SSO
| Action | Sample | Rule |
|---|---|---|
| Add an SSO Group. | N | N |
| Change SSO Grace Period Authentication Count | N | N |
| Change SSO Grace Period Duration | N | N |
| Change SSO Authentication Policy | N | N |
| Delete an SSO Group. | N | N |
| Disable SSO | N | N |
| Enable SSO | N | N |
sso-addgsso: Add an SSO Group.
#Description
An SSO group was added.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
sso-chngasso: Change SSO Grace Period Authentication Count
#Description
The SSO grace period authentication count was changed.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
sso-chngdsso: Change SSO Grace Period Duration
#Description
The SSO grace period duration was changed.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
sso-chngpsso: Change SSO Authentication Policy
#Description
The SSO authentication policy was changed.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
sso-delgsso: Delete an SSO Group.
#Description
An SSO group was deleted.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
sso-disblsso: Disable SSO
#Description
Unlock with SSO was disabled.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
sso-enblsso: Enable SSO
#Description
Unlock with SSO was enabled.
Fields #
| Name | Description |
|---|---|
uuid | Unique event identifier. |
timestamp | Time the event occurred. |
actor_uuid | Actor identifier. |
actor_details.uuid | Actor identifier. |
actor_details.name | Actor's full name. |
actor_details.email | Actor's email address. |
actor_type | Type of actor. |
actor_account_uuid | 1Password account identifier of the actor. |
account_uuid | 1Password account identifier. |
action | Action performed. |
object_type | Type of affected object. |
object_uuid | Identifier of the affected object. |
object_details.uuid | Affected user identifier, when applicable. |
object_details.name | Affected user's full name, when applicable. |
object_details.email | Affected user's email address, when applicable. |
aux_id | Numeric identifier for related event data. |
aux_uuid | Identifier for related event data. |
aux_details.uuid | Related user identifier, when applicable. |
aux_details.name | Related user's full name, when applicable. |
aux_details.email | Related user's email address, when applicable. |
aux_info | Additional event information. |
session.uuid | Session identifier. |
session.login_time | Time the session started. |
session.device_uuid | Identifier of the session device. |
session.ip | IP address used for the session. |
location.country | Client country inferred from IP address. |
location.region | Client region inferred from IP address. |
location.city | Client city inferred from IP address. |
location.longitude | Client longitude inferred from IP address. |
location.latitude | Client latitude inferred from IP address. |
any: SSO (catch-all)
#Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.
Description
Scope-level aggregate for rules that match any sso event. Not a distinct 1Password Events API record.
Fields #
| Name | Description | Rules |
|---|---|---|
uuid | Unique event identifier. | |
timestamp | Time the event occurred. | |
actor_uuid | Actor identifier. | |
actor_details.uuid | Actor identifier. | |
actor_details.name | Actor's full name. | |
actor_details.email | Actor's email address. | |
actor_type | Type of actor. | |
actor_account_uuid | 1Password account identifier of the actor. | |
account_uuid | 1Password account identifier. | |
action | Action performed. | 1 detection rule |
object_type | Type of affected object. | 1 detection rule |
object_uuid | Identifier of the affected object. | |
object_details.uuid | Affected user identifier, when applicable. | |
object_details.name | Affected user's full name, when applicable. | |
object_details.email | Affected user's email address, when applicable. | |
aux_id | Numeric identifier for related event data. | |
aux_uuid | Identifier for related event data. | |
aux_details.uuid | Related user identifier, when applicable. | |
aux_details.name | Related user's full name, when applicable. | |
aux_details.email | Related user's email address, when applicable. | |
aux_info | Additional event information. | |
session.uuid | Session identifier. | |
session.login_time | Time the session started. | |
session.device_uuid | Identifier of the session device. | |
session.ip | IP address used for the session. | |
location.country | Client country inferred from IP address. | |
location.region | Client region inferred from IP address. | |
location.city | Client city inferred from IP address. | |
location.longitude | Client longitude inferred from IP address. | |
location.latitude | Client latitude inferred from IP address. |
Common Indicators #
Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
log_source (kusto rule field) | eq | auditevents | 1 rule | kusto |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Kusto #
T1556