1Password - Vault export post account creation

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


This will alert when a successful vault export has occurred within 14 days of a new account being created within 1Password. Ref: https://1password.com/ Ref: https://github.com/securehats/

Attribute Value
Type Analytic Rule
Solution 1Password
ID 969e2e5c-9cc6-423c-a3de-514f7ad75fe7
Severity Medium
Kind Scheduled
Tactics CredentialAccess, Persistence
Techniques T1555, T1136
Required Connectors 1Password
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
OnePasswordEventLogs_CL ? ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Analytic Rules · Back to 1Password