SignInAttempt

Action	Sample	Rule
Sign-in attempt (catch-all)	N	Y
all_blocked	Y	N
anonymous_blocked	Y	N
code_bad	N	N
code_disabled	N	N
code_timeout	N	N
continent_blocked	N	N
country_blocked	Y	N
credentials_ok	Y	Y
duo_bad	N	N
duo_disabled	N	N
duo_native_bad	N	N
duo_timeout	N	N
federated	N	N
ip_blocked	N	N
mfa_missing	N	N
mfa_ok	Y	Y
modern_version_missing	N	N
modern_version_old	N	N
non_sso_user	N	N
password_secret_bad	Y	N
platform_secret_bad	Y	N
platform_secret_disabled	N	N
platform_secret_proxy	N	N
service_account_sso_denied	N	N
sso_user_mismatch	N	N
totp_bad	Y	N
totp_disabled	N	N
totp_timeout	Y	N
u2f_bad	N	N
u2f_disabled	N	N
u2f_timout	N	N
unknown	Y	N
version_old	Y	N

any: Sign-in attempt (catch-all)

Description

Matches any sign-in attempt event.

Fields #

Name	Description	Rules
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.	1 detection rule
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`event_type` (panther rule field)	eq	`failed_login`	2 rules	panther
`event_type` (panther rule field)	eq	`successful_login`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Unusual 1Password Client Detected source medium: Detects when unusual or undesirable 1Password clients access your 1Password accountT1555
Brute Force By IP source informational: An actor user was denied login access more times than the configured threshold.T1110
Brute Force By User source informational: An actor user was denied login access more times than the configured threshold.T1110

Show 4 more (7 total) on the rules page

References #

1Password Events API OpenAPI specification

all_blocked

Description

A sign-in attempt was blocked by a firewall rule.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

{
  "uuid": "BNNLZCEEZVCRZOAGK6RSM2LCYA",
  "session_uuid": "QTEO4BZZWRCEHKUNZECB5EEYZI",
  "timestamp": "1/14/2024, 1:14:25.425 PM",
  "country": "IL",
  "category": "firewall_failed",
  "type": "all_blocked",
  "details": {
    "value": ""
  },
  "target_user": {
    "uuid": "54SFBG7JOJEQRKEY5TQ7JXRFVA",
    "name": "Gus Fring",
    "email": "gus.fring@securehats.nl"
  },
  "client": {
    "app_name": "1Password for iOS",
    "app_version": "81023003",
    "platform_name": "iPhone",
    "platform_version": "iPhone16,1 (D83AP)",
    "os_name": "iOS",
    "os_version": "17.1.2",
    "ip_address": "192.118.11.113"
  },
  "location": {
    "country": "IL",
    "region": "Tel Aviv",
    "city": "Tel Aviv",
    "latitude": 32.0803,
    "longitude": 34.7805
  }
}

References #

anonymous_blocked

Description

An anonymous sign-in attempt was blocked.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

{
  "type": "anonymous_blocked",
  "uuid": "DUMMY-ID-0066",
  "client": {
    "app_name": "1Password CLI",
    "app_version": "2390001",
    "platform_name": "localhost",
    "platform_version": "amd64",
    "os_name": "Linux",
    "os_version": "12",
    "ip_address": "192.0.2.16"
  },
  "country": "Dummy Country 001",
  "details": {
    "value": "Cloud Provider"
  },
  "category": "firewall_failed",
  "location": {
    "country": "Dummy Country 001",
    "region": "Dummy Region 006",
    "city": "Dummy City 012",
    "latitude": 0.0,
    "longitude": 0.0
  },
  "timestamp": "2026-08-19T15:35:32.20997114Z",
  "target_user": {
    "uuid": "DUMMY-USER-0024",
    "name": "Dummy User 024",
    "email": "dummy.user024@example.invalid",
    "type": "user"
  },
  "account_uuid": "DUMMY-ID-0004",
  "session_uuid": "DUMMY-ID-0067"
}

References #

code_bad

Description

The sign-in code was invalid.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

code_disabled

Description

Code-based authentication was disabled.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

code_timeout

Description

The sign-in code timed out.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

continent_blocked

Description

A sign-in attempt was blocked by a continent-based firewall rule.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

country_blocked

Description

A sign-in attempt was blocked by a country-based firewall rule.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

