Bitsight Integration

The Bitsight integration ingests Vulnerability evidence from the Bitsight Threats API and enriches each event with the originating threat and company metadata. Use it to:

• Track newly reported exposures affecting your organizations
• Correlate Bitsight findings with Elastic Security investigations
• Monitor remediation progress over time

Elastic Managed integrations are only supported on Elastic Cloud Serverless and Elastic Cloud Hosted deployments. An Elastic Managed integration lets you ingest data from a cloud source while avoiding the orchestration, management, and maintenance associated with standard ingest infrastructure. Elastic runs the collector for you, so you can focus on your data instead of the infrastructure that collects it.

For more information, refer to Elastic Managed integrations and the Elastic Managed integrations FAQ.

• Transport: HTTP(S) to Bitsight Threats API

• A Bitsight API token with access to the Threats endpoints
• Elastic Agent with network egress to Bitsight

1. In Kibana navigate to Integrations → Add integration → search for “Bitsight”.
2. Select the Vulnerability data stream and fill in:
   • Base URL (e.g., https://api.bitsighttech.com)
   • API token (Basic auth: username = token, password left blank)
   • Poll interval and batch size
   • Initial lookback window (how far back to fetch on first run)

The data stream walks the Threats API depth‑first and emits one document per evidence row:

• Threat list: GET /ratings/v2/threats?category_slug=vulnerability&first_seen_date_gte=...&limit=...&sort=first_seen_date
• Companies per threat: GET /ratings/v2/threats/{threat_guid}/companies?limit=...
• Evidence per company: GET /ratings/v2/threats/{threat_guid}/companies/{company_guid}/evidence?limit=...

Behavior

• Pagination: Follows links.next when present
• Cursor: Persists cursor.last_first_seen_date to resume between runs
• Backoff: Pauses on HTTP 429 or 5xx to avoid hammering the API (queue is preserved)
• Output: Each event is a JSON string with threat, company, and evidence

Mappings & ECS

• event.kind=event, event.category=[vulnerability], event.type=[info]
• vulnerability.id derives from bitsight.threat.name (e.g., CVE-…)
• host.ip extracted from bitsight.evidence.identifier when it looks like ip:port

When enabled, the Agent writes HTTP traces to logs/cel/http-request-trace-*.ndjson on the host. These files may contain sensitive payloads—disable the tracer after capturing evidence.

• 401/403: Verify the token is valid; Basic auth uses the token as the username and a blank password
• 429/5xx: The integration backs off and preserves the queue; check later or reduce polling rate
• No events: Confirm time window (initial lookback) and that Threats API returns results for the period
• Ingest mismatches: Use “Preserve original event” and compare event.original against decoded fields

{
    "@timestamp": "2025-03-01T00:00:00.000Z",
    "bitsight": {
        "company": {
            "company_guid": "aaaa0000-bbbb-cccc-dddd-eeeeeeeeeeee",
            "company_name": "ExampleTech AG",
            "detection_types": [
                "standard"
            ],
            "evidence_certainty": "LIKELY",
            "evidence_tags": [
                {
                    "name": "Long time since last detection",
                    "slug": "LONG_TIME_SINCE_LAST_DETECTION"
                }
            ],
            "exposure_detection": "MITIGATED",
            "first_seen_date": "2025-02-03",
            "last_seen_date": "2025-03-01",
            "logo": "https://service.bitsighttech.com/customer-api/ratings/v1/companies/aaaa0000-bbbb-cccc-dddd-eeeeeeeeeeee/logo-image"
        },
        "evidence": {
            "certainty": "LIKELY",
            "detection_type": "standard",
            "evidence_tag": {
                "name": "Long time since last detection",
                "slug": "LONG_TIME_SINCE_LAST_DETECTION"
            },
            "exposure_detection": "MITIGATED",
            "first_seen_date": "2025-02-03",
            "identifier": "203.0.113.42:443",
            "last_seen_date": "2025-03-01"
        },
        "threat": {
            "category": {
                "name": "vulnerability",
                "slug": "vulnerability"
            },
            "dve": {
                "highest_score": 1.5,
                "highest_score_date": "2022-06-12T00:00:00",
                "score": 0.76
            },
            "epss": {
                "percentile": 80.9,
                "score": 1.6
            },
            "evidence_certainty": "LIKELY",
            "exposed_count": 0,
            "exposure_trend": -1,
            "first_seen_date": "2025-02-03",
            "guid": "11111111-aaaa-bbbb-cccc-222222222222",
            "last_seen_date": "2025-03-01",
            "mitigated_count": 1,
            "name": "CVE-2023-12345",
            "severity": {
                "details": "CVSS 6.1",
                "level": "Moderate"
            },
            "support_started_date": "2023-07-28"
        }
    },
    "host": {
        "ip": [
            "203.0.113.42"
        ]
    },
    "vulnerability": {
        "id": "CVE-2023-12345",
        "scanner": {
            "vendor": "Bitsight"
        },
        "score": {
            "base": 6.1
        },
        "severity": "Medium"
    }
}