1Password-SignInAttempt

Event	Title	Channel	Sample	Rule
any	Sign-in attempt (catch-all)	_catch_all	N	Y
all_blocked	all_blocked	all_blocked	Y	N
anonymous_blocked	anonymous_blocked	anonymous_blocked	Y	N
code_bad	code_bad	code_bad	N	N
code_disabled	code_disabled	code_disabled	N	N
code_timeout	code_timeout	code_timeout	N	N
continent_blocked	continent_blocked	continent_blocked	N	N
country_blocked	country_blocked	country_blocked	Y	N
credentials_ok	credentials_ok	credentials_ok	Y	Y
duo_bad	duo_bad	duo_bad	N	N
duo_disabled	duo_disabled	duo_disabled	N	N
duo_native_bad	duo_native_bad	duo_native_bad	N	N
duo_timeout	duo_timeout	duo_timeout	N	N
federated	federated	federated	N	N
ip_blocked	ip_blocked	ip_blocked	N	N
mfa_missing	mfa_missing	mfa_missing	N	N
mfa_ok	mfa_ok	mfa_ok	Y	Y
modern_version_missing	modern_version_missing	modern_version_missing	N	N
modern_version_old	modern_version_old	modern_version_old	N	N
non_sso_user	non_sso_user	non_sso_user	N	N
password_secret_bad	password_secret_bad	password_secret_bad	Y	N
platform_secret_bad	platform_secret_bad	platform_secret_bad	Y	N
platform_secret_disabled	platform_secret_disabled	platform_secret_disabled	N	N
platform_secret_proxy	platform_secret_proxy	platform_secret_proxy	N	N
service_account_sso_denied	service_account_sso_denied	service_account_sso_denied	N	N
sso_user_mismatch	sso_user_mismatch	sso_user_mismatch	N	N
totp_bad	totp_bad	totp_bad	Y	N
totp_disabled	totp_disabled	totp_disabled	N	N
totp_timeout	totp_timeout	totp_timeout	Y	N
u2f_bad	u2f_bad	u2f_bad	N	N
u2f_disabled	u2f_disabled	u2f_disabled	N	N
u2f_timout	u2f_timout	u2f_timout	N	N
unknown	unknown	unknown	Y	N
version_old	version_old	version_old	Y	N

any: Sign-in attempt (catch-all)

Description

Catch-all entry for 1Password rules that match sign-in attempt events without naming a specific action.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Detection Patterns #

Password Vault Export

1Password-ItemUsage export: exportOR1Password-SignInAttempt any: Sign-in attemptOR1Password-Vault vault-export: Export Vault

3 rules

Kusto

1Password - Vault export post account creation (source)

1Password - Vault export (source)

1Password - Vault export prior to account suspension or deletion (source)

Password Vault Export

1Password-ItemUsage export: exportOR1Password-SignInAttempt any: Sign-in attemptOR1Password-User user-delete: Change User State FromORuser-suspend: Change User State FromOR1Password-Vault vault-delete: Delete VaultORvault-export: Export Vault

3 rules

Kusto

1Password - Vault export post account creation (source)

1Password - Vault export (source)

1Password - Vault export prior to account suspension or deletion (source)

Persistence: Create Account

1Password-Invite invite-create: Create InviteOR1Password-ItemUsage any: Item usageOR1Password-SignInAttempt any: Sign-in attempt

1 rule

Kusto

1Password - Manual account creation (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`action` (kusto rule field)	eq	`export`	3 rules	kusto
`action` (kusto rule field)	eq	`create`	1 rule	kusto
`action` (kusto rule field)	eq	`delete`	1 rule	kusto
`object_type` (kusto rule field)	eq	`vault`	3 rules	kusto
`object_type` (kusto rule field)	eq	`user`	1 rule	kusto
`event_type` (panther rule field)	eq	`failed_login`	2 rules	panther
`event_type` (panther rule field)	eq	`successful_login`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Unusual 1Password Client Detected source medium: Detects when unusual or undesirable 1Password clients access your 1Password accountT1555
Brute Force By IP source informational: An actor user was denied login access more times than the configured threshold.T1110
Brute Force By User source informational: An actor user was denied login access more times than the configured threshold.T1110