{
  "uuid": "VV6M5SG5PJEWVHJQPVBZL7GV2E",
  "session_uuid": "DYEMWNGV35CXVACU2NZ3VA4CC4",
  "timestamp": "1/15/2024, 2:34:14.964 PM",
  "country": "US",
  "category": "firewall_reported_success",
  "type": "country_blocked",
  "details": {
    "value": "US"
  },
  "target_user": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  },
  "client": {
    "app_name": "1Password Browser Extension",
    "app_version": "21900005",
    "platform_name": "Edge extension",
    "platform_version": "119.0.2151.97",
    "os_name": "Windows",
    "os_version": "11.0",
    "ip_address": "91.196.220.160"
  },
  "location": {
    "country": "US",
    "region": "California",
    "city": "Los Angeles",
    "latitude": 34.0544,
    "longitude": -118.2441
  }
}

References #

credentials_ok

Description

Account credentials were accepted.

Fields #

Name	Description	Rules
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.	4 detection rules
`type`	Specific sign-in attempt type.	4 detection rules
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.	3 detection rules
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.	3 detection rules
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.	3 detection rules
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

{
  "account_uuid": "opid-4a7dcecbc0a00ccd4248",
  "category": "success",
  "client": {
    "app_name": "REDACTED",
    "app_version": "REDACTED",
    "ip_address": "203.0.113.16",
    "os_name": "REDACTED",
    "os_version": "REDACTED",
    "platform_name": "REDACTED",
    "platform_version": "REDACTED"
  },
  "country": "ZZ",
  "details": null,
  "location": {
    "city": "CITY-REDACTED",
    "country": "ZZ",
    "latitude": 0.0,
    "longitude": 0.0,
    "region": "REGION-REDACTED"
  },
  "session_uuid": "opid-4f31aa5206aa645ce7e4",
  "target_user": {
    "email": "user-43f0f48e30b0@example.invalid",
    "name": "User 360bf3a8254a",
    "type": "user",
    "uuid": "opid-adc712a95a826da15eac"
  },
  "timestamp": "2026-08-24T00:44:54.736917264Z",
  "type": "credentials_ok",
  "uuid": "opid-e2843d0cee534914acdb"
}

Detection Patterns #

Stealth: Valid Accounts

1Password-SignInAttempt credentials_ok: credentials_okORmfa_ok: mfa_ok

1 rule

Kusto

1Password - Successful anomalous sign-in (source)

Common Indicators #

Field	Kind	Value	Rules	Vendors
`category`	eq	`success`	3 rules	kusto, panther
`client:app_name` (panther rule field)	ne	`1password scim bridge`	2 rules	panther
`client:ip_address` (panther rule field)	wildcard	`...`	2 rules	panther
`type` (panther rule field)	eq	`credentials_ok`	2 rules	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

1Password Login From CrowdStrike Unmanaged Device Query source: Looks for OnePassword Logins from IP Addresses that aren''t seen in CrowdStrike''s AIP List.
1Password Login From CrowdStrike Unmanaged Device source medium linked query: 1Password Login From CrowdStrike Unmanaged Device Query: Detects 1Password Logins from IP addresses not found in CrowdStrike''s AIP list. May indicate unmanaged device being used, or faulty CrowdStrike Sensor.
1Password Login From CrowdStrike Unmanaged Device Query (crowdstrike_fdrevent table) source: Looks for OnePassword Logins from IP Addresses that aren''t seen in CrowdStrike''s AIP List. (crowdstrike_fdrevent table)

References #

1Password Events API OpenAPI specification

duo_bad

Description

Duo authentication failed.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

duo_disabled

Description

Duo authentication was disabled.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

duo_native_bad

Description

Native Duo authentication failed.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

duo_timeout

Description

Duo authentication timed out.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

federated

Description

A federated sign-in was used.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

ip_blocked

Description

A sign-in attempt was blocked by an IP-based firewall rule.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

mfa_missing

Description

A required multi-factor authentication step was missing.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

mfa_ok

Description

Multi-factor authentication succeeded.

