1Password-SSO

Event	Title	Channel	Sample	Rule
any	SSO (catch-all)	_catch_all	N	Y
sso-addgsso	Add an SSO Group.	sso-addgsso	N	N
sso-chngasso	Change SSO Grace Period Authentication Count	sso-chngasso	N	N
sso-chngdsso	Change SSO Grace Period Duration	sso-chngdsso	N	N
sso-chngpsso	Change SSO Authentication Policy	sso-chngpsso	N	N
sso-delgsso	Delete an SSO Group.	sso-delgsso	N	N
sso-disblsso	Disable SSO	sso-disblsso	N	N
sso-enblsso	Enable SSO	sso-enblsso	N	N

any: SSO (catch-all)

Description

Catch-all entry for 1Password rules that match sso events without naming a specific action.

Fields #

Name	Description	Rules
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`actor_uuid`	The unique identifier for the team member who performed the action.
`actor_details.uuid`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_details.name`	Full name
`actor_details.email`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_type`
`actor_account_uuid`
`account_uuid`
`action`	The type of action that was performed.
`object_type`	The type of object that the action was performed on.	1 detection rule
`object_uuid`	The unique identifier for the object the action was performed on.
`object_details.uuid`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`object_details.name`	Full name
`object_details.email`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`aux_id`	The identifier that relates to additional information about the activity.
`aux_uuid`	The unique identifier that relates to additional information about the activity.
`aux_details.uuid`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_details.name`	Full name
`aux_details.email`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_info`	Additional information about the activity.
`session.uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.login_time`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.device_uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.ip`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`log_source` (kusto rule field)	eq	`auditevents`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

1Password - Changes to SSO configuration source medium: This will alert when changes have been made to the SSO configuration. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same. Ref: https://1password.com/ Ref: https://github.com/securehats/T1556

sso-addgsso: Add an SSO Group.

Description

An SSO group was added.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`actor_uuid`	The unique identifier for the team member who performed the action.
`actor_details.uuid`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_details.name`	Full name
`actor_details.email`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_type`
`actor_account_uuid`
`account_uuid`
`action`	The type of action that was performed.
`object_type`	The type of object that the action was performed on.
`object_uuid`	The unique identifier for the object the action was performed on.
`object_details.uuid`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`object_details.name`	Full name
`object_details.email`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`aux_id`	The identifier that relates to additional information about the activity.
`aux_uuid`	The unique identifier that relates to additional information about the activity.
`aux_details.uuid`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_details.name`	Full name
`aux_details.email`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_info`	Additional information about the activity.
`session.uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.login_time`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.device_uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.ip`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.

sso-chngasso: Change SSO Grace Period Authentication Count

Description

The SSO grace period authentication count was changed.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`actor_uuid`	The unique identifier for the team member who performed the action.
`actor_details.uuid`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_details.name`	Full name
`actor_details.email`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_type`
`actor_account_uuid`
`account_uuid`
`action`	The type of action that was performed.
`object_type`	The type of object that the action was performed on.
`object_uuid`	The unique identifier for the object the action was performed on.
`object_details.uuid`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`object_details.name`	Full name
`object_details.email`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`aux_id`	The identifier that relates to additional information about the activity.
`aux_uuid`	The unique identifier that relates to additional information about the activity.
`aux_details.uuid`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_details.name`	Full name
`aux_details.email`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_info`	Additional information about the activity.
`session.uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.login_time`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.device_uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.ip`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.

sso-chngdsso: Change SSO Grace Period Duration

Description

The SSO grace period duration was changed.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`actor_uuid`	The unique identifier for the team member who performed the action.
`actor_details.uuid`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_details.name`	Full name
`actor_details.email`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_type`
`actor_account_uuid`
`account_uuid`
`action`	The type of action that was performed.
`object_type`	The type of object that the action was performed on.
`object_uuid`	The unique identifier for the object the action was performed on.
`object_details.uuid`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`object_details.name`	Full name
`object_details.email`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`aux_id`	The identifier that relates to additional information about the activity.
`aux_uuid`	The unique identifier that relates to additional information about the activity.
`aux_details.uuid`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_details.name`	Full name
`aux_details.email`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_info`	Additional information about the activity.
`session.uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.login_time`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.device_uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.ip`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.

