ItemUsage

Action	Sample	Rule
Item usage (catch-all)	N	Y
enter-item-edit-mode	Y	N
export	Y	N
fill	Y	N
other	N	N
reveal	Y	N
secure-copy	Y	N
select-sso-provider	N	N
server-create	Y	N
server-fetch	Y	N
server-update	Y	N
share	Y	N

any: Item usage (catch-all)

Description

Matches any item usage event.

Fields #

Name	Description	Rules
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`used_version`	Version associated with the item usage.
`vault_uuid`	Identifier of the vault containing the item.
`item_uuid`	Identifier of the used item.	1 detection rule
`action`	Action performed.	1 detection rule
`user.uuid`	User identifier.
`user.name`	User's full name.
`user.email`	User's email address.
`user.user_type`	User type.
`user.user_account_uuid`	1Password account identifier for the user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Detection Patterns #

Credential Access: Credentials from Password Stores

1Password-ItemUsage any: Item usageOR1Password-UserVaultAccess uva-grant: Grant User Vault AccessORuva-update: Update User Vault Access

1 rule

Kusto

1Password - Secret extraction post vault access change by administrator (source)

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`action` (kusto rule field)	eq	`update`	1 rule	kusto
`log_source` (kusto rule field)	eq	`auditevents`	1 rule	kusto
`object_type` (kusto rule field)	eq	`uva`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

BETA - Sensitive 1Password Item Accessed source low: Alerts when a user defined list of sensitive items in 1Password is accessedT1552
Configuration Required - Sensitive 1Password Item Accessed source low: Alerts when a user defined list of sensitive items in 1Password is accessedT1552

References #

enter-item-edit-mode

Description

An item was opened for editing or marked as a favorite.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`used_version`	Version associated with the item usage.
`vault_uuid`	Identifier of the vault containing the item.
`item_uuid`	Identifier of the used item.
`action`	Action performed.
`user.uuid`	User identifier.
`user.name`	User's full name.
`user.email`	User's email address.
`user.user_type`	User type.
`user.user_account_uuid`	1Password account identifier for the user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

The source export stringifies used_version; the 1Password Events API schema defines used_version as an integer.

{
  "uuid": "7ASJ63X4LNC3PKSVFXRBP6KO7U",
  "timestamp": "1/11/2024, 9:47:36.000 AM",
  "client": {
    "app_name": "1Password for Windows",
    "app_version": "81003012",
    "platform_name": "LT-NLD-RDK",
    "platform_version": "Unknown",
    "os_name": "Windows",
    "os_version": "10.0.2009",
    "ip_address": "95.93.92.51"
  },
  "location": {
    "country": "Portugal",
    "region": "Faro",
    "city": "Olh�o",
    "latitude": 37.0272,
    "longitude": -7.8338
  },
  "action": "enter-item-edit-mode",
  "used_version": "4",
  "vault_uuid": "pxod76epyirrlm3hnsj4lws6yi",
  "item_uuid": "wwrhfe5qq3j7afzr6dxkgsnsem",
  "user": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  }
}

References #

export

Description

An item was exported, downloaded, duplicated, or moved to another account.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`used_version`	Version associated with the item usage.
`vault_uuid`	Identifier of the vault containing the item.
`item_uuid`	Identifier of the used item.
`action`	Action performed.
`user.uuid`	User identifier.
`user.name`	User's full name.
`user.email`	User's email address.
`user.user_type`	User type.
`user.user_account_uuid`	1Password account identifier for the user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

The source export stringifies used_version; the 1Password Events API schema defines used_version as an integer.

