Unusual 1Password item usage action observed from user

Documentos > Datadog Security > OOTB Rules > Unusual 1Password item usage action observed from user

Classification:

attack

Tactic:

Technique:

Esta página aún no está disponible en español. Estamos trabajando en su traducción.
Si tienes alguna pregunta o comentario sobre nuestro actual proyecto de traducción, no dudes en ponerte en contacto con nosotros.

Goal

Detect when 1Password item usage activity is observed.

Strategy

This rule monitors 1Password audit logs for the following item usage actions

enter-item-edit-mode
export
fill
reveal
select-sso-provider
secure-copy
server-create
server-fetch
server-update
share

Note: This rule uses the New Value detection method, to determine when a previously unseen item usage action is observed.

Triage & response

Investigate {{@usr.email}} attempting an item usage action: {{@evt.name}} that they haven’t performed recently with item {{@item_uuid}} within vault {{@vault_uuid}}.