Overview

The Bitbucket integration uses Bitbucket Cloud OAuth 2.0 to authenticate, then polls the Bitbucket Audit Log API to collect:

• Repository creation, deletion, and visibility changes
• Pull request opens, merges, declines, and approvals
• Workspace member, group, and permission changes
• App password and access token activity
• Branch restriction and pipeline configuration changes

Prerequisites

• A Bitbucket Cloud workspace on a plan that includes audit logs (Premium).
• Workspace Admin permission to create OAuth consumers.

Step 1: Create an OAuth consumer in Bitbucket

1. Sign in to Bitbucket Cloud.
2. Open your workspace and go to Workspace settings → OAuth consumers.
3. Click Add consumer.
4. Fill in:
   • Name: atatus-siem
   • Callback URL: https://atatus.com/oauth/callback (placeholder; not used for client-credentials flow)
   • This is a private consumer: checked
5. Under Permissions, grant:
   • Account → Read
   • Workspace membership → Read
   • Repositories → Read
6. Click Save, then open the consumer to copy the Key (Client ID) and Secret (Client Secret).

Step 2: Connect Bitbucket in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the Bitbucket card and click Connect.
3. Fill in the form:

1. Click Connect.

Verification

• The Bitbucket card shows Configured.
• Audit events appear in Security → Cloud SIEM → Audit Logs → Events with source bitbucket.