{
  "uuid": "RU22OXALW5HZFPO7H3MPDL2TVY",
  "timestamp": "1/15/2024, 10:57:21.000 AM",
  "client": {
    "app_name": "1Password for Windows",
    "app_version": "81003012",
    "platform_name": "LT-NLD-RDK",
    "platform_version": "Unknown",
    "os_name": "Windows",
    "os_version": "10.0.2009",
    "ip_address": "80.114.2.247"
  },
  "location": {
    "country": "The Netherlands",
    "region": "Utrecht",
    "city": "Amersfoort",
    "latitude": 52.1849,
    "longitude": 5.3954
  },
  "action": "export",
  "used_version": "7",
  "vault_uuid": "pxod76epyirrlm3hnsj4lws6yi",
  "item_uuid": "wwrhfe5qq3j7afzr6dxkgsnsem",
  "user": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  }
}

References #

fill

Description

An item was used to fill a form or application.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`used_version`	Version associated with the item usage.
`vault_uuid`	Identifier of the vault containing the item.
`item_uuid`	Identifier of the used item.
`action`	Action performed.
`user.uuid`	User identifier.
`user.name`	User's full name.
`user.email`	User's email address.
`user.user_type`	User type.
`user.user_account_uuid`	1Password account identifier for the user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

The source export stringifies used_version; the 1Password Events API schema defines used_version as an integer.

{
  "used_version": "1",
  "user": {
    "uuid": "DUMMY-USER-0033",
    "name": "Dummy User 033",
    "email": "dummy.user033@example.invalid",
    "type": "user"
  },
  "uuid": "DUMMY-ID-0095",
  "action": "fill",
  "client": {
    "app_name": "1Password for iOS",
    "app_version": "81232033",
    "platform_name": "iPhone",
    "platform_version": "iPhone18,3 (V57AP)",
    "os_name": "iOS",
    "os_version": "26.6",
    "ip_address": "192.0.2.21"
  },
  "location": {
    "country": "Dummy Country 003",
    "region": "Dummy Region 003",
    "city": "Dummy City 004",
    "latitude": 0.0,
    "longitude": 0.0
  },
  "item_uuid": "DUMMY-ID-0096",
  "timestamp": "2026-08-16T11:11:30-04:00",
  "vault_uuid": "DUMMY-ID-0097",
  "account_uuid": "DUMMY-ID-0004"
}

References #

other

Description

An older client reported an unknown item action absent from the OpenAPI schema.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`used_version`	Version associated with the item usage.
`vault_uuid`	Identifier of the vault containing the item.
`item_uuid`	Identifier of the used item.
`action`	Action performed.
`user.uuid`	User identifier.
`user.name`	User's full name.
`user.email`	User's email address.
`user.user_type`	User type.
`user.user_account_uuid`	1Password account identifier for the user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

reveal

Description

A password or file was revealed or previewed.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`used_version`	Version associated with the item usage.
`vault_uuid`	Identifier of the vault containing the item.
`item_uuid`	Identifier of the used item.
`action`	Action performed.
`user.uuid`	User identifier.
`user.name`	User's full name.
`user.email`	User's email address.
`user.user_type`	User type.
`user.user_account_uuid`	1Password account identifier for the user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

{
  "account_uuid": "opid-4a7dcecbc0a00ccd4248",
  "action": "reveal",
  "client": {
    "app_name": "REDACTED",
    "app_version": "REDACTED",
    "ip_address": "203.0.113.16",
    "os_name": "REDACTED",
    "os_version": "REDACTED",
    "platform_name": "REDACTED",
    "platform_version": "REDACTED"
  },
  "item_uuid": "opid-b59f780f2c7d9b1ab916",
  "location": {
    "city": "CITY-REDACTED",
    "country": "ZZ",
    "latitude": 0.0,
    "longitude": 0.0,
    "region": "REGION-REDACTED"
  },
  "timestamp": "2026-08-24T00:44:59.136719828Z",
  "used_version": 1,
  "user": {
    "email": "user-43f0f48e30b0@example.invalid",
    "name": "User 360bf3a8254a",
    "type": "user",
    "uuid": "opid-adc712a95a826da15eac"
  },
  "uuid": "opid-6eaa98135e3c0a2ac287",
  "vault_uuid": "opid-4f273719af40edb843de"
}

References #

secure-copy

Description

An item field, password history, or JSON representation was copied.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`used_version`	Version associated with the item usage.
`vault_uuid`	Identifier of the vault containing the item.
`item_uuid`	Identifier of the used item.
`action`	Action performed.
`user.uuid`	User identifier.
`user.name`	User's full name.
`user.email`	User's email address.
`user.user_type`	User type.
`user.user_account_uuid`	1Password account identifier for the user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

The source export stringifies used_version; the 1Password Events API schema defines used_version as an integer.