Show 4 more (7 total) on the rules page

all_blocked

Description

1Password sign-in attempt event: all_blocked.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "uuid": "BNNLZCEEZVCRZOAGK6RSM2LCYA",
  "session_uuid": "QTEO4BZZWRCEHKUNZECB5EEYZI",
  "timestamp": "1/14/2024, 1:14:25.425 PM",
  "country": "IL",
  "category": "firewall_failed",
  "type": "all_blocked",
  "details": {
    "value": ""
  },
  "target_user": {
    "uuid": "54SFBG7JOJEQRKEY5TQ7JXRFVA",
    "name": "Gus Fring",
    "email": "gus.fring@securehats.nl"
  },
  "client": {
    "app_name": "1Password for iOS",
    "app_version": "81023003",
    "platform_name": "iPhone",
    "platform_version": "iPhone16,1 (D83AP)",
    "os_name": "iOS",
    "os_version": "17.1.2",
    "ip_address": "192.118.11.113"
  },
  "location": {
    "country": "IL",
    "region": "Tel Aviv",
    "city": "Tel Aviv",
    "latitude": 32.0803,
    "longitude": 34.7805
  }
}

anonymous_blocked

Description

1Password sign-in attempt event: anonymous_blocked.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "type": "anonymous_blocked",
  "uuid": "DUMMY-ID-0066",
  "client": {
    "app_name": "1Password CLI",
    "app_version": "2390001",
    "platform_name": "localhost",
    "platform_version": "amd64",
    "os_name": "Linux",
    "os_version": "12",
    "ip_address": "192.0.2.16"
  },
  "country": "Dummy Country 001",
  "details": {
    "value": "Cloud Provider"
  },
  "category": "firewall_failed",
  "location": {
    "country": "Dummy Country 001",
    "region": "Dummy Region 006",
    "city": "Dummy City 012",
    "latitude": 0.0,
    "longitude": 0.0
  },
  "timestamp": "2026-08-19T15:35:32.20997114Z",
  "target_user": {
    "uuid": "DUMMY-USER-0024",
    "name": "Dummy User 024",
    "email": "dummy.user024@example.invalid",
    "type": "user"
  },
  "account_uuid": "DUMMY-ID-0004",
  "session_uuid": "DUMMY-ID-0067"
}

code_bad

Description

1Password sign-in attempt event: code_bad.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

code_disabled

Description

1Password sign-in attempt event: code_disabled.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

code_timeout

Description

1Password sign-in attempt event: code_timeout.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

continent_blocked

Description

1Password sign-in attempt event: continent_blocked.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

country_blocked

Description

1Password sign-in attempt event: country_blocked.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "uuid": "VV6M5SG5PJEWVHJQPVBZL7GV2E",
  "session_uuid": "DYEMWNGV35CXVACU2NZ3VA4CC4",
  "timestamp": "1/15/2024, 2:34:14.964 PM",
  "country": "US",
  "category": "firewall_reported_success",
  "type": "country_blocked",
  "details": {
    "value": "US"
  },
  "target_user": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  },
  "client": {
    "app_name": "1Password Browser Extension",
    "app_version": "21900005",
    "platform_name": "Edge extension",
    "platform_version": "119.0.2151.97",
    "os_name": "Windows",
    "os_version": "11.0",
    "ip_address": "91.196.220.160"
  },
  "location": {
    "country": "US",
    "region": "California",
    "city": "Los Angeles",
    "latitude": 34.0544,
    "longitude": -118.2441
  }
}

credentials_ok

Description

1Password sign-in attempt event: credentials_ok.

