Detection rules › By event

1Password-UserVaultAccess

Event	Rules
any	3
uva-grant	1
uva-update	1

any

3 detection rules reference this event. View event page.

Kusto (3)

1Password - Non-privileged vault user permission change severity medium T1098
1Password - Potential insider privilege escalation via vault severity medium T1078
1Password - Privileged vault permission change severity high T1098

uva-grant

1 detection rules reference this event. View event page.

Kusto (1)

1Password - Secret extraction post vault access change by administrator severity high T1555

uva-update

1 detection rules reference this event. View event page.

Kusto (1)

1Password - Secret extraction post vault access change by administrator severity high T1555