Fields #

Name	Description	Rules
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.	1 detection rule
`type`	Specific sign-in attempt type.	1 detection rule
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

{
  "uuid": "ECN6G65MHFFWPNYXWDT7MYC2HU",
  "session_uuid": "B3CKKJLK4BD6BFWPZ3UKZETWLY",
  "timestamp": "12/11/2023, 8:05:35.222 AM",
  "country": "NL",
  "category": "success",
  "type": "mfa_ok",
  "target_user": {
    "uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
    "name": "Walter White",
    "email": "walter.white@securehats.nl"
  },
  "client": {
    "app_name": "1Password for Windows",
    "app_version": "81020036",
    "platform_name": "LAPTOP-1FSV0NBD",
    "platform_version": "Unknown",
    "os_name": "Windows",
    "os_version": "10.0.2009",
    "ip_address": "2a02:a44f:d7cb:0:453b:ca5e:d79f:19fc"
  },
  "location": {
    "country": "NL",
    "region": "Gelderland",
    "city": "Epe",
    "latitude": 52.3466,
    "longitude": 5.9963
  }
}

Detection Patterns #

Stealth: Valid Accounts

1Password-SignInAttempt credentials_ok: credentials_okORmfa_ok: mfa_ok

1 rule

Kusto

1Password - Successful anomalous sign-in (source)

Common Indicators #

Field	Kind	Value	Rules	Vendors
`category` (kusto rule field)	eq	`success`	1 rule	kusto

References #

modern_version_missing

Description

A required modern client version was missing.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

modern_version_old

Description

An outdated modern client version was used.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

non_sso_user

Description

A user not configured for SSO attempted to sign in.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

password_secret_bad

Description

The password or secret was invalid.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

{
  "uuid": "5H7XILZTG5E7RDYDJPZF374CGY",
  "session_uuid": "2VFBJVEHHBAUTIXNRYZRAPJ2XY",
  "timestamp": "2/27/2024, 5:56:07.030 AM",
  "country": "ZA",
  "category": "credentials_failed",
  "type": "password_secret_bad",
  "target_user": {
    "uuid": "LB3XERXFAFCBZCENBG4HQSOATA",
    "name": "Hector Salamanca",
    "email": "hector.salamanca@securehats.nl"
  },
  "client": {
    "app_name": "1Password for Windows",
    "app_version": "81026039",
    "platform_name": "securehats.nl-24826",
    "platform_version": "Unknown",
    "os_name": "Windows",
    "os_version": "10.0.2009",
    "ip_address": "101.110.109.43"
  },
  "location": {
    "country": "ZA",
    "region": "Western Cape",
    "city": "Cape Town",
    "latitude": -33.91,
    "longitude": 18.4304
  }
}

References #

platform_secret_bad

Description

Platform-secret authentication failed.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

{
  "uuid": "6TGQTLBORZH7VONTFI3NLPJG3U",
  "session_uuid": "7F67IATVBZGL7BBM3BI657HMMQ",
  "timestamp": "1/23/2024, 9:26:07.111 PM",
  "country": "NL",
  "category": "mfa_failed",
  "type": "platform_secret_bad",
  "target_user": {
    "uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
    "name": "Walter White",
    "email": "walter.white@securehats.nl"
  },
  "client": {
    "app_name": "1Password for Windows",
    "app_version": "81023003",
    "platform_name": "LAPTOP-1FSV0NBD",
    "platform_version": "Unknown",
    "os_name": "Windows",
    "os_version": "10.0.2009",
    "ip_address": "76.75.244.76"
  },
  "location": {
    "country": "NL",
    "region": "North Brabant",
    "city": "Rijen",
    "latitude": 51.5923,
    "longitude": 4.9218
  }
}

References #

platform_secret_disabled

Description

Platform-secret authentication was disabled.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

platform_secret_proxy

Description

A platform-secret proxy was used for authentication.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

service_account_sso_denied

Description

Service account SSO was denied.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

sso_user_mismatch

Description

The SSO user did not match the 1Password user.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

totp_bad

Description

The time-based one-time password was invalid.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

{
  "uuid": "6KYYIO3ETJEMNFBHRXCF6T6LDY",
  "session_uuid": "6AXKUBXFC5CV3L4DGXGXUDK7ZU",
  "timestamp": "2/20/2024, 10:02:28.958 PM",
  "country": "ZA",
  "category": "mfa_failed",
  "type": "totp_bad",
  "target_user": {
    "uuid": "PLM6JX3B65HYTMPDCAYXDGWYHA",
    "name": "Clay Morrow",
    "email": "clay.morrow@securehats.nl"
  },
  "client": {
    "app_name": "1Password for Web",
    "app_version": "1687",
    "platform_name": "Microsoft Edge",
    "platform_version": "121.0.2277.105",
    "os_name": "Android",
    "os_version": "13.0.0",
    "ip_address": "152.110.218.252"
  },
  "location": {
    "country": "ZA",
    "region": "Western Cape",
    "city": "Cape Town",
    "latitude": -33.9249,
    "longitude": 18.4267
  }
}

