1Password-Vault

Event	Title	Channel	Sample	Rule
any	Vault (catch-all)	_catch_all	N	N
vault-create	Add Vault	vault-create	N	N
vault-delete	Delete Vault	vault-delete	Y	Y
vault-export	Export Vault	vault-export	Y	Y
vault-purge	Mark Vault To Be Purged	vault-purge	N	N
vault-update	Update Client Access	vault-update	N	N
vault-updatea	Update Attributes	vault-updatea	Y	N

any: Vault (catch-all)

Description

Catch-all entry for 1Password rules that match vault events without naming a specific action.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`actor_uuid`	The unique identifier for the team member who performed the action.
`actor_details.uuid`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_details.name`	Full name
`actor_details.email`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_type`
`actor_account_uuid`
`account_uuid`
`action`	The type of action that was performed.
`object_type`	The type of object that the action was performed on.
`object_uuid`	The unique identifier for the object the action was performed on.
`object_details.uuid`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`object_details.name`	Full name
`object_details.email`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`aux_id`	The identifier that relates to additional information about the activity.
`aux_uuid`	The unique identifier that relates to additional information about the activity.
`aux_details.uuid`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_details.name`	Full name
`aux_details.email`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_info`	Additional information about the activity.
`session.uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.login_time`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.device_uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.ip`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.

vault-create: Add Vault

Description

A vault was added.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`actor_uuid`	The unique identifier for the team member who performed the action.
`actor_details.uuid`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_details.name`	Full name
`actor_details.email`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_type`
`actor_account_uuid`
`account_uuid`
`action`	The type of action that was performed.
`object_type`	The type of object that the action was performed on.
`object_uuid`	The unique identifier for the object the action was performed on.
`object_details.uuid`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`object_details.name`	Full name
`object_details.email`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`aux_id`	The identifier that relates to additional information about the activity.
`aux_uuid`	The unique identifier that relates to additional information about the activity.
`aux_details.uuid`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_details.name`	Full name
`aux_details.email`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_info`	Additional information about the activity.
`session.uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.login_time`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.device_uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.ip`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.

vault-delete: Delete Vault

Description

A vault was deleted.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`actor_uuid`	The unique identifier for the team member who performed the action.
`actor_details.uuid`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_details.name`	Full name
`actor_details.email`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_type`
`actor_account_uuid`
`account_uuid`
`action`	The type of action that was performed.
`object_type`	The type of object that the action was performed on.
`object_uuid`	The unique identifier for the object the action was performed on.
`object_details.uuid`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`object_details.name`	Full name
`object_details.email`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`aux_id`	The identifier that relates to additional information about the activity.
`aux_uuid`	The unique identifier that relates to additional information about the activity.
`aux_details.uuid`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_details.name`	Full name
`aux_details.email`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_info`	Additional information about the activity.
`session.uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.login_time`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.device_uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.ip`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.

Example Event #

{
  "uuid": "UVXT6YVDXMQMGVSPIT3LNLOMQ2",
  "timestamp": "1/22/2024, 9:16:15.595 PM",
  "location": {
    "country": "The Netherlands",
    "region": "North Brabant",
    "city": "Rijen",
    "latitude": 51.5923,
    "longitude": 4.9218
  },
  "actor_uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
  "actor_details": {
    "uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
    "name": "Walter White",
    "email": "walter.white@securehats.nl"
  },
  "action": "delete",
  "object_type": "vault",
  "object_uuid": "fpl6uwaz6aazj2ly56jlxjcomi",
  "session": {
    "uuid": "NTB4XSFZFZBFNNCYGEK6JWQYSI",
    "login_time": "2024-01-22T21:12:57.7107500Z",
    "device_uuid": "uh7t35mrsnycrf4vz6wbdhs4y4",
    "ip": "76.75.244.76"
  }
}

Detection Patterns #

Credential Access: Credentials from Password Stores

1Password-ItemUsage export: exportOR1Password-SignInAttempt any: Sign-in attemptOR1Password-User user-delete: Change User State FromORuser-suspend: Change User State FromOR1Password-Vault vault-delete: Delete VaultORvault-export: Export Vault

1 rule

Kusto

1Password - Vault export prior to account suspension or deletion (source)

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`action` (kusto rule field)	eq	`delete`	1 rule	kusto
`action` (kusto rule field)	eq	`export`	1 rule	kusto
`object_type` (kusto rule field)	eq	`user`	1 rule	kusto
`object_type` (kusto rule field)	eq	`vault`	1 rule	kusto

vault-export: Export Vault

Description

A vault was exported.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`actor_uuid`	The unique identifier for the team member who performed the action.
`actor_details.uuid`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_details.name`	Full name
`actor_details.email`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_type`
`actor_account_uuid`
`account_uuid`
`action`	The type of action that was performed.
`object_type`	The type of object that the action was performed on.
`object_uuid`	The unique identifier for the object the action was performed on.
`object_details.uuid`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`object_details.name`	Full name
`object_details.email`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`aux_id`	The identifier that relates to additional information about the activity.
`aux_uuid`	The unique identifier that relates to additional information about the activity.
`aux_details.uuid`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_details.name`	Full name
`aux_details.email`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_info`	Additional information about the activity.
`session.uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.login_time`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.device_uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.ip`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.

