API

Attempt to modify a 1Password item by user

문서 > Datadog 보안 > OOTB Rules > Attempt to modify a 1Password item by user

Classification:

attack

Set up the 1password integration.

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when a 1Password user attempts to modify an item.

Strategy

This rule monitors 1Password audit logs to determine when the the enter-item-edit-mode item usage action occurs. This could indicate an attempt to modify an item.

Triage & response

Investigate the {{@usr.email}} attempting to modify item {{@item_uuid}} within vault {{@vault_uuid}}.
If this action was unintend by the user:
- Rotate the user’s 1Password master password
- Identify all the items that were modified and rotate the necessary authentication credentials