1Password-ItemUsage

Event	Title	Channel	Sample	Rule
any	Item usage (catch-all)	_catch_all	N	Y
enter-item-edit-mode	enter-item-edit-mode	enter-item-edit-mode	Y	N
export	export	export	Y	Y
fill	fill	fill	Y	N
other	other	other	N	N
reveal	reveal	reveal	Y	N
secure-copy	secure-copy	secure-copy	Y	N
select-sso-provider	select-sso-provider	select-sso-provider	N	N
server-create	server-create	server-create	Y	N
server-fetch	server-fetch	server-fetch	Y	N
server-update	server-update	server-update	Y	N
share	share	share	Y	N

any: Item usage (catch-all)

Description

Catch-all entry for 1Password rules that match item usage events without naming a specific action.

Fields #

Name	Description	Rules
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`used_version`
`vault_uuid`
`item_uuid`
`action`	The type of action that was performed.	2 detection rules
`user.uuid`
`user.name`	Full name
`user.email`
`user.user_type`
`user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Detection Patterns #

Persistence: Create Account

1Password-Invite invite-create: Create InviteOR1Password-ItemUsage any: Item usageOR1Password-SignInAttempt any: Sign-in attempt

1 rule

Kusto

1Password - Manual account creation (source)

Credential Access: Credentials from Password Stores

1Password-ItemUsage any: Item usageOR1Password-UserVaultAccess uva-grant: Grant User Vault AccessORuva-update: Update User Vault Access

1 rule

Kusto

1Password - Secret extraction post vault access change by administrator (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`action` (kusto rule field)	eq	`create`	1 rule	kusto
`action` (kusto rule field)	eq	`update`	1 rule	kusto
`log_source` (kusto rule field)	eq	`auditevents`	1 rule	kusto
`object_type` (kusto rule field)	eq	`uva`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

BETA - Sensitive 1Password Item Accessed source low: Alerts when a user defined list of sensitive items in 1Password is accessedT1552
Configuration Required - Sensitive 1Password Item Accessed source low: Alerts when a user defined list of sensitive items in 1Password is accessedT1552

enter-item-edit-mode

Description

1Password apps: Add an item to Favorites. Edit an item. Usage is recorded upon selecting Edit, whether or not the item is modified.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`used_version`
`vault_uuid`
`item_uuid`
`action`	The type of action that was performed.
`user.uuid`
`user.name`	Full name
`user.email`
`user.user_type`
`user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "uuid": "7ASJ63X4LNC3PKSVFXRBP6KO7U",
  "timestamp": "1/11/2024, 9:47:36.000 AM",
  "client": {
    "app_name": "1Password for Windows",
    "app_version": "81003012",
    "platform_name": "LT-NLD-RDK",
    "platform_version": "Unknown",
    "os_name": "Windows",
    "os_version": "10.0.2009",
    "ip_address": "95.93.92.51"
  },
  "location": {
    "country": "Portugal",
    "region": "Faro",
    "city": "Olh�o",
    "latitude": 37.0272,
    "longitude": -7.8338
  },
  "action": "enter-item-edit-mode",
  "used_version": "4",
  "vault_uuid": "pxod76epyirrlm3hnsj4lws6yi",
  "item_uuid": "wwrhfe5qq3j7afzr6dxkgsnsem",
  "user": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  }
}

export

Description

1Password apps: Download a file. Duplicate and save an item to another account. Export 1Password account data as a 1PUX or CSV file. Usage is recorded for every exported item. Move an item to another account.

Fields #

Name	Description	Rules
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`used_version`
`vault_uuid`
`item_uuid`
`action`	The type of action that was performed.	6 detection rules
`user.uuid`
`user.name`	Full name
`user.email`
`user.user_type`
`user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "uuid": "RU22OXALW5HZFPO7H3MPDL2TVY",
  "timestamp": "1/15/2024, 10:57:21.000 AM",
  "client": {
    "app_name": "1Password for Windows",
    "app_version": "81003012",
    "platform_name": "LT-NLD-RDK",
    "platform_version": "Unknown",
    "os_name": "Windows",
    "os_version": "10.0.2009",
    "ip_address": "80.114.2.247"
  },
  "location": {
    "country": "The Netherlands",
    "region": "Utrecht",
    "city": "Amersfoort",
    "latitude": 52.1849,
    "longitude": 5.3954
  },
  "action": "export",
  "used_version": "7",
  "vault_uuid": "pxod76epyirrlm3hnsj4lws6yi",
  "item_uuid": "wwrhfe5qq3j7afzr6dxkgsnsem",
  "user": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`action` (kusto rule field)	eq	`export`	3 rules	kusto
`action` (kusto rule field)	eq	`delete`	1 rule	kusto
`object_type` (kusto rule field)	eq	`vault`	3 rules	kusto
`object_type` (kusto rule field)	eq	`user`	1 rule	kusto

fill

Description

1Password apps: Fill an item by selecting: "Open and fill" "Type in window" (Windows only) 1Password in the browser: Fill an item by selecting: Autofill Auto-Type (Windows only) Open & Fill An item from the inline menu in a form field