References #

totp_disabled

Description

Time-based one-time password authentication was disabled.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

totp_timeout

Description

The time-based one-time password timed out.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

{
  "uuid": "CE5TD6ORTZG7TDUBHPRM2V6GSY",
  "session_uuid": "7C5HZQOOGVAJFBNHESHBAKWVVY",
  "timestamp": "12/18/2023, 8:04:43.383 AM",
  "country": "ZA",
  "category": "mfa_failed",
  "type": "totp_timeout",
  "target_user": {
    "uuid": "QW2Z4T64HFEJRIZANDX3OKEFL4",
    "name": "Alfie Solomons",
    "email": "alfie.solomons@securehats.nl"
  },
  "client": {
    "app_name": "1Password Browser Extension",
    "app_version": "21800105",
    "platform_name": "Microsoft Edge",
    "platform_version": "120.0.2210.61",
    "os_name": "Windows",
    "os_version": "11.0",
    "ip_address": "197.90.120.176"
  },
  "location": {
    "country": "ZA",
    "region": "Gauteng",
    "city": "Johannesburg",
    "latitude": -26.2309,
    "longitude": 28.0583
  }
}

References #

u2f_bad

Description

U2F authentication failed.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

u2f_disabled

Description

U2F authentication was disabled.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

u2f_timout

Description

U2F authentication timed out.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

References #

1Password Events API OpenAPI specification

unknown

Description

An undocumented sign-in attempt type was observed in telemetry.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

{
  "uuid": "JW5PC24QR5GOHGVPGZ6OCB4RXE",
  "session_uuid": "4SOI4VWFJNGUJNI2Y64NAODQSE",
  "timestamp": "12/19/2023, 10:40:49.225 AM",
  "country": "ZA",
  "category": "mfa_failed",
  "type": "unknown",
  "target_user": {
    "uuid": "4WSX6UY2VBFVVFZMUDANQ42DFU",
    "name": "Bruce Lee",
    "email": "bruce.lee@securehats.nl"
  },
  "client": {
    "app_name": "1Password for Web",
    "app_version": "1656",
    "platform_name": "Microsoft Edge",
    "platform_version": "120.0.2210.77",
    "os_name": "Windows",
    "os_version": "11.0",
    "ip_address": "41.1.80.70"
  },
  "location": {
    "country": "ZA",
    "region": "Gauteng",
    "city": "Johannesburg",
    "latitude": -26.2309,
    "longitude": 28.0583
  }
}

References #

version_old

Description

An undocumented version_old sign-in attempt was observed in telemetry.

Fields #

Name	Description
`uuid`	Unique event identifier.
`session_uuid`	Identifier of the sign-in session.
`timestamp`	Time the event occurred.
`category`	Sign-in result category.
`type`	Specific sign-in attempt type.
`country`	Country reported for the sign-in attempt.
`details.value`	Firewall policy value, when applicable.
`target_user.uuid`	Target user identifier.
`target_user.name`	Target user's full name.
`target_user.email`	Target user's email address.
`target_user.user_type`	Target user type.
`target_user.user_account_uuid`	1Password account identifier for the target user.
`client.app_name`	Client application name.
`client.app_version`	Client application version.
`client.platform_name`	Client platform or device name.
`client.platform_version`	Platform-specific browser version, device model, or CPU version.
`client.os_name`	Client operating system.
`client.os_version`	Client operating system version.
`client.ip_address`	Client IP address.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.
`account_uuid`	1Password account identifier.

Example Event #

{
  "type": "version_old",
  "uuid": "DUMMY-ID-0029",
  "client": {
    "app_name": "1Password for Web",
    "app_version": "1941",
    "platform_name": "Chrome",
    "platform_version": "133.0.6943.127",
    "os_name": "Windows",
    "os_version": "11.0",
    "ip_address": "192.0.2.8"
  },
  "country": "Dummy Country 003",
  "category": "modern_version_failed",
  "location": {
    "country": "Dummy Country 003",
    "region": "Dummy Region 003",
    "city": "Dummy City 005",
    "latitude": 0.0,
    "longitude": 0.0
  },
  "timestamp": "2026-08-06T13:20:11.026987245Z",
  "target_user": {
    "uuid": "DUMMY-USER-0011",
    "name": "Dummy User 011",
    "email": "dummy.user011@example.invalid",
    "type": "user"
  },
  "account_uuid": "DUMMY-ID-0004",
  "session_uuid": "DUMMY-ID-0030"
}