# Daily Bitwarden security briefing for your Slack channel

> Every morning at 8am, read the last day of Bitwarden organization activity, flag only the risky moments, and post a short brief to Slack.

- Workflow type: agent
- Services: Bitwarden, Slack Bot
- Categories: Operations, Engineering
- Published: 2026-08-04

## What it does

- Reads the last 24 hours of activity in your Bitwarden organization every morning at 8am.
- Matches every action to the person who took it, so you read real names and email addresses instead of ID codes.
- Surfaces only what matters for security: failed sign-ins, two-factor being switched off, people gaining more access, vault exports, deleted collections, and policy changes.
- Groups the findings by person, calls out anything that looks like a compromised account or an unusual burst of activity, and posts it to your security channel in Slack with a clear all-clear when nothing happened.

## What you'll need

- A Bitwarden organization on a Teams or Enterprise plan, since those are the only plans where Bitwarden keeps an organization activity log.
- Owner access to that Bitwarden organization, because only an owner can create the key this workflow uses to read the log.
- A Slack workspace and the channel you want the briefing posted to.

## Prompt

Every morning at 8am on a cron trigger, turn the last 24 hours of my Bitwarden organization activity into a short security briefing in Slack instead of a raw log dump.

Start with the Bitwarden List Events operation, querying from 24 hours before the run up to now. /events is the only paged endpoint in the Bitwarden public API and it pages with a continuationToken: keep requesting the next page, passing the token back each time, until the returned token is null. Stopping after the first page will silently read a fraction of the day and make a busy day look quiet.

Bitwarden identifies the actor on each event by member id, not by name. Call List Members once and build a lookup from member id to name and email so every finding in the briefing names a real person. If an actor id has no matching member, report it by id and note that the account appears to have been removed, since that is itself worth knowing.

Triage rather than forward. Bitwarden logs more than 50 event types and most of them are routine noise. Keep only what matters for security: failed login attempts, two factor authentication being switched off, member role escalations such as someone moving to Admin or Owner or being granted broader permissions, vault or organization exports, collection deletions, and organization policy changes. Stay quiet about routine item edits, item views, and ordinary successful logins that have nothing else attached to them.

Group the findings by person. For each person, give their name and email, then a short list of what they did and when. Then read across the whole day and describe patterns rather than listing lines: repeated failed logins followed by a successful one, two factor being disabled shortly before an export, a member escalating their own role, activity at an unusual hour for that person, or a burst of activity from one account that is well outside their normal pattern. Where something looks like an account takeover, say so plainly and name the first thing you would check.

Post the briefing to our security channel in Slack using the Slack Bot Send a Message operation. Keep it readable on a phone: a one-line headline verdict first, then the per-person findings, then the patterns worth investigating. When nothing noteworthy happened, say so explicitly with a short all clear rather than posting nothing, so an empty channel is never mistaken for a broken workflow.

Constraints to respect. Event logs require a Teams or Enterprise organization and the events request returns 403 on any other plan; if that happens, post a message to the channel explaining the plan requirement instead of failing silently. Client-side events flush to the Bitwarden server roughly every 60 seconds, so the final minute of the window may lag and will appear in the next day's briefing. A single events query can span at most 367 days, which is far wider than the 24 hour window this uses. The trigger is cron because the Bitwarden public API does not send outgoing webhooks.

## How to customize

- Change the timing: run it at 7am, twice a day, or only on weekdays.
- Adjust what counts as noteworthy: add or drop the kinds of activity you care about, or change how many failed sign-ins it takes before someone gets called out.
- Change where it lands: a private security channel, a direct message to your IT lead, or several channels at once.

## Example output

Bitwarden security briefing, 8:00am

Headline: one account worth investigating today, everything else routine.

Dana Okafor (dana@acme.com)
- 11 failed login attempts between 02:14 and 02:31 UTC, then a successful login at 02:33
- Two-factor authentication turned off at 02:41
- Organization vault exported at 02:44
This reads like an account takeover: a burst of failures at an unusual hour, followed by a successful login, two-factor removed, and an export within minutes. Suggest revoking the session, resetting the password, and confirming with Dana directly before re-enabling access.

Marcus Lee (marcus@acme.com)
- Role changed from User to Admin at 15:02 UTC by Priya Shah (priya@acme.com)
Expected if this was part of the ops handover, worth a quick confirmation otherwise.

Policy changes
- Master password requirements policy updated at 16:20 UTC by Priya Shah

Nothing else in the last 24 hours needed attention. Routine item edits and views were left out.

## FAQ

### Does this work with a free Bitwarden account?

No. Bitwarden only keeps an organization activity log on Teams and Enterprise plans, so this needs one of those. On any other plan the workflow will tell you in Slack that the log is not available rather than failing quietly.

### Will I get a message every day, even when nothing happened?

Yes, and that is deliberate. A quiet channel is ambiguous: it could mean a calm day or a broken workflow. On uneventful days you get a one-line all clear so you know the check actually ran.

### Can this see anyone's passwords or vault contents?

No. It only reads the activity log, which records what people did and when. It never opens vault items or reads stored credentials.

### How does it decide what is worth telling me about?

Bitwarden records more than fifty kinds of activity and most of it is routine. The briefing keeps the security-relevant ones, such as failed sign-ins, two-factor being turned off, permission increases, exports, deleted collections, and policy changes, and ignores everyday item edits.

### Do I need a security monitoring tool like Splunk for this?

No. Bitwarden connects to those tools if you already have one, but this gives smaller teams the same early warning without buying or running anything extra.

Use this prompt in General Input: https://www.generalinput.com/prompts/daily-bitwarden-security-briefing-for-your-slack-channel