Fields #

Name	Description	Rules
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`		4 detection rules
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "uuid": "CWDCZLRTOFCTRIK35WCSEC5VEU",
  "session_uuid": "4HNNWMTPZRAFJE2YAWRE2HZIR4",
  "timestamp": "3/1/2024, 2:03:06.092 AM",
  "country": "ZA",
  "category": "success",
  "type": "credentials_ok",
  "target_user": {
    "uuid": "LB3XERXFAFCBZCENBG4HQSOATA",
    "name": "Hector Salamanca",
    "email": "hector.salamanca@securehats.nl"
  },
  "client": {
    "app_name": "1Password for Windows",
    "app_version": "81026039",
    "platform_name": "securehats.nl-24826",
    "platform_version": "Unknown",
    "os_name": "Windows",
    "os_version": "10.0.2009",
    "ip_address": "101.110.109.43"
  },
  "location": {
    "country": "ZA",
    "region": "Western Cape",
    "city": "Cape Town",
    "latitude": -33.91,
    "longitude": 18.4304
  }
}

Detection Patterns #

Stealth: Valid Accounts

1Password-SignInAttempt credentials_ok: credentials_okORmfa_ok: mfa_ok

1 rule

Kusto

1Password - Successful anomalous sign-in (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`category`	eq	`success`	3 rules	kusto, panther
`client:app_name` (panther rule field)	ne	`1password scim bridge`	2 rules	panther
`client:ip_address` (panther rule field)	wildcard	`...`	2 rules	panther
`type` (panther rule field)	eq	`credentials_ok`	2 rules	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

1Password Login From CrowdStrike Unmanaged Device Query source: Looks for OnePassword Logins from IP Addresses that aren''t seen in CrowdStrike''s AIP List.
1Password Login From CrowdStrike Unmanaged Device source medium linked query: 1Password Login From CrowdStrike Unmanaged Device Query: Detects 1Password Logins from IP addresses not found in CrowdStrike''s AIP list. May indicate unmanaged device being used, or faulty CrowdStrike Sensor.
1Password Login From CrowdStrike Unmanaged Device Query (crowdstrike_fdrevent table) source: Looks for OnePassword Logins from IP Addresses that aren''t seen in CrowdStrike''s AIP List. (crowdstrike_fdrevent table)

duo_bad

Description

1Password sign-in attempt event: duo_bad.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

duo_disabled

Description

1Password sign-in attempt event: duo_disabled.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

duo_native_bad

Description

1Password sign-in attempt event: duo_native_bad.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

duo_timeout

Description

1Password sign-in attempt event: duo_timeout.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

federated

Description

1Password sign-in attempt event: federated.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

ip_blocked

Description

1Password sign-in attempt event: ip_blocked.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

mfa_missing

Description

1Password sign-in attempt event: mfa_missing.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

mfa_ok

Description

1Password sign-in attempt event: mfa_ok.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "uuid": "ECN6G65MHFFWPNYXWDT7MYC2HU",
  "session_uuid": "B3CKKJLK4BD6BFWPZ3UKZETWLY",
  "timestamp": "12/11/2023, 8:05:35.222 AM",
  "country": "NL",
  "category": "success",
  "type": "mfa_ok",
  "target_user": {
    "uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
    "name": "Walter White",
    "email": "walter.white@securehats.nl"
  },
  "client": {
    "app_name": "1Password for Windows",
    "app_version": "81020036",
    "platform_name": "LAPTOP-1FSV0NBD",
    "platform_version": "Unknown",
    "os_name": "Windows",
    "os_version": "10.0.2009",
    "ip_address": "2a02:a44f:d7cb:0:453b:ca5e:d79f:19fc"
  },
  "location": {
    "country": "NL",
    "region": "Gelderland",
    "city": "Epe",
    "latitude": 52.3466,
    "longitude": 5.9963
  }
}

Detection Patterns #

Stealth: Valid Accounts

1Password-SignInAttempt credentials_ok: credentials_okORmfa_ok: mfa_ok

1 rule

Kusto

1Password - Successful anomalous sign-in (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`category` (kusto rule field)	eq	`success`	1 rule	kusto

modern_version_missing

Description

1Password sign-in attempt event: modern_version_missing.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

modern_version_old

Description

1Password sign-in attempt event: modern_version_old.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

non_sso_user

Description

1Password sign-in attempt event: non_sso_user.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

