Detection rules › By event

1Password-ItemUsage

Event	Rules
any	4
export	3

any

4 detection rules reference this event. View event page.

Kusto (2)

1Password - Manual account creation severity medium T1136
1Password - Secret extraction post vault access change by administrator severity high T1555

Panther (2)

BETA - Sensitive 1Password Item Accessed severity low T1552
Configuration Required - Sensitive 1Password Item Accessed severity low T1552

export

3 detection rules reference this event. View event page.

Kusto (3)

1Password - Vault export severity low T1555
1Password - Vault export post account creation severity medium T1136, T1555
1Password - Vault export prior to account suspension or deletion severity medium T1555