Detection rules › By event

1Password-User

Event	Rules
any	1
user-delete	1
user-suspend	1

any

1 detection rules reference this event. View event page.

Kusto (1)

1Password - User account MFA settings changed severity medium T1556

user-delete

1 detection rules reference this event. View event page.

Kusto (1)

1Password - Vault export prior to account suspension or deletion severity medium T1555

user-suspend

1 detection rules reference this event. View event page.

Kusto (1)

1Password - Vault export prior to account suspension or deletion severity medium T1555