{
  "uuid": "2CH5VCBJYJGTBHG4VQPRCPOSUM",
  "timestamp": "1/11/2024, 9:47:34.000 AM",
  "client": {
    "app_name": "1Password for Windows",
    "app_version": "81003012",
    "platform_name": "LT-NLD-RDK",
    "platform_version": "Unknown",
    "os_name": "Windows",
    "os_version": "10.0.2009",
    "ip_address": "95.93.92.51"
  },
  "location": {
    "country": "Portugal",
    "region": "Faro",
    "city": "Olh�o",
    "latitude": 37.0272,
    "longitude": -7.8338
  },
  "action": "secure-copy",
  "used_version": "4",
  "vault_uuid": "pxod76epyirrlm3hnsj4lws6yi",
  "item_uuid": "wwrhfe5qq3j7afzr6dxkgsnsem",
  "user": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  }
}

References #

select-sso-provider

Description

A sign-in provider was selected for a website.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`used_version`	Version associated with the item usage.
`vault_uuid`	Identifier of the vault containing the item.
`item_uuid`	Identifier of the used item.
`action`	Action performed.
`user.uuid`	User identifier.
`user.name`	User's full name.
`user.email`	User's email address.
`user.user_type`	User type.
`user.user_account_uuid`	1Password account identifier for the user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

server-create

Description

An item was created, duplicated, or moved on the server.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`used_version`	Version associated with the item usage.
`vault_uuid`	Identifier of the vault containing the item.
`item_uuid`	Identifier of the used item.
`action`	Action performed.
`user.uuid`	User identifier.
`user.name`	User's full name.
`user.email`	User's email address.
`user.user_type`	User type.
`user.user_account_uuid`	1Password account identifier for the user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

{
  "account_uuid": "opid-4a7dcecbc0a00ccd4248",
  "action": "server-create",
  "client": {
    "app_name": "REDACTED",
    "app_version": "REDACTED",
    "ip_address": "203.0.113.16",
    "os_name": "REDACTED",
    "os_version": "REDACTED",
    "platform_name": "REDACTED",
    "platform_version": "REDACTED"
  },
  "item_uuid": "opid-b59f780f2c7d9b1ab916",
  "location": {
    "city": "CITY-REDACTED",
    "country": "ZZ",
    "latitude": 0.0,
    "longitude": 0.0,
    "region": "REGION-REDACTED"
  },
  "timestamp": "2026-08-24T00:44:57.936579188Z",
  "used_version": 1,
  "user": {
    "email": "user-43f0f48e30b0@example.invalid",
    "name": "User 360bf3a8254a",
    "type": "user",
    "uuid": "opid-adc712a95a826da15eac"
  },
  "uuid": "opid-97e99a38216c5bfe7ad4",
  "vault_uuid": "opid-4f273719af40edb843de"
}

References #

server-fetch

Description

An item or file was retrieved on the server.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`used_version`	Version associated with the item usage.
`vault_uuid`	Identifier of the vault containing the item.
`item_uuid`	Identifier of the used item.
`action`	Action performed.
`user.uuid`	User identifier.
`user.name`	User's full name.
`user.email`	User's email address.
`user.user_type`	User type.
`user.user_account_uuid`	1Password account identifier for the user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