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`used_version`
`vault_uuid`
`item_uuid`
`action`	The type of action that was performed.
`user.uuid`
`user.name`	Full name
`user.email`
`user.user_type`
`user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "used_version": "1",
  "user": {
    "uuid": "DUMMY-USER-0033",
    "name": "Dummy User 033",
    "email": "dummy.user033@example.invalid",
    "type": "user"
  },
  "uuid": "DUMMY-ID-0095",
  "action": "fill",
  "client": {
    "app_name": "1Password for iOS",
    "app_version": "81232033",
    "platform_name": "iPhone",
    "platform_version": "iPhone18,3 (V57AP)",
    "os_name": "iOS",
    "os_version": "26.6",
    "ip_address": "192.0.2.21"
  },
  "location": {
    "country": "Dummy Country 003",
    "region": "Dummy Region 003",
    "city": "Dummy City 004",
    "latitude": 0.0,
    "longitude": 0.0
  },
  "item_uuid": "DUMMY-ID-0096",
  "timestamp": "2026-08-16T11:11:30-04:00",
  "vault_uuid": "DUMMY-ID-0097",
  "account_uuid": "DUMMY-ID-0004"
}

other

Description

1Password apps: Action is unknown. This value appears in the vendor documentation, but not in the corresponding OpenAPI enum for this version of the specification. The two vendor authorities disagree about it.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`used_version`
`vault_uuid`
`item_uuid`
`action`	The type of action that was performed.
`user.uuid`
`user.name`	Full name
`user.email`
`user.user_type`
`user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

reveal

Description

1Password apps: Preview a file. Reveal a password. Show a password in large type. 1Password in the browser: Reveal a password. Show a password in large type.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`used_version`
`vault_uuid`
`item_uuid`
`action`	The type of action that was performed.
`user.uuid`
`user.name`	Full name
`user.email`
`user.user_type`
`user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "used_version": "2",
  "user": {
    "uuid": "DUMMY-USER-0029",
    "name": "Dummy User 029",
    "email": "dummy.user029@example.invalid",
    "type": "user"
  },
  "uuid": "DUMMY-ID-0101",
  "action": "reveal",
  "client": {
    "app_name": "1Password CLI",
    "app_version": "2380101",
    "platform_name": "DUMMY-DEVICE-004",
    "platform_version": "arm64",
    "os_name": "MacOSX",
    "os_version": "15.7.3",
    "ip_address": "192.0.2.18"
  },
  "location": {
    "country": "Dummy Country 003",
    "region": "Dummy Region 008",
    "city": "Dummy City 014",
    "latitude": 0.0,
    "longitude": 0.0
  },
  "item_uuid": "DUMMY-ID-0102",
  "timestamp": "2026-08-16T17:43:05.692665-04:00",
  "vault_uuid": "DUMMY-ID-0017",
  "account_uuid": "DUMMY-ID-0004"
}

secure-copy

Description

1Password apps: Copy an item field. Copy an item's password history. 1Password in the browser: Copy an item field. Copy an item in JSON format.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`used_version`
`vault_uuid`
`item_uuid`
`action`	The type of action that was performed.
`user.uuid`
`user.name`	Full name
`user.email`
`user.user_type`
`user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "uuid": "2CH5VCBJYJGTBHG4VQPRCPOSUM",
  "timestamp": "1/11/2024, 9:47:34.000 AM",
  "client": {
    "app_name": "1Password for Windows",
    "app_version": "81003012",
    "platform_name": "LT-NLD-RDK",
    "platform_version": "Unknown",
    "os_name": "Windows",
    "os_version": "10.0.2009",
    "ip_address": "95.93.92.51"
  },
  "location": {
    "country": "Portugal",
    "region": "Faro",
    "city": "Olh�o",
    "latitude": 37.0272,
    "longitude": -7.8338
  },
  "action": "secure-copy",
  "used_version": "4",
  "vault_uuid": "pxod76epyirrlm3hnsj4lws6yi",
  "item_uuid": "wwrhfe5qq3j7afzr6dxkgsnsem",
  "user": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  }
}

select-sso-provider

Description

1Password in the browser: Sign in to a site using a sign-in provider.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`used_version`
`vault_uuid`
`item_uuid`
`action`	The type of action that was performed.
`user.uuid`
`user.name`	Full name
`user.email`
`user.user_type`
`user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

server-create

Description

1Password apps: Duplicate an item. Move an item. 1Password.com: Create an item. Duplicate an item. 1Password CLI: Create an item. 1Password Connect server: Create an item.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`used_version`
`vault_uuid`
`item_uuid`
`action`	The type of action that was performed.
`user.uuid`
`user.name`	Full name
`user.email`
`user.user_type`
`user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "uuid": "ST4EN36U5NF2PPWGM25IKVVYSQ",
  "timestamp": "1/11/2024, 8:40:08.674 AM",
  "client": {
    "app_name": "1Password Browser Extension",
    "app_version": "21900005",
    "platform_name": "Edge extension",
    "platform_version": "119.0.2151.97",
    "os_name": "Windows",
    "os_version": "11.0",
    "ip_address": "95.93.92.51"
  },
  "location": {
    "country": "Portugal",
    "region": "Faro",
    "city": "Olh�o",
    "latitude": 37.0272,
    "longitude": -7.8338
  },
  "action": "server-create",
  "used_version": "1",
  "vault_uuid": "pxod76epyirrlm3hnsj4lws6yi",
  "item_uuid": "a7tayv4ot644refhhzpkgupsvi",
  "user": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  }
}

