1Password

1Password is a password manager used for storing and managing your account credentials, financial information, documents, and other sensitive data. It provides secure password generation, quick form filling, and cross-device synchronization. It also offers features like secure password sharing and monitoring for compromised accounts.

What does this pack contain?

• Rest API integration for your 1Password.
• Modeling Rules for security events:
  • Audit events
  • Item usage actions
  • Sign in attempts

Configure 1Password in Cortex

The integration can be configured to fetch three types of events from 1Password:

• Audit events - Information about actions performed by team members within a 1Password account. Events include details on a preformed action such as execution time and executing user, action type and any additional information about the activity.
• Item usage actions - Information about items in shared vaults that have been modified, accessed, or used. Events include the accessing user's name and IP address, time of access, and the vault where the item is stored.
• Sign-in attempts - Information about sign-in attempts. Events include the name and IP address of the user who attempted to sign in to the account, when the attempt was made, and, for failed attempts, the cause of the failure.

All event timestamps, along with date and time configuration parameters and command arguments, are in the Coordinated Universal Time (UTC) timezone.

Every call to the 1Password Events API must be authorized with a bearer token. To issue a new bearer token:

1. Sign in to your 1Password account and click Integrations in the sidebar.
2. Under the Directory tab, choose (•••) Other and enter a descriptive name for the integration, such as 'Cortex XSIAM'.
3. Enter a name for the bearer token and choose when it will expire.
4. Ensure the token has access to the event types listed above.
5. Click Issue Token to generate a new bearer token.
6. Save the token in a secure location and use it in configuring this integration instance.

For more information please about authorization, refer to this documentation

Limitations

It is recommended to configure the integration instance so that the maximum number of fetched events does not exceed 100,000 per minute per event type. Otherwise, the 1Password Events API may raise rate limit errors (HTTP 429).

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

one-password-get-events

Fetch events from 1Password. This command is intended for development and debugging purposes and should be used with caution as it may create duplicate events.

Base Command

one-password-get-events

Input

Command Example

!one-password-get-events event_type="Sign in attempts" limit=2 from_date="2024-12-12T12:00:00.000Z" should_push_events=False

Context Output

There is no context output for this command.

Human Readable Output

Sign in attempts

account_uuid	category	client	country	location	session_uuid	target_user	timestamp	type	uuid
H9T8ZQ6P4F3JY1VK7D2N5L7XQ2W	success	app_name: 1Password Browser Extension app_version: 81055002 …	UK	country: UK region: Scotland city: Glasgow …	YB7RPKX9V6N2DAG3T0ZQ8YHWY4C	uuid: LJ5T8WK9U8FQGZ2D1Q4V9RLP3S name: Jenny Bee email: userB@example.com type: user	2024-12-13T19:52:14.658476952Z	credentials_ok	NAFGMYS3LZBCZLX2MVRSWNXIHI
B7N3W5E9Y6JHQ2V1KZ8M4P0QX5T	success	app_name: 1Password for Web app_version: 1895 …	IL	country: IL region: Gush Dan city: Tel Aviv …	C4XUJWF8N2Y1K9V3WZ7M5E6T0H	uuid: MNY8UJ6PZG5BVW9QH3A1K2X3CK name: John Doe email: userA@example.com type: user	2024-12-16T13:27:33.375466135Z	credentials_ok	QXZTBRJULQX5ZJWKRFG8YTP8EX