{
  "account_uuid": "opid-4a7dcecbc0a00ccd4248",
  "action": "server-fetch",
  "client": {
    "app_name": "REDACTED",
    "app_version": "REDACTED",
    "ip_address": "203.0.113.16",
    "os_name": "REDACTED",
    "os_version": "REDACTED",
    "platform_name": "REDACTED",
    "platform_version": "REDACTED"
  },
  "item_uuid": "opid-b59f780f2c7d9b1ab916",
  "location": {
    "city": "CITY-REDACTED",
    "country": "ZZ",
    "latitude": 0.0,
    "longitude": 0.0,
    "region": "REGION-REDACTED"
  },
  "timestamp": "2026-08-24T00:44:58.911929864Z",
  "used_version": 1,
  "user": {
    "email": "user-43f0f48e30b0@example.invalid",
    "name": "User 360bf3a8254a",
    "type": "user",
    "uuid": "opid-adc712a95a826da15eac"
  },
  "uuid": "opid-74c74bcf9c23fd786b83",
  "vault_uuid": "opid-4f273719af40edb843de"
}

References #

server-update

Description

An item was updated, deleted, moved, archived, restored, or favorited on the server.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`used_version`	Version associated with the item usage.
`vault_uuid`	Identifier of the vault containing the item.
`item_uuid`	Identifier of the used item.
`action`	Action performed.
`user.uuid`	User identifier.
`user.name`	User's full name.
`user.email`	User's email address.
`user.user_type`	User type.
`user.user_account_uuid`	1Password account identifier for the user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

{
  "account_uuid": "opid-4a7dcecbc0a00ccd4248",
  "action": "server-update",
  "client": {
    "app_name": "REDACTED",
    "app_version": "REDACTED",
    "ip_address": "203.0.113.16",
    "os_name": "REDACTED",
    "os_version": "REDACTED",
    "platform_name": "REDACTED",
    "platform_version": "REDACTED"
  },
  "item_uuid": "opid-b59f780f2c7d9b1ab916",
  "location": {
    "city": "CITY-REDACTED",
    "country": "ZZ",
    "latitude": 0.0,
    "longitude": 0.0,
    "region": "REGION-REDACTED"
  },
  "timestamp": "2026-08-24T00:44:59.449784983Z",
  "used_version": 2,
  "user": {
    "email": "user-43f0f48e30b0@example.invalid",
    "name": "User 360bf3a8254a",
    "type": "user",
    "uuid": "opid-adc712a95a826da15eac"
  },
  "uuid": "opid-d43c3e7893670191729a",
  "vault_uuid": "opid-4f273719af40edb843de"
}

References #

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`used_version`	Version associated with the item usage.
`vault_uuid`	Identifier of the vault containing the item.
`item_uuid`	Identifier of the used item.
`action`	Action performed.
`user.uuid`	User identifier.
`user.name`	User's full name.
`user.email`	User's email address.
`user.user_type`	User type.
`user.user_account_uuid`	1Password account identifier for the user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

The source export stringifies used_version; the 1Password Events API schema defines used_version as an integer.

{
  "used_version": "1",
  "user": {
    "uuid": "DUMMY-USER-0004",
    "name": "Dummy User 004",
    "email": "dummy.user004@example.invalid",
    "type": "user"
  },
  "uuid": "DUMMY-ID-0008",
  "action": "share",
  "client": {
    "app_name": "1Password for Mac",
    "app_version": "81228025",
    "platform_name": "DUMMY-DEVICE-001",
    "platform_version": "Mac16,8",
    "os_name": "MacOSX",
    "os_version": "26.5.2",
    "ip_address": "192.0.2.3"
  },
  "location": {
    "country": "Dummy Country 003",
    "region": "Dummy Region 003",
    "city": "Dummy City 003",
    "latitude": 0.0,
    "longitude": 0.0
  },
  "item_uuid": "DUMMY-ID-0009",
  "timestamp": "2026-08-20T15:08:16.4936253Z",
  "vault_uuid": "DUMMY-ID-0010",
  "account_uuid": "DUMMY-ID-0004"
}