Knowledge BaseRelease NotesRequest Demo

1Password Logs

Panther supports pulling logs directly from 1Password

Overview

Panther fetches 1Password event logs via the 1Password Events API every one minute. Panther is specifically monitoring the following 1Password events:

  • Sign-in attempts from a user's 1Password account

  • Items in shared vaults that have been modified, accessed, or used

  • Audit events from the Activity Log

To set up 1Password as a log source in Panther, you'll need to generate an access token in your 1Password account, then configure the 1Password log source in Panther.

How to onboard 1Password logs to Panther

Step 1: Generate an Access Token in 1Password

  1. Sign in to your 1Password account, then click Integrations in the sidebar.

  2. Click Directory at the top of the page.

  3. Scroll down to the "Events Reporting" section then click Panther. In the "Events Reporting" section in 1Password, there is a tile labeled Panther. In the image, there is a red square around it.

  4. Enter a System Name for the integration, then click Add Integration.

  5. Enter a name for the bearer token and choose token expiration.

  6. Select the event types your token will have access to:

  7. Click Issue Token to generate the access token key.

  8. Click Save in 1Password and choose which vault to save your token to.

  9. Click View Integration Details to view the token.

    • You will need this token in the next steps.

Step 2: Create a new 1Password log source in Panther

  1. In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.

  2. Click Create New.

  3. Search for “1Password,” then click its tile.

  4. In the slide-out panel, click Start Setup.

  5. On the next screen, enter a name for the source e.g. My 1Password logs.

  6. Click Setup.

  7. On the Credentials page, fill in the form:

    • Paste the access token key from your 1Password account into the Access Token field.

    • Select the region and plan of your 1Password account.

  8. Click Setup. You will be directed to a success screen:

    The success screen reads, "Everything looks good! Panther will now automatically pull & process logs from your account"

    • You can optionally enable one or more Detection Packs.

    • The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.

      The "Trigger an alert when no events are processed" toggle is set to YES. The "How long should Panther wait before it sends you an alert that no events have been processed" setting is set to 1 Day

Note: By default, 1Password logs do not contain human-readable values for objects such as vaults and login credentials. Please see our guide about using Lookup Tables to translate 1Password's Universally Unique Identifier (UUID) values into human-readable names.

Panther-Built Detections

See Panther's built in rules for 1Password in panther-analysis in Github.

Supported log types

Required fields in the schemas are listed as "required: true" just below the "name" field.

OnePassword.ItemUsage

These are 1Password item usage events. For more information, see the 1Password Events API reference documentation.

OnePassword.SignInAttempt

These are 1Password sign-in attempts. For more information, see the 1Password Events API reference documentation.

OnePassword.AuditEvent

These are 1Password audit events from the Activity Log. For more information, see the 1Password Events Reporting audit events documentation.

PreviousSupported LogsNextAzure Logs

Last updated

Was this helpful?