sso-chngpsso: Change SSO Authentication Policy

Description

The SSO authentication policy was changed.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`actor_uuid`	The unique identifier for the team member who performed the action.
`actor_details.uuid`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_details.name`	Full name
`actor_details.email`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_type`
`actor_account_uuid`
`account_uuid`
`action`	The type of action that was performed.
`object_type`	The type of object that the action was performed on.
`object_uuid`	The unique identifier for the object the action was performed on.
`object_details.uuid`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`object_details.name`	Full name
`object_details.email`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`aux_id`	The identifier that relates to additional information about the activity.
`aux_uuid`	The unique identifier that relates to additional information about the activity.
`aux_details.uuid`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_details.name`	Full name
`aux_details.email`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_info`	Additional information about the activity.
`session.uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.login_time`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.device_uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.ip`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.

sso-delgsso: Delete an SSO Group.

Description

An SSO group was deleted.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`actor_uuid`	The unique identifier for the team member who performed the action.
`actor_details.uuid`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_details.name`	Full name
`actor_details.email`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_type`
`actor_account_uuid`
`account_uuid`
`action`	The type of action that was performed.
`object_type`	The type of object that the action was performed on.
`object_uuid`	The unique identifier for the object the action was performed on.
`object_details.uuid`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`object_details.name`	Full name
`object_details.email`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`aux_id`	The identifier that relates to additional information about the activity.
`aux_uuid`	The unique identifier that relates to additional information about the activity.
`aux_details.uuid`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_details.name`	Full name
`aux_details.email`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_info`	Additional information about the activity.
`session.uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.login_time`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.device_uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.ip`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.

sso-disblsso: Disable SSO

Description

Unlock with SSO was disabled.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`actor_uuid`	The unique identifier for the team member who performed the action.
`actor_details.uuid`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_details.name`	Full name
`actor_details.email`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_type`
`actor_account_uuid`
`account_uuid`
`action`	The type of action that was performed.
`object_type`	The type of object that the action was performed on.
`object_uuid`	The unique identifier for the object the action was performed on.
`object_details.uuid`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`object_details.name`	Full name
`object_details.email`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`aux_id`	The identifier that relates to additional information about the activity.
`aux_uuid`	The unique identifier that relates to additional information about the activity.
`aux_details.uuid`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_details.name`	Full name
`aux_details.email`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_info`	Additional information about the activity.
`session.uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.login_time`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.device_uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.ip`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.

sso-enblsso: Enable SSO

Description

Unlock with SSO was enabled.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`actor_uuid`	The unique identifier for the team member who performed the action.
`actor_details.uuid`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_details.name`	Full name
`actor_details.email`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_type`
`actor_account_uuid`
`account_uuid`
`action`	The type of action that was performed.
`object_type`	The type of object that the action was performed on.
`object_uuid`	The unique identifier for the object the action was performed on.
`object_details.uuid`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`object_details.name`	Full name
`object_details.email`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`aux_id`	The identifier that relates to additional information about the activity.
`aux_uuid`	The unique identifier that relates to additional information about the activity.
`aux_details.uuid`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_details.name`	Full name
`aux_details.email`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_info`	Additional information about the activity.
`session.uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.login_time`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.device_uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.ip`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.

1Password-SSO

any: SSO (catch-all)

Description

Fields #

Common Indicators #

Detection Rules #

Kusto #

sso-addgsso: Add an SSO Group.

Description

Fields #

sso-chngasso: Change SSO Grace Period Authentication Count

Description

Fields #

sso-chngdsso: Change SSO Grace Period Duration

Description

Fields #

sso-chngpsso: Change SSO Authentication Policy

Description

Fields #

sso-delgsso: Delete an SSO Group.

Description

Fields #

sso-disblsso: Disable SSO

Description

Fields #

sso-enblsso: Enable SSO

Description

Fields #

References #