1Password - Vault export

Back


Id	dae4c601-51c9-47f5-83d3-e6eaef929cf6
Rulename	1Password - Vault export
Description	This will alert when a successful vault export has occurred within 1Password. Ref: https://1password.com/ Ref: https://github.com/securehats/
Severity	Low
Tactics	CredentialAccess
Techniques	T1555
Required data connectors	1Password
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/1Password/Analytics Rules/1Password - Vault Export.yaml
Version	1.0.0
Arm template	dae4c601-51c9-47f5-83d3-e6eaef929cf6.json

KQL

OnePasswordEventLogs_CL
| where action == "export"
| where object_type == "vault"
| extend
    TargetUsername = actor_details.email
    , SrcIpAddr = session.ip

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/1Password/Analytics Rules/1Password - Vault Export.yaml
name: 1Password - Vault export
triggerThreshold: 0
relevantTechniques:
- T1555
queryPeriod: 1h
queryFrequency: 1h
triggerOperator: gt
id: dae4c601-51c9-47f5-83d3-e6eaef929cf6
kind: Scheduled
tactics:
- CredentialAccess
description: |-
  This will alert when a successful vault export has occurred within 1Password.
  Ref: https://1password.com/
  Ref: https://github.com/securehats/  
incidentConfiguration:
  groupingConfiguration:
    enabled: true
    matchingMethod: AllEntities
    lookbackDuration: 1h
    reopenClosedIncident: false
  createIncident: true
severity: Low
suppressionDuration: 1h
requiredDataConnectors:
- connectorId: 1Password
  dataTypes:
  - OnePasswordEventLogs_CL
query: |-
  OnePasswordEventLogs_CL
  | where action == "export"
  | where object_type == "vault"
  | extend
      TargetUsername = actor_details.email
      , SrcIpAddr = session.ip  
version: 1.0.0
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: TargetUsername
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: SrcIpAddr
    identifier: Address
eventGroupingSettings:
  aggregationKind: SingleAlert
suppressionEnabled: false

ARM