1Password collector

Overview

With 1Password Collector, you can send your account activity to Devo using the 1Password Events Reporting API. This API can report 1Password activity like sign-in attempts, item usage, and audit events.

Devo collector features

Feature	Details
Allow parallel downloading (`multipod`)	`not allowed`
Running environments	`collector server` `on premise`
Populated Devo events	`table`
Flattening pre-processing	`no`
Allowed source events obfuscation	`yes`

Data sources

Data source	Description	API endpoint	Collector service name	Devo table	Available from release
Audit Events	Returns a list of audit events from the Activity Log.	`/api/v1/auditevents`	`audit`	`auth.agilebits.onepassword.audit`	`v1.0.1`
Item Usage Actions	Returns a list of account activity events.	`/api/v1/itemusages`	`item_usage`	`auth.agilebits.onepassword.itemusage`	`v1.0.0`
Sign-in Attempts	Returns a list of sign-in attempts.	`/api/v1/signinattempts`	`sign_in_attempts`	`auth.agilebits.onepassword.signinattempt`	`v1.0.0`

Configuration requirements

To run this collector, there are some configurations detailed below that you need to consider.

Configuration	Details
Cylance APP	You need to run a Cylance app.
Application ID	Once you create the App, it gives you an Application ID.
Application Secret	Once you create the App, it gives you an Application Secret.
Tenant ID	You can find it in your Cylance console.

Refer to the Vendor setup section to know more about these configurations.

For more information on how the events are parsed, visit our page.

Flattening preprocessing

Data source	Collector service	Optional	Flattening details
Source	Service	`yes` `no`	Flattening steps

Vendor setup

Generate a Bearer Token

To issue a bearer token:

Sign in to your account on http://1Password.com and click Integrations in the sidebar.
Choose the Events Reporting integration where you want to issue a token and click “Add a token”.
Enter a name for the bearer token and choose when it will expire. Select or deselect the event types the token has access to, then click Issue Token.
Click Save in 1Password and choose which vault to save your token to. Then click View Integration Details.

Additional Information: Get started with 1Password Events Reporting | issue or revoke bearer tokens

Identify Your 1Password Server

The URL of the server that hosts your 1Password account is required in order to make requests to the 1Password Events API.

If your account is on:	Your Events API URL is:
1Password.com	`https://events.1password.com` (1Password Business) `https://events.ent.1password.com` (1Password Enterprise)
http://1Password.ca	`https://events.1password.ca`
http://1Password.eu	`https://events.1password.eu`

Additional Information: Get started with 1Password Events Reporting | Servers

Minimum configuration required for basic pulling

Although this collector supports advanced configuration, the fields required to retrieve data with basic configuration are defined below.

This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check setting sections for details.

Setting	Details
`base_url`	The URL of the server that hosts your 1Password account
`token`	Access token created in the 1Password console.

Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector).

We use a piece of software called Collector Server to host and manage all our available collectors.

To enable the collector for a customer:

In the Collector Server GUI, access the domain in which you want this instance to be created
Click Add Collector and find the one you wish to add.
In the Version field, select the latest value.
In the Collector Name field, set the value you prefer (this name must be unique inside the same Collector Server domain).
In the sending method select Direct Send. Direct Send configuration is optional for collectors that create Table events, but mandatory for those that create Lookups.
In the Parameters section, establish the Collector Parameters as follows below:

Editing the JSON configuration

{
  "global_overrides": {
    "debug": False
  },
  "inputs": {
    "onepassword": {
      "id": "<short_unique_id>",
      "enabled": <input_status>,
      "requests_per_second": <requests_per_second_value>,
      "base_url": <url_value>,
      "credentials": {
        "token": "<token_value>"
      },
      "services": {
        "item_usage": {
          "request_period_in_seconds": <request_period_in_seconds_value>,
          "tag_override": <tag_override_value>,
          "start_time_override": <start_time_override_value>,
          "limit_override": <limit_override_value>
        },
        "sign_in_attempts": {
          "request_period_in_seconds": <request_period_in_seconds_value>,
          "tag_override": <tag_override_value>,
          "start_time_override": <start_time_override_value>,
          "limit_override": <limit_override_value>
        },
        "audit": {
          "request_period_in_seconds": <request_period_in_seconds_value>,
          "tag_override": <tag_override_value>,
          "start_time_override": <start_time_override_value>,
          "limit_override": <limit_override_value>
        }
      }
    }
  }
}

All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the services object.

Please replace the placeholders with real world values following the description table below:

Parameter	Data Type	Type	Value Range / Format	Details
`id`	`int`	`Mandatory`	Minimum length: 1 Maximum length: 5	Use this param to give an unique id to this input service. This parameter is used to build the persistence address, do not use the same value for multiple collectors. It could cause a collision.
`enabled`	`bool`	`Mandatory`	`false` / `true`	If the value is `true`, the input definition will be executed. If the value is `false`, the service will be ignored.
`requests_per_second`	`int`	`Optional`	Minimum value: 1	Customize the maximum number of API requests per second. If not used, the default setting will be used: `60` requests/sec. This parameter should be removed if it is not used.
`base_url`	`str`	`Mandatory`	The URL must be one of the servers detailed here.	Use this param to define the URL used by the collector to pull data. Replace with your 1password Server URL
`token`	`str`	`Mandatory`	Minimum length: 1	Access token created in the 1Password console.
`request_period_in_seconds_value`	`int`	`Optional`	Minimum length: 1	Period in seconds used between each data pulling, this value will overwrite the default value (60 seconds) This parameter should be removed if it is not used.
`start_time_override`	`str`	`Optional`	UTC with format: `YYYY-mm-ddTHH:MM:SS`	This configuration allows you to set a custom date as the beginning of the period to download. This allows downloading historical data before downloading new events. If this setting is not set, the default value is one hour before the current time. This parameter should be removed if it is not used.
`tag_override`	`str`	`Optional`	See Devo Docs on tagging format and conventions. https://docs.devo.com/space/latest/95126204/About+Devo+tags	This configuration allows you to set a custom tag. This parameter should be removed if it is not used.
`limit_override`	`int`	`Optional`	Minimum length: 1 Maximum length: 1000	How many events should be returned in a single request. If this setting is not set, the default value is 100 events/request. This parameter should be removed if it is not used.

Change log for v1.0.0

Release	Released on	Release type	Details	Recommendations
`v1.0.1`	07 Nov 2023	V1	`Release Version`	`Recommended version`
`v1.0.0`	06 Nov 2023	V1	`Release Version`	`Recommended version`

Change log for v0.x.x

Release	Released on	Release type	Details	Recommendations
`v0.1.2`	`10/03/23`	PRE-RELEASE	Pre-release version of collector	`Not ready for general release`
`v0.1.1`	`02/10/23`	PRE-RELEASE	Pre-release version of collector	`Not ready for general release`
`v0.1.0`	`02/09/23`	PRE-RELEASE	Pre-release version of collector	`Not ready for general release`