UserVaultAccess

Action	Sample	Rule
User vault access (catch-all)	N	Y
Grant User Vault Access	Y	Y
Revoke User Vault Access	Y	N
Update User Vault Access	Y	Y

any: User vault access (catch-all)

Description

Matches any user vault access event.

Fields #

Name	Description	Rules
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.	3 detection rules
`object_type`	Type of affected object.	3 detection rules
`object_uuid`	Identifier of the affected object.	2 detection rules
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Detection Patterns #

Persistence: Account Manipulation

1Password-GroupVaultAccess any: Group vault accessOR1Password-UserVaultAccess any: User vault access

1 rule

Kusto

1Password - Privileged vault permission change (source)

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`action` (kusto rule field)	contains	`grant`	3 rules	kusto
`action` (kusto rule field)	contains	`update`	3 rules	kusto
`action` (kusto rule field)	contains	`revoke`	2 rules	kusto
`log_source` (kusto rule field)	eq	`auditevents`	3 rules	kusto
`object_type` (kusto rule field)	eq	`uva`	3 rules	kusto
`object_uuid` (kusto rule field)	eq	`watchlist`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

1Password - Non-privileged vault user permission change source medium: This will alert when user permissions have changed within a non-privileged vault which have been implemented by an actor that was not the target user account. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same. Ref: https://1password.com/ Ref: https://github.com/securehats/T1098
1Password - Potential insider privilege escalation via vault source medium: This will alert when an actor grants, or updates their own permissions via a vault. Once this analytics rule is triggered it will group all related future alerts for upto an hour when all related entities are the same. Ref: https://1password.com/ Ref: https://github.com/securehats/T1078

References #

uva-grant: Grant User Vault Access

Description

A user was granted access to a vault.

Fields #

Name	Description	Rules
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.	1 detection rule
`object_type`	Type of affected object.	1 detection rule
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

{
  "account_uuid": "opid-4a7dcecbc0a00ccd4248",
  "action": "grant",
  "actor_details": {
    "email": "user-43f0f48e30b0@example.invalid",
    "name": "User 360bf3a8254a",
    "uuid": "opid-adc712a95a826da15eac"
  },
  "actor_type": "user",
  "actor_uuid": "opid-adc712a95a826da15eac",
  "aux_details": {
    "email": "user-43f0f48e30b0@example.invalid",
    "name": "User 360bf3a8254a",
    "uuid": "opid-adc712a95a826da15eac"
  },
  "aux_id": 0,
  "aux_info": "REDACTED",
  "aux_uuid": "opid-adc712a95a826da15eac",
  "location": {
    "city": "CITY-REDACTED",
    "country": "ZZ",
    "latitude": 0.0,
    "longitude": 0.0,
    "region": "REGION-REDACTED"
  },
  "object_type": "uva",
  "object_uuid": "opid-4f273719af40edb843de",
  "session": {
    "device_uuid": "opid-517df91906f62a8bf419",
    "ip": "203.0.113.16",
    "login_time": "2026-08-24T00:44:54.720872837Z",
    "uuid": "opid-4f31aa5206aa645ce7e4"
  },
  "timestamp": "2026-08-24T00:44:56.816093916Z",
  "uuid": "opid-5bc74a82edcb160771fb"
}

Detection Patterns #

Credential Access: Credentials from Password Stores

1Password-ItemUsage any: Item usageOR1Password-UserVaultAccess uva-grant: Grant User Vault AccessORuva-update: Update User Vault Access

1 rule

Kusto

1Password - Secret extraction post vault access change by administrator (source)

Common Indicators #

Field	Kind	Value	Rules	Vendors
`action` (kusto rule field)	eq	`update`	1 rule	kusto
`object_type` (kusto rule field)	eq	`uva`	1 rule	kusto

References #

uva-revoke: Revoke User Vault Access

Description

A user's access to a vault was revoked.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

The source export stringifies aux_id; the 1Password Events API schema defines aux_id as an integer.

{
  "uuid": "MVYFLMNKYSBZELMKQRI7YSDEBP",
  "timestamp": "1/3/2024, 1:56:47.692 PM",
  "location": {
    "country": "The Netherlands",
    "region": "North Brabant",
    "city": "Rijen",
    "latitude": 51.5923,
    "longitude": 4.9218
  },
  "actor_uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
  "actor_details": {
    "uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
    "name": "Walter White",
    "email": "walter.white@securehats.nl"
  },
  "action": "revoke",
  "object_type": "uva",
  "object_uuid": "v55t357pscfhe4hgoy52z3wjte",
  "aux_id": "11848976",
  "aux_uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
  "aux_details": {
    "uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
    "name": "Walter White",
    "email": "walter.white@securehats.nl"
  },
  "session": {
    "uuid": "2OQHYRJL3JEUVPMOJRBGIJLDDI",
    "login_time": "2024-01-03T13:56:20.4876133Z",
    "device_uuid": "uh7t35mrsnycrf4vz6wbdhs4y4",
    "ip": "76.75.244.76"
  }
}

References #

uva-update: Update User Vault Access

Description

A user's vault access was updated.

Fields #

Name	Description	Rules
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.	1 detection rule
`object_type`	Type of affected object.	1 detection rule
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

The source export stringifies aux_id; the 1Password Events API schema defines aux_id as an integer.

{
  "uuid": "UBBFFAIH5LDXT5343MAOWFXGKG",
  "timestamp": "1/3/2024, 1:56:14.226 PM",
  "location": {
    "country": "The Netherlands",
    "region": "North Brabant",
    "city": "Rijen",
    "latitude": 51.5923,
    "longitude": 4.9218
  },
  "actor_uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
  "actor_details": {
    "uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
    "name": "Walter White",
    "email": "walter.white@securehats.nl"
  },
  "action": "update",
  "object_type": "uva",
  "object_uuid": "v55t357pscfhe4hgoy52z3wjte",
  "aux_id": "11848976",
  "aux_uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
  "aux_details": {
    "uuid": "QD3Q2WVSVZFHZMC3O6HY3VSC6Y",
    "name": "Walter White",
    "email": "walter.white@securehats.nl"
  },
  "aux_info": "32",
  "session": {
    "uuid": "MM5OIIXNF5BZ5LRW3ZOZUYBIPI",
    "login_time": "2024-01-03T13:53:12.5527746Z",
    "device_uuid": "uh7t35mrsnycrf4vz6wbdhs4y4",
    "ip": "76.75.244.76"
  }
}

Detection Patterns #

Credential Access: Credentials from Password Stores

1Password-ItemUsage any: Item usageOR1Password-UserVaultAccess uva-grant: Grant User Vault AccessORuva-update: Update User Vault Access

1 rule

Kusto

1Password - Secret extraction post vault access change by administrator (source)

Common Indicators #

Field	Kind	Value	Rules	Vendors
`action` (kusto rule field)	eq	`update`	1 rule	kusto
`object_type` (kusto rule field)	eq	`uva`	1 rule	kusto