---
title: 1Password
description: Get events for your 1Password account.
breadcrumbs: Docs > Integrations > 1Password
---

# 1Password
Integration version1.0.0   1Password Dashboard Overview1Password Dashboard Map1Password Detection Rule
## Overview{% #overview %}

With [1Password Business](https://support.1password.com/explore/business/), you can send your account events to Datadog Cloud SIEM using the 1Password Events API. In addition, you can:

- Control your 1Password data retention.
- Build custom widgets and dashboards.
- Set up detection rules that trigger specific actions.
- Cross-reference 1Password events with the data from other services.

Datadog's integration with 1Password collects logs using [1Password Events API](https://developer.1password.com/docs/events-api/), which generates three types of logs:

- **Sign-in attempts**: These logs include the name and IP address of the user who attempted to sign in to the account, when the attempt was made, and for failed attempts, the cause of the failure, such as an incorrect password, key, or second factor.
- **Item usage**: This type of log contains actions that describe how an item—for example, a password or other credential—was used. Possible values for action include fill, enter-item-edit-mode, export, share, secure-copy, reveal, select-sso-provider, server-create, server-update, and server-fetch.
- **Audit events**: These logs include actions performed by team members in a 1Password account, such as changes made to the account, vaults, groups, users, and more.

After parsing your 1Password logs, Datadog then populates the [out-of-the-box 1Password overview dashboard](https://app.datadoghq.com/dash/integration/1Password-Overview) with insights into security-related events from your 1Password values, items, and users. Widgets include toplists showing the most frequent and infrequent events, and a geolocation map that shows you the country of origin of sign-in attempts.

## Setup{% #setup %}

**Step 1: Generate an Access Token in 1Password**

To get started, [sign in](https://start.1password.com/signin) to your 1Password account, click **Integrations** in the sidebar, and choose **Datadog**.

Next, add the integration to your 1Password account and create a bearer JSON web token:

1. Enter a **Name** for the integration, then click **Add Integration**.
1. Enter a **Name** for the bearer token and choose when the token will expire.
1. Select the event types your token will have access to: a. Sign-in attempts b. Item usage events c. Audit events
1. Click **Issue Token** to generate the access token key. For additional information on issuing or revoking 1Password bearer tokens, see [1Password's documentation](https://support.1password.com/events-reporting/#appendix-issue-or-revoke-bearer-tokens).
1. Click **Save in 1Password** and choose which vault to save your token to.
1. Click **View Integration Details** to view the token.

You will need this token in the next step.

**Step 2: Connect your 1Password account to Datadog**

To get started, copy the access token key from the previous step.

1. Enter a **Name** for the account.
1. Paste the **access token key** from your 1Password account into the **Access Token** field.
1. Under host type, select the **region & plan of your 1Password account**.
1. Optionally, you can define **tags** for these logs.
1. Click **Save**.

### Validation{% #validation %}

Search your Datadog logs with `source:1password`. If you installed the integration correctly, you should be able to see 1Password events.

## Data Collected{% #data-collected %}

### Metrics{% #metrics %}

The 1Password integration does not include any metrics.

### Service Checks{% #service-checks %}

The 1Password integration does not include any service checks.

### Events{% #events %}

The 1Password integration does not include any events.

## Troubleshooting{% #troubleshooting %}

### Event Delivery Timing{% #event-delivery-timing %}

Events from desktop, mobile, and 1Password Connect clients may be delayed because they sync in batches. These delays can range from minutes to hours depending on user activity and network conditions. Events always include the original timestamp of when they occurred.

Events from the 1Password web app are typically available immediately. If you observe significant delays from the web app, contact [1Password Support](https://support.1password.com/contact/?o=https%3a%2f%2fsupport.1password.com%2fevents-reporting%2f).

Need help from Datadog? Contact [Datadog support](https://docs.datadoghq.com/help/). Alternatively, if you need help from 1Password, contact [1Password support](https://support.1password.com/contact/?o=https%3a%2f%2fsupport.1password.com%2fevents-reporting%2f).