server-fetch

Description

1Password apps: Download a file. Preview a file. 1Password.com: Open an item. 1Password CLI: Open an item. 1Password Connect server: Get all of an item's files. Get the contents of a file. Get the details of a file. Get the details of an item.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`used_version`
`vault_uuid`
`item_uuid`
`action`	The type of action that was performed.
`user.uuid`
`user.name`	Full name
`user.email`
`user.user_type`
`user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "uuid": "O7QSL5G3FJEW3DSJNKQBGRO2EY",
  "timestamp": "1/15/2024, 10:48:58.374 AM",
  "client": {
    "app_name": "1Password Browser Extension",
    "app_version": "22000000",
    "platform_name": "Brave",
    "platform_version": "118.0.0.0",
    "os_name": "Windows",
    "os_version": "11.0",
    "ip_address": "80.114.2.247"
  },
  "location": {
    "country": "The Netherlands",
    "region": "Utrecht",
    "city": "Amersfoort",
    "latitude": 52.1849,
    "longitude": 5.3954
  },
  "action": "server-fetch",
  "used_version": "1",
  "vault_uuid": "hkih674vjms6md4evnhsbzd7ri",
  "item_uuid": "k2k55v3k5bedqwounknnh3ugjy",
  "user": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  }
}

server-update

Description

1Password apps: Add an item to Favorites. Archive an item. Delete an item. Edit an item. Move an item. Restore an item. 1Password in the browser: Add an item to Favorites. 1Password.com: Add an item to Favorites. Archive an item. Delete an item. Edit an item. Restore an item. 1Password CLI: Archive an item. Delete an item. Edit an item. 1Password Connect server: Delete an item. Edit an item. Replace an item.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`used_version`
`vault_uuid`
`item_uuid`
`action`	The type of action that was performed.
`user.uuid`
`user.name`	Full name
`user.email`
`user.user_type`
`user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "uuid": "MZQYGBFS6RAZVMNKUU7DSWJEMM",
  "timestamp": "1/11/2024, 9:39:30.614 AM",
  "client": {
    "app_name": "1Password Browser Extension",
    "app_version": "21900005",
    "platform_name": "Edge extension",
    "platform_version": "119.0.2151.97",
    "os_name": "Windows",
    "os_version": "11.0",
    "ip_address": "95.93.92.51"
  },
  "location": {
    "country": "Portugal",
    "region": "Faro",
    "city": "Olh�o",
    "latitude": 37.0272,
    "longitude": -7.8338
  },
  "action": "server-update",
  "used_version": "2",
  "vault_uuid": "pxod76epyirrlm3hnsj4lws6yi",
  "item_uuid": "a7tayv4ot644refhhzpkgupsvi",
  "user": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  }
}

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`used_version`
`vault_uuid`
`item_uuid`
`action`	The type of action that was performed.
`user.uuid`
`user.name`	Full name
`user.email`
`user.user_type`
`user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "used_version": "1",
  "user": {
    "uuid": "DUMMY-USER-0004",
    "name": "Dummy User 004",
    "email": "dummy.user004@example.invalid",
    "type": "user"
  },
  "uuid": "DUMMY-ID-0008",
  "action": "share",
  "client": {
    "app_name": "1Password for Mac",
    "app_version": "81228025",
    "platform_name": "DUMMY-DEVICE-001",
    "platform_version": "Mac16,8",
    "os_name": "MacOSX",
    "os_version": "26.5.2",
    "ip_address": "192.0.2.3"
  },
  "location": {
    "country": "Dummy Country 003",
    "region": "Dummy Region 003",
    "city": "Dummy City 003",
    "latitude": 0.0,
    "longitude": 0.0
  },
  "item_uuid": "DUMMY-ID-0009",
  "timestamp": "2026-08-20T15:08:16.4936253Z",
  "vault_uuid": "DUMMY-ID-0010",
  "account_uuid": "DUMMY-ID-0004"
}

1Password-ItemUsage

any: Item usage (catch-all)

Description

Fields #

Detection Patterns #

Persistence: Create Account

Kusto

Credential Access: Credentials from Password Stores

Kusto

Common Indicators #

Detection Rules #

Panther #

enter-item-edit-mode

Description

Fields #

Example Event #

export

Description

Fields #

Example Event #

Detection Patterns #

Password Vault Export

Kusto

Password Vault Export

Kusto

Common Indicators #

fill

Description

Fields #

Example Event #

other

Description

Fields #

reveal

Description

Fields #

Example Event #

secure-copy

Description

Fields #

Example Event #

select-sso-provider

Description

Fields #

server-create

Description

Fields #

Example Event #

server-fetch

Description

Fields #

Example Event #

server-update

Description

Fields #

Example Event #

share

Description

Fields #

Example Event #

References #