Datadog SIEM Content Packs for 1Password

• https://docs.datadoghq.com/security/default_rules/#1password

Rules:

• 1Password vault export attempt by user
• Unusual 1Password item usage action observed from user
• Impossible travel event observed from 1Password user
• Anomalous amount of failed sign-in attempts by 1Password user
• Unusual 1Password device authorization activity
• Attempt to modify a 1Password item by user

Related

• 1Password Datadog integration

See also

• Datadog security: Datadog Cloud SIEM, Content Packs, Datadog Cloud SIEM signals
• 1password, Privnote, Kolide, 1password connect, 1password Kubernetes Injector, 1password-cli, kind: OnePasswordItem, 1Password Browser extension, uses: 1password/load-secrets-action@v2