Detection rules › By event

1Password-SignInAttempt

Event	Rules
any	11
credentials_ok	4
mfa_ok	1

any

11 detection rules reference this event. View event page.

Kusto (4)

1Password - Manual account creation severity medium T1136
1Password - Vault export severity low T1555
1Password - Vault export post account creation severity medium T1136, T1555
1Password - Vault export prior to account suspension or deletion severity medium T1555

Panther (7)

Brute Force By IP severity informational T1110
Brute Force By User severity informational T1110
GreyNoise V3 Malicious IP Activity severity high T1595.001
GTI/VirusTotal Threat Intelligence Indicator Match severity high T1595.001
OTX Threat Intelligence Indicator Match severity high T1595.001
Sign In from Rogue State severity medium T1078.004
Unusual 1Password Client Detected severity medium T1555

credentials_ok

4 detection rules reference this event. View event page.

Kusto (1)

1Password - Successful anomalous sign-in severity low T1078

Panther (3)

mfa_ok

1 detection rules reference this event. View event page.

Kusto (1)

1Password - Successful anomalous sign-in severity low T1078