Vault

Action	Sample	Rule
Vault (catch-all)	N	N
Add Vault	Y	N
Delete Vault	Y	Y
Export Vault	Y	Y
Mark Vault To Be Purged	N	N
Update Client Access	N	N
Update Attributes	Y	N

any: Vault (catch-all)

Description

Matches any vault event.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

References #

vault-create: Add Vault

Description

A vault was added.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

{
  "account_uuid": "opid-4a7dcecbc0a00ccd4248",
  "action": "create",
  "actor_details": {
    "email": "user-43f0f48e30b0@example.invalid",
    "name": "User 360bf3a8254a",
    "uuid": "opid-adc712a95a826da15eac"
  },
  "actor_type": "user",
  "actor_uuid": "opid-adc712a95a826da15eac",
  "location": {
    "city": "CITY-REDACTED",
    "country": "ZZ",
    "latitude": 0.0,
    "longitude": 0.0,
    "region": "REGION-REDACTED"
  },
  "object_type": "vault",
  "object_uuid": "opid-4f273719af40edb843de",
  "session": {
    "device_uuid": "opid-517df91906f62a8bf419",
    "ip": "203.0.113.16",
    "login_time": "2026-08-24T00:44:54.720872837Z",
    "uuid": "opid-4f31aa5206aa645ce7e4"
  },
  "timestamp": "2026-08-24T00:44:56.778294226Z",
  "uuid": "opid-caa4f88d1e23dcc3fca1"
}

References #

vault-delete: Delete Vault

Description

A vault was deleted.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

{
  "account_uuid": "opid-4a7dcecbc0a00ccd4248",
  "action": "delete",
  "actor_details": {
    "email": "user-43f0f48e30b0@example.invalid",
    "name": "User 360bf3a8254a",
    "uuid": "opid-adc712a95a826da15eac"
  },
  "actor_type": "user",
  "actor_uuid": "opid-adc712a95a826da15eac",
  "location": {
    "city": "CITY-REDACTED",
    "country": "ZZ",
    "latitude": 0.0,
    "longitude": 0.0,
    "region": "REGION-REDACTED"
  },
  "object_type": "vault",
  "object_uuid": "opid-4f273719af40edb843de",
  "session": {
    "device_uuid": "opid-517df91906f62a8bf419",
    "ip": "203.0.113.16",
    "login_time": "2026-08-24T00:44:54.720872837Z",
    "uuid": "opid-4f31aa5206aa645ce7e4"
  },
  "timestamp": "2026-08-24T00:45:03.085177465Z",
  "uuid": "opid-bbb9c55574e4bde2f26a"
}

Detection Patterns #

Credential Access: Credentials from Password Stores

1Password-User user-delete: Change User State FromORuser-suspend: Change User State FromOR1Password-Vault vault-delete: Delete VaultORvault-export: Export Vault

1 rule

Kusto

1Password - Vault export prior to account suspension or deletion (source)

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`action` (kusto rule field)	eq	`delete`	1 rule	kusto
`action` (kusto rule field)	eq	`export`	1 rule	kusto
`object_type` (kusto rule field)	eq	`user`	1 rule	kusto
`object_type` (kusto rule field)	eq	`vault`	1 rule	kusto

References #

vault-export: Export Vault

Description

A vault was exported.

Fields #

Name	Description	Rules
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.	3 detection rules
`object_type`	Type of affected object.	3 detection rules
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

{
  "uuid": "FBODO62J4WR72EGECMVQ5BCAF4",
  "timestamp": "1/15/2024, 10:57:31.218 AM",
  "location": {
    "country": "The Netherlands",
    "region": "Utrecht",
    "city": "Amersfoort",
    "latitude": 52.1849,
    "longitude": 5.3954
  },
  "actor_uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
  "actor_details": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  },
  "action": "export",
  "object_type": "vault",
  "object_uuid": "n36hcpeonwo63gr566l5kqww7u",
  "session": {
    "uuid": "HDG7CELQ6NBTBNY6W362BZAT2E",
    "login_time": "2024-01-15T10:56:59.3311720Z",
    "device_uuid": "se3mwxcxoyttdxigu3rgwn3d6i",
    "ip": "80.114.2.247"
  }
}

