Attempt to exfiltrate a 1Password item by user

Set up the 1password integration.



Detect possible exfiltration attempts from 1Password through an item export.


This rule monitors 1Password audit logs to determine when the export item usage action occurs. This could indicate exfiltration attempts from 1Password by downloading or exporting items.

Triage & response

  1. Investigate the {{}} attempting to download or export item {{@item_uuid}} from vault {{@vault_uuid}}.
  2. If this action was unintend by the user:
    • Rotate the user’s 1Password master password
    • Identify all the items that were exported and rotate the necessary authentication credentials