GroupVaultAccess

Action	Sample	Rule
Group vault access (catch-all)	N	Y
Grant Group Vault Access	Y	N
Revoke Group Vault Access	Y	N
Update Group Vault Access	Y	N

any: Group vault access (catch-all)

Description

Matches any group vault access event.

Fields #

Name	Description	Rules
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.	1 detection rule
`object_type`	Type of affected object.	1 detection rule
`object_uuid`	Identifier of the affected object.	1 detection rule
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Detection Patterns #

Persistence: Account Manipulation

1Password-GroupVaultAccess any: Group vault accessOR1Password-UserVaultAccess any: User vault access

1 rule

Kusto

1Password - Privileged vault permission change (source)

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`action` (kusto rule field)	contains	`grant`	1 rule	kusto
`action` (kusto rule field)	contains	`revoke`	1 rule	kusto
`action` (kusto rule field)	contains	`update`	1 rule	kusto
`log_source` (kusto rule field)	eq	`auditevents`	1 rule	kusto
`object_type` (kusto rule field)	eq	`uva`	1 rule	kusto
`object_uuid` (kusto rule field)	eq	`watchlist`	1 rule	kusto

References #

gva-grant: Grant Group Vault Access

Description

A group was granted access to a vault.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

{
  "account_uuid": "opid-4a7dcecbc0a00ccd4248",
  "action": "grant",
  "actor_details": {
    "email": "user-43f0f48e30b0@example.invalid",
    "name": "User 360bf3a8254a",
    "uuid": "opid-adc712a95a826da15eac"
  },
  "actor_type": "user",
  "actor_uuid": "opid-adc712a95a826da15eac",
  "aux_id": 0,
  "aux_info": "REDACTED",
  "aux_uuid": "opid-625b43c8b7eae2bf9efa",
  "location": {
    "city": "CITY-REDACTED",
    "country": "ZZ",
    "latitude": 0.0,
    "longitude": 0.0,
    "region": "REGION-REDACTED"
  },
  "object_type": "gva",
  "object_uuid": "opid-4f273719af40edb843de",
  "session": {
    "device_uuid": "opid-517df91906f62a8bf419",
    "ip": "203.0.113.16",
    "login_time": "2026-08-24T00:44:54.720872837Z",
    "uuid": "opid-4f31aa5206aa645ce7e4"
  },
  "timestamp": "2026-08-24T00:44:56.83726696Z",
  "uuid": "opid-593390cd9aae768d5194"
}

References #

gva-revoke: Revoke Group Vault Access

Description

A group's access to a vault was revoked.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

The source export stringifies aux_id; the 1Password Events API schema defines aux_id as an integer.

{
  "uuid": "SH6EYECNZVEJAFFKV6BZ4SCLKA",
  "timestamp": "12/15/2023, 11:05:51.294 AM",
  "location": {
    "country": "The Netherlands",
    "region": "North Holland",
    "city": "Amsterdam",
    "latitude": 52.3759,
    "longitude": 4.8975
  },
  "actor_uuid": "AVHAFAP4PRDF5K3724I67N3CEU",
  "actor_details": {
    "uuid": "AVHAFAP4PRDF5K3724I67N3CEU",
    "name": "Automated User Provisioning",
    "email": "zkv4c3mauxjbw@1passwordserviceaccounts.com"
  },
  "action": "revoke",
  "object_type": "gva",
  "object_uuid": "hftuvpitsmpcpa2fif36ml4loy",
  "aux_id": "20446667",
  "aux_uuid": "6me6nx3rwsjzlcusk6hz2tyyj4",
  "session": {
    "uuid": "KRG6S6ANAZB67JYNUQFNTMZQ6Y",
    "login_time": "2023-12-12T05:25:28.4465411Z",
    "device_uuid": "pjleru42mvdhql4nl7mab6ympm",
    "ip": "4.175.88.205"
  }
}

References #

gva-update: Update Group Vault Access

Description

A group's vault access was updated.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

The source export stringifies aux_id; the 1Password Events API schema defines aux_id as an integer.

{
  "uuid": "OGFNHTYJLTIGE6GVLKYIR7XJD7",
  "timestamp": "1/3/2024, 5:28:03.990 PM",
  "location": {
    "country": "The Netherlands",
    "region": "North Holland",
    "city": "Amsterdam",
    "latitude": 52.3716,
    "longitude": 4.8883
  },
  "actor_uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
  "actor_details": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  },
  "action": "update",
  "object_type": "gva",
  "object_uuid": "pxod76epyirrlm3hnsj4lws6yi",
  "aux_id": "20040573",
  "aux_uuid": "uifejsarevmna75h67ybraeoiq",
  "aux_info": "2097650",
  "session": {
    "uuid": "OMSF7NLRYFAMPBMEKDGMO3V6OM",
    "login_time": "2024-01-03T16:56:38.9882780Z",
    "device_uuid": "tmikosahabjierhqhaapybduj4",
    "ip": "91.214.67.71"
  }
}