Datadog SIEM Content Packs for 1Password

• https://docs.datadoghq.com/security/default_rules/#1password

• 1Password vault export attempt by user
• Unusual 1Password item usage action observed from user
• Impossible travel event observed from 1Password user
• Anomalous amount of failed sign-in attempts by 1Password user
• Unusual 1Password device authorization activity
• Attempt to modify a 1Password item by user

See also

• Datadog security: Datadog Cloud SIEM, Content Packs, Datadog Cloud SIEM signals