Example Event #

{
  "uuid": "FBODO62J4WR72EGECMVQ5BCAF4",
  "timestamp": "1/15/2024, 10:57:31.218 AM",
  "location": {
    "country": "The Netherlands",
    "region": "Utrecht",
    "city": "Amersfoort",
    "latitude": 52.1849,
    "longitude": 5.3954
  },
  "actor_uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
  "actor_details": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  },
  "action": "export",
  "object_type": "vault",
  "object_uuid": "n36hcpeonwo63gr566l5kqww7u",
  "session": {
    "uuid": "HDG7CELQ6NBTBNY6W362BZAT2E",
    "login_time": "2024-01-15T10:56:59.3311720Z",
    "device_uuid": "se3mwxcxoyttdxigu3rgwn3d6i",
    "ip": "80.114.2.247"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`action` (kusto rule field)	eq	`export`	3 rules	kusto
`action` (kusto rule field)	eq	`delete`	1 rule	kusto
`object_type` (kusto rule field)	eq	`vault`	3 rules	kusto
`object_type` (kusto rule field)	eq	`user`	1 rule	kusto

vault-purge: Mark Vault To Be Purged

Description

A vault was marked for purging.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`actor_uuid`	The unique identifier for the team member who performed the action.
`actor_details.uuid`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_details.name`	Full name
`actor_details.email`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_type`
`actor_account_uuid`
`account_uuid`
`action`	The type of action that was performed.
`object_type`	The type of object that the action was performed on.
`object_uuid`	The unique identifier for the object the action was performed on.
`object_details.uuid`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`object_details.name`	Full name
`object_details.email`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`aux_id`	The identifier that relates to additional information about the activity.
`aux_uuid`	The unique identifier that relates to additional information about the activity.
`aux_details.uuid`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_details.name`	Full name
`aux_details.email`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_info`	Additional information about the activity.
`session.uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.login_time`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.device_uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.ip`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.

vault-update: Update Client Access

Description

The client access value for a vault was updated.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`actor_uuid`	The unique identifier for the team member who performed the action.
`actor_details.uuid`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_details.name`	Full name
`actor_details.email`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_type`
`actor_account_uuid`
`account_uuid`
`action`	The type of action that was performed.
`object_type`	The type of object that the action was performed on.
`object_uuid`	The unique identifier for the object the action was performed on.
`object_details.uuid`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`object_details.name`	Full name
`object_details.email`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`aux_id`	The identifier that relates to additional information about the activity.
`aux_uuid`	The unique identifier that relates to additional information about the activity.
`aux_details.uuid`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_details.name`	Full name
`aux_details.email`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_info`	Additional information about the activity.
`session.uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.login_time`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.device_uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.ip`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.

vault-updatea: Update Attributes

Description

A vault name or description was changed.

Fields #

Name	Description
`uuid`	The unique identifier for the event.
`timestamp`	When the action was performed.
`actor_uuid`	The unique identifier for the team member who performed the action.
`actor_details.uuid`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_details.name`	Full name
`actor_details.email`	The details of the team member who performed the action (including their UUID, name, and email address).
`actor_type`
`actor_account_uuid`
`account_uuid`
`action`	The type of action that was performed.
`object_type`	The type of object that the action was performed on.
`object_uuid`	The unique identifier for the object the action was performed on.
`object_details.uuid`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`object_details.name`	Full name
`object_details.email`	The details of the team member who is the object of the action (including their UUID, name, and email address). This property is only returned for events where the object of the action is a team member.
`aux_id`	The identifier that relates to additional information about the activity.
`aux_uuid`	The unique identifier that relates to additional information about the activity.
`aux_details.uuid`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_details.name`	Full name
`aux_details.email`	The details of the team member who relates to the additional information about the activity (including their UUID, name, and email address). This property is only returned for events where the additional information about an activity relates to a team member.
`aux_info`	Additional information about the activity.
`session.uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.login_time`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.device_uuid`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`session.ip`	The information about the session, including the date and time the client signed in and started the session, the unique identifier of the device that signed into the session, and the IP address used.
`location.country`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.region`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.city`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.longitude`	The geolocation information of the client based on their IP address at the time the event was performed.
`location.latitude`	The geolocation information of the client based on their IP address at the time the event was performed.

Example Event #

{
  "uuid": "DRH5ZT5EQDVJ4EQFYKMNH2ADSL",
  "timestamp": "1/15/2024, 10:54:32.610 AM",
  "location": {
    "country": "The Netherlands",
    "region": "Utrecht",
    "city": "Amersfoort",
    "latitude": 52.1849,
    "longitude": 5.3954
  },
  "actor_uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
  "actor_details": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  },
  "action": "updatea",
  "object_type": "vault",
  "object_uuid": "n36hcpeonwo63gr566l5kqww7u",
  "session": {
    "uuid": "4YN2SFKZJ5E5RJGIB5LRFNNFZM",
    "login_time": "2024-01-15T10:46:49.2290152Z",
    "device_uuid": "tmikosahabjierhqhaapybduj4",
    "ip": "80.114.2.247"
  }
}

1Password-Vault

any: Vault (catch-all)

Description

Fields #

vault-create: Add Vault

Description

Fields #

vault-delete: Delete Vault

Description

Fields #

Example Event #

Detection Patterns #

Credential Access: Credentials from Password Stores

Kusto

Common Indicators #

vault-export: Export Vault

Description

Fields #

Example Event #

Detection Patterns #

Password Vault Export

Kusto

Password Vault Export

Kusto

Common Indicators #

vault-purge: Mark Vault To Be Purged

Description

Fields #

vault-update: Update Client Access

Description

Fields #

vault-updatea: Update Attributes

Description

Fields #

Example Event #

References #