password_secret_bad

Description

1Password sign-in attempt event: password_secret_bad.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "uuid": "5H7XILZTG5E7RDYDJPZF374CGY",
  "session_uuid": "2VFBJVEHHBAUTIXNRYZRAPJ2XY",
  "timestamp": "2/27/2024, 5:56:07.030 AM",
  "country": "ZA",
  "category": "credentials_failed",
  "type": "password_secret_bad",
  "target_user": {
    "uuid": "LB3XERXFAFCBZCENBG4HQSOATA",
    "name": "Hector Salamanca",
    "email": "hector.salamanca@securehats.nl"
  },
  "client": {
    "app_name": "1Password for Windows",
    "app_version": "81026039",
    "platform_name": "securehats.nl-24826",
    "platform_version": "Unknown",
    "os_name": "Windows",
    "os_version": "10.0.2009",
    "ip_address": "101.110.109.43"
  },
  "location": {
    "country": "ZA",
    "region": "Western Cape",
    "city": "Cape Town",
    "latitude": -33.91,
    "longitude": 18.4304
  }
}

platform_secret_bad

Description

1Password sign-in attempt event: platform_secret_bad.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "uuid": "6TGQTLBORZH7VONTFI3NLPJG3U",
  "session_uuid": "7F67IATVBZGL7BBM3BI657HMMQ",
  "timestamp": "1/23/2024, 9:26:07.111 PM",
  "country": "NL",
  "category": "mfa_failed",
  "type": "platform_secret_bad",
  "target_user": {
    "uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
    "name": "Walter White",
    "email": "walter.white@securehats.nl"
  },
  "client": {
    "app_name": "1Password for Windows",
    "app_version": "81023003",
    "platform_name": "LAPTOP-1FSV0NBD",
    "platform_version": "Unknown",
    "os_name": "Windows",
    "os_version": "10.0.2009",
    "ip_address": "76.75.244.76"
  },
  "location": {
    "country": "NL",
    "region": "North Brabant",
    "city": "Rijen",
    "latitude": 51.5923,
    "longitude": 4.9218
  }
}

platform_secret_disabled

Description

1Password sign-in attempt event: platform_secret_disabled.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

platform_secret_proxy

Description

1Password sign-in attempt event: platform_secret_proxy.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

service_account_sso_denied

Description

1Password sign-in attempt event: service_account_sso_denied.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

sso_user_mismatch

Description

1Password sign-in attempt event: sso_user_mismatch.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

totp_bad

Description

1Password sign-in attempt event: totp_bad.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "uuid": "6KYYIO3ETJEMNFBHRXCF6T6LDY",
  "session_uuid": "6AXKUBXFC5CV3L4DGXGXUDK7ZU",
  "timestamp": "2/20/2024, 10:02:28.958 PM",
  "country": "ZA",
  "category": "mfa_failed",
  "type": "totp_bad",
  "target_user": {
    "uuid": "PLM6JX3B65HYTMPDCAYXDGWYHA",
    "name": "Clay Morrow",
    "email": "clay.morrow@securehats.nl"
  },
  "client": {
    "app_name": "1Password for Web",
    "app_version": "1687",
    "platform_name": "Microsoft Edge",
    "platform_version": "121.0.2277.105",
    "os_name": "Android",
    "os_version": "13.0.0",
    "ip_address": "152.110.218.252"
  },
  "location": {
    "country": "ZA",
    "region": "Western Cape",
    "city": "Cape Town",
    "latitude": -33.9249,
    "longitude": 18.4267
  }
}

totp_disabled

Description

1Password sign-in attempt event: totp_disabled.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

totp_timeout

Description

1Password sign-in attempt event: totp_timeout.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "uuid": "CE5TD6ORTZG7TDUBHPRM2V6GSY",
  "session_uuid": "7C5HZQOOGVAJFBNHESHBAKWVVY",
  "timestamp": "12/18/2023, 8:04:43.383 AM",
  "country": "ZA",
  "category": "mfa_failed",
  "type": "totp_timeout",
  "target_user": {
    "uuid": "QW2Z4T64HFEJRIZANDX3OKEFL4",
    "name": "Alfie Solomons",
    "email": "alfie.solomons@securehats.nl"
  },
  "client": {
    "app_name": "1Password Browser Extension",
    "app_version": "21800105",
    "platform_name": "Microsoft Edge",
    "platform_version": "120.0.2210.61",
    "os_name": "Windows",
    "os_version": "11.0",
    "ip_address": "197.90.120.176"
  },
  "location": {
    "country": "ZA",
    "region": "Gauteng",
    "city": "Johannesburg",
    "latitude": -26.2309,
    "longitude": 28.0583
  }
}

