Detection rules › Panther
Configuration Required - Sensitive 1Password Item Accessed
Alerts when a user defined list of sensitive items in 1Password is accessed
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1552 Unsecured Credentials |
Rule body yaml
AnalysisType: rule
Filename: onepassword_sensitive_item_access.py
RuleID: "OnePassword.Sensitive.Item"
DedupPeriodMinutes: 30
DisplayName: "Configuration Required - Sensitive 1Password Item Accessed"
Enabled: false
LogTypes:
- OnePassword.ItemUsage
Reference: https://support.1password.com/1password-com-items/
Severity: Low
Description: Alerts when a user defined list of sensitive items in 1Password is accessed
SummaryAttributes:
- p_any_ip_addresses
- p_any_emails
Tags:
- Configuration Required
- 1Password
- Credential Access:Unsecured Credentials
Reports:
MITRE ATT&CK:
- TA0006:T1552
Tests:
- Name: 1Password - Sensitive Item Accessed
ExpectedResult: true
Log:
{
"uuid": "ecd1d435c26440dc930ddfbbef201a11",
"timestamp": "2022-02-23 20:27:17.071",
"used_version": 2,
"vault_uuid": "111111",
"item_uuid": "ecd1d435c26440dc930ddfbbef201a11",
"user":
{
"email": "homer@springfield.gov",
"name": "Homer Simpson",
"uuid": "2222222",
},
"client":
{
"app_name": "1Password Browser Extension",
"app_version": "20195",
"ip_address": "1.1.1.1.1",
"os_name": "MacOSX",
"os_version": "10.15.7",
"platform_name": "Chrome",
"platform_version": "4.0.4.102",
},
"p_log_type": "OnePassword.ItemUsage",
}
- Name: 1Password - Regular Item Usage
ExpectedResult: false
Log:
{
"uuid": "11111",
"timestamp": "2022-02-23 20:27:17.071",
"used_version": 2,
"vault_uuid": "111111",
"item_uuid": "1111111",
"user":
{
"email": "homer@springfield.gov",
"name": "Homer Simpson",
"uuid": "2222222",
},
"client":
{
"app_name": "1Password Browser Extension",
"app_version": "20195",
"ip_address": "1.1.1.1.1",
"os_name": "MacOSX",
"os_version": "10.15.7",
"platform_name": "Chrome",
"platform_version": "4.0.4.102",
},
"p_log_type": "OnePassword.ItemUsage",
}
Detection logic
Condition
item_uuid in "ecd1d435c26440dc930ddfbbef201a11"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
item_uuid | in |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
user | user.name |
item_name | p_enrichment.1Password Translation.item_uuid.title |
client | client.app_name |
ip_address | source_ip |
event_time | timestamp |