Detection Patterns #

Credential Access: Credentials from Password Stores

1Password-User user-delete: Change User State FromORuser-suspend: Change User State FromOR1Password-Vault vault-delete: Delete VaultORvault-export: Export Vault

1 rule

Kusto

1Password - Vault export prior to account suspension or deletion (source)

Common Indicators #

Field	Kind	Value	Rules	Vendors
`action` (kusto rule field)	eq	`export`	3 rules	kusto
`action` (kusto rule field)	eq	`delete`	1 rule	kusto
`object_type` (kusto rule field)	eq	`vault`	3 rules	kusto
`object_type` (kusto rule field)	eq	`user`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

1Password - Vault export post account creation source medium: This will alert when a successful vault export has occurred within 14 days of a new account being created within 1Password. Ref: https://1password.com/ Ref: https://github.com/securehats/T1136, T1555
1Password - Vault export source low: This will alert when a successful vault export has occurred within 1Password. Ref: https://1password.com/ Ref: https://github.com/securehats/T1555

References #

vault-purge: Mark Vault To Be Purged

Description

A vault was marked for purging.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

References #

vault-update: Update Client Access

Description

The client access value for a vault was updated.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

References #

vault-updatea: Update Attributes

Description

A vault name or description was changed.

Fields #

Name	Description
`uuid`	Unique event identifier.
`timestamp`	Time the event occurred.
`actor_uuid`	Actor identifier.
`actor_details.uuid`	Actor identifier.
`actor_details.name`	Actor's full name.
`actor_details.email`	Actor's email address.
`actor_type`	Type of actor.
`actor_account_uuid`	1Password account identifier of the actor.
`account_uuid`	1Password account identifier.
`action`	Action performed.
`object_type`	Type of affected object.
`object_uuid`	Identifier of the affected object.
`object_details.uuid`	Affected user identifier, when applicable.
`object_details.name`	Affected user's full name, when applicable.
`object_details.email`	Affected user's email address, when applicable.
`aux_id`	Numeric identifier for related event data.
`aux_uuid`	Identifier for related event data.
`aux_details.uuid`	Related user identifier, when applicable.
`aux_details.name`	Related user's full name, when applicable.
`aux_details.email`	Related user's email address, when applicable.
`aux_info`	Additional event information.
`session.uuid`	Session identifier.
`session.login_time`	Time the session started.
`session.device_uuid`	Identifier of the session device.
`session.ip`	IP address used for the session.
`location.country`	Client country inferred from IP address.
`location.region`	Client region inferred from IP address.
`location.city`	Client city inferred from IP address.
`location.longitude`	Client longitude inferred from IP address.
`location.latitude`	Client latitude inferred from IP address.

Example Event #

{
  "uuid": "DRH5ZT5EQDVJ4EQFYKMNH2ADSL",
  "timestamp": "1/15/2024, 10:54:32.610 AM",
  "location": {
    "country": "The Netherlands",
    "region": "Utrecht",
    "city": "Amersfoort",
    "latitude": 52.1849,
    "longitude": 5.3954
  },
  "actor_uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
  "actor_details": {
    "uuid": "2C4RSXPRI5BVFOS3TCJFYDZYXY",
    "name": "Tommy Shelby",
    "email": "tommy.shelby@securehats.nl"
  },
  "action": "updatea",
  "object_type": "vault",
  "object_uuid": "n36hcpeonwo63gr566l5kqww7u",
  "session": {
    "uuid": "4YN2SFKZJ5E5RJGIB5LRFNNFZM",
    "login_time": "2024-01-15T10:46:49.2290152Z",
    "device_uuid": "tmikosahabjierhqhaapybduj4",
    "ip": "80.114.2.247"
  }
}