u2f_bad

Description

1Password sign-in attempt event: u2f_bad.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

u2f_disabled

Description

1Password sign-in attempt event: u2f_disabled.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

u2f_timout

Description

1Password sign-in attempt event: u2f_timout.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

unknown

Description

1Password sign-in attempt event: unknown. This value appears in real 1Password telemetry but in neither the OpenAPI enum nor the documentation. A real record proves it exists; its meaning is undocumented and is deliberately not inferred here. Observed in real telemetry; absent from SignInAttempt.type in spec 1.4.1. Meaning undocumented, deliberately not inferred.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "uuid": "JW5PC24QR5GOHGVPGZ6OCB4RXE",
  "session_uuid": "4SOI4VWFJNGUJNI2Y64NAODQSE",
  "timestamp": "12/19/2023, 10:40:49.225 AM",
  "country": "ZA",
  "category": "mfa_failed",
  "type": "unknown",
  "target_user": {
    "uuid": "4WSX6UY2VBFVVFZMUDANQ42DFU",
    "name": "Bruce Lee",
    "email": "bruce.lee@securehats.nl"
  },
  "client": {
    "app_name": "1Password for Web",
    "app_version": "1656",
    "platform_name": "Microsoft Edge",
    "platform_version": "120.0.2210.77",
    "os_name": "Windows",
    "os_version": "11.0",
    "ip_address": "41.1.80.70"
  },
  "location": {
    "country": "ZA",
    "region": "Gauteng",
    "city": "Johannesburg",
    "latitude": -26.2309,
    "longitude": 28.0583
  }
}

version_old

Description

1Password sign-in attempt event: version_old. This value appears in real 1Password telemetry but in neither the OpenAPI enum nor the documentation. A real record proves it exists; its meaning is undocumented and is deliberately not inferred here. Observed in real telemetry; absent from SignInAttempt.type in spec 1.4.1. Meaning undocumented, deliberately not inferred.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`session_uuid`
`timestamp`	When the action was performed.
`category`
`type`
`country`	Country ISO Code
`details.value`	For firewall prevented sign-ins, the value is the chosen continent, country, etc. that blocked the sign-in attempt
`target_user.uuid`
`target_user.name`	Full name
`target_user.email`
`target_user.user_type`
`target_user.user_account_uuid`
`client.app_name`
`client.app_version`
`client.platform_name`
`client.platform_version`	Depending on the platform used, this can be the version of the browser that the client extension is installed, the model of computer that the native application is installed or the machine's CPU version that the CLI was installed
`client.os_name`
`client.os_version`
`client.ip_address`
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`account_uuid`

Example Event #

{
  "type": "version_old",
  "uuid": "DUMMY-ID-0029",
  "client": {
    "app_name": "1Password for Web",
    "app_version": "1941",
    "platform_name": "Chrome",
    "platform_version": "133.0.6943.127",
    "os_name": "Windows",
    "os_version": "11.0",
    "ip_address": "192.0.2.8"
  },
  "country": "Dummy Country 003",
  "category": "modern_version_failed",
  "location": {
    "country": "Dummy Country 003",
    "region": "Dummy Region 003",
    "city": "Dummy City 005",
    "latitude": 0.0,
    "longitude": 0.0
  },
  "timestamp": "2026-08-06T13:20:11.026987245Z",
  "target_user": {
    "uuid": "DUMMY-USER-0011",
    "name": "Dummy User 011",
    "email": "dummy.user011@example.invalid",
    "type": "user"
  },
  "account_uuid": "DUMMY-ID-0004",
  "session_uuid": "DUMMY-ID-0030"
}

References #

1Password Events API OpenAPI specification