1Password - Vault export prior to account suspension or deletion

Back


Id	51617533-cf51-4415-9020-b15bd47d69d2
Rulename	1Password - Vault export prior to account suspension or deletion
Description	This will alert when a successful vault export has occurred within the last 14 days prior to an account being suspended or deleted from 1Password. Ref: https://1password.com/ Ref: https://github.com/securehats/
Severity	Medium
Tactics	CredentialAccess
Techniques	T1555
Required data connectors	1Password
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/1Password/Analytics Rules/1Password - Vault export prior to account suspension or deletion.yaml
Version	1.0.0
Arm template	51617533-cf51-4415-9020-b15bd47d69d2.json

KQL

let ruleFrequency = 1h;
let lookback = 14d;
let onePasswordVaultExportCheck =
    OnePasswordEventLogs_CL
    | where TimeGenerated between (ago(lookback) .. ago(now() - ago(ruleFrequency)))
    | where action == "export" and object_type == "vault"
;
OnePasswordEventLogs_CL
| where (action == "suspend" and object_type == "user") or (action == "delete" and object_type == "user")
| extend
    userUuid = tostring(object_details.uuid)
    , auditevents = bag_pack("action", action, "object_type", object_type)
| join (
    onePasswordVaultExportCheck
    | extend userUuid = tostring(actor_details.uuid)
    )
    on $left.userUuid == $right.userUuid
| extend
    TargetUsername = actor_details1.email
    , SrcIpAddr = session1.ip_address
| project
    TimeGenerated
    , auditevents
    , actor_details
    , location_details = location
    , session_details = session
    , exported_vault = object_details
    , TargetUsername
    , SrcIpAddr

YAML

queryPeriod: 14d
query: |-
  let ruleFrequency = 1h;
  let lookback = 14d;
  let onePasswordVaultExportCheck =
      OnePasswordEventLogs_CL
      | where TimeGenerated between (ago(lookback) .. ago(now() - ago(ruleFrequency)))
      | where action == "export" and object_type == "vault"
  ;
  OnePasswordEventLogs_CL
  | where (action == "suspend" and object_type == "user") or (action == "delete" and object_type == "user")
  | extend
      userUuid = tostring(object_details.uuid)
      , auditevents = bag_pack("action", action, "object_type", object_type)
  | join (
      onePasswordVaultExportCheck
      | extend userUuid = tostring(actor_details.uuid)
      )
      on $left.userUuid == $right.userUuid
  | extend
      TargetUsername = actor_details1.email
      , SrcIpAddr = session1.ip_address
  | project
      TimeGenerated
      , auditevents
      , actor_details
      , location_details = location
      , session_details = session
      , exported_vault = object_details
      , TargetUsername
      , SrcIpAddr  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/1Password/Analytics Rules/1Password - Vault export prior to account suspension or deletion.yaml
name: 1Password - Vault export prior to account suspension or deletion
entityMappings:
- fieldMappings:
  - columnName: TargetUsername
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
  entityType: IP
suppressionEnabled: false
description: |-
  This will alert when a successful vault export has occurred within the last 14 days prior to an account being suspended or deleted from 1Password.

  Ref: https://1password.com/
  Ref: https://github.com/securehats/  
kind: Scheduled
version: 1.0.0
eventGroupingSettings:
  aggregationKind: SingleAlert
suppressionDuration: 5h
queryFrequency: 1h
severity: Medium
requiredDataConnectors:
- connectorId: 1Password
  dataTypes:
  - OnePasswordEventLogs_CL
triggerOperator: gt
triggerThreshold: 0
incidentConfiguration:
  groupingConfiguration:
    lookbackDuration: 1h
    reopenClosedIncident: false
    matchingMethod: AllEntities
    enabled: true
  createIncident: true
tactics:
- CredentialAccess
id: 51617533-cf51-4415-9020-b15bd47d69d2
relevantTechniques:
- T1555

ARM