Configuration requirements
To run this collector, there are some configurations detailed below that you need to consider.
Configuration | Details |
---|---|
Cylance APP | You need to run a Cylance app. |
Application ID | Once you create the App, it gives you an Application ID. |
Application Secret | Once you create the App, it gives you an Application Secret. |
Tenant ID | You can find it in your Cylance console. |
Refer to the Vendor setup section to know more about these configurations.
Overview
The 1Password collector pulls data from the 1Password Events API and forwards to Devo.
Devo collector features
Feature | Details |
---|---|
Allow parallel downloading ( |
|
Running environments |
|
Populated Devo events |
|
Data sources
Data source | Description | API endpoint | Collector service name | Devo table | Available from release |
---|---|---|---|---|---|
Item Usage | Returns information about items in shared vaults that have been modified, accessed, or used. Events include the name and IP address of the user who accessed the item, when it was accessed, and the vault where the item is stored. |
|
|
|
|
Sign-in Attempts | Returns information about sign-in attempts. Events include the name and IP address of the user who attempted to sign in to the account, when the attempt was made, and -- for failed attempts -- the cause of the failure. |
|
|
|
|
Audit | Returns information about actions performed by team members within a 1Password account. Events include when an action was performed and by whom, along with details about the type and object of the action and any other information about the activity. More info here on audit events. |
|
|
|
|
For more information on how the events are parsed, visit our page.
Flattening preprocessing
Data source | Collector service | Optional | Flattening details |
---|---|---|---|
Source | Service |
| Flattening steps |
Vendor setup
Generate a Bearer Token
To issue a bearer token:
Sign in to your account on http://1Password.com and click Integrations in the sidebar.
Choose the Events Reporting integration where you want to issue a token and click “Add a token”.
Enter a name for the bearer token and choose when it will expire. Select or deselect the event types the token has access to, then click Issue Token.
Click Save in 1Password and choose which vault to save your token to. Then click View Integration Details.
Additional Information: Get started with 1Password Events Reporting | issue or revoke bearer tokens
Identify Your 1Password Server
The URL of the server that hosts your 1Password account is required in order to make requests to the 1Password Events API.
If your account is on: | Your Events API URL is: |
| |
| |
|
Additional Information: Get started with 1Password Events Reporting | Servers
Minimum configuration required for basic pulling
Although this collector supports advanced configuration, the fields required to retrieve data with basic configuration are defined below.
This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check setting sections for details.
Setting | Details |
---|---|
| The URL of the server that hosts your 1Password account |
| Access token created in the 1Password console. |
Run the collector
Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector).
We use a piece of software called Collector Server to host and manage all our available collectors.
To enable the collector for a customer:
In the Collector Server GUI, access the domain in which you want this instance to be created
Click Add Collector and find the one you wish to add.
In the Version field, select the latest value.
In the Collector Name field, set the value you prefer (this name must be unique inside the same Collector Server domain).
In the sending method select Direct Send. Direct Send configuration is optional for collectors that create
Table
events, but mandatory for those that createLookups
.In the Parameters section, establish the Collector Parameters as follows below:
Editing the JSON configuration
{ "global_overrides": { "debug": False }, "inputs": { "onepassword": { "id": "<short_unique_id>", "enabled": <input_status>, "requests_per_second": <requests_per_second_value>, "base_url": <url_value>, "credentials": { "token": "<token_value>" }, "services": { "item_usage": { "request_period_in_seconds": <request_period_in_seconds_value>, "tag_override": <tag_override_value>, "start_time_override": <start_time_override_value>, "limit_override": <limit_override_value> }, "sign_in_attempts": { "request_period_in_seconds": <request_period_in_seconds_value>, "tag_override": <tag_override_value>, "start_time_override": <start_time_override_value>, "limit_override": <limit_override_value> }, "audit": { "request_period_in_seconds": <request_period_in_seconds_value>, "tag_override": <tag_override_value>, "start_time_override": <start_time_override_value>, "limit_override": <limit_override_value> } } } } }
All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the services
object.
Please replace the placeholders with real world values following the description table below:
Parameter | Data Type | Type | Value Range / Format | Details |
|
|
| Minimum length: 1 | Use this param to give an unique id to this input service. This parameter is used to build the persistence address, do not use the same value for multiple collectors. It could cause a collision. |
|
|
|
| If the value is |
|
|
| Minimum value: 1 | Customize the maximum number of API requests per second. If not used, the default setting will be used: This parameter should be removed if it is not used. |
|
|
| The URL must be one of the servers detailed here. | Use this param to define the URL used by the collector to pull data. Replace with your 1password Server URL |
|
|
| Minimum length: 1 | Access token created in the 1Password console. |
|
|
| Minimum length: 1 | Period in seconds used between each data pulling, this value will overwrite the default value (60 seconds) This parameter should be removed if it is not used. |
|
|
| UTC with format: | This configuration allows you to set a custom date as the beginning of the period to download. This allows downloading historical data before downloading new events. If this setting is not set, the default value is one hour before the current time. This parameter should be removed if it is not used. |
|
|
| See Devo Docs on tagging format and conventions. | This configuration allows you to set a custom tag. This parameter should be removed if it is not used. |
|
|
| Minimum length: 1 | How many events should be returned in a single request. If this setting is not set, the default value is 100 events/request. This parameter should be removed if it is not used. |
Change log for v1.0.0
Release | Released on | Release type | Details | Recommendations |
---|---|---|---|---|
| V1 |
|
| |
|
| V1 |
|
|
Change log for v0.x.x
Release | Released on | Release type | Details | Recommendations |
---|---|---|---|---|
|
| PRE-RELEASE | Pre-release version of collector |
|
|
| PRE-RELEASE | Pre-release version of collector |
|
|
| PRE-RELEASE | Pre-release version of collector |
|