API

Unusual 1Password item usage action observed from user

문서 > Datadog 보안 > OOTB Rules > Unusual 1Password item usage action observed from user

Classification:

attack

Set up the 1password integration.

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when 1Password item usage activity is observed.

Strategy

This rule monitors 1Password audit logs for the following item usage actions

Note: This rule uses the New Value detection method, to determine when a previously unseen item usage action is observed.

Triage & response

Investigate {{@usr.email}} attempting an item usage action: {{@evt.name}} that they haven’t performed recently with item {{@item_uuid}} within vault {{@vault_uuid}}.