02). Defaults to now. Must not be earlier than start_date. | Optional | - |
Context Output#
There is no context output for this command.
Notes#
API Date Format Limitation: The BitSight API returns first_seen timestamps in date-only format (YYYY-MM-DD) without hours or minutes. The integration converts these to full timestamps in the _time field for XSIAM compatibility. This means all events will show timestamps like 2025-08-30T00:00:00 (midnight UTC) regardless of when during that day the finding was actually discovered.