Skip to main content

1Password

The 1Password Matano managed log source lets you ingest your 1Password logs for item usages & sign-in attempts directly into Matano.

Usage

Use the managed log source by specifying the managed.type property in your log_source as ONEPASSWORD.

name: onepassword

managed:
type: ONEPASSWORD
properties:
events_api_url: <MY_EVENTS_API_URL> # e.g. https://events.1password.com (see below)

Populate the events_api_url property according to the following table:

If your account is on:Your Events API URL is:
1Password.comhttps://events.1password.com (1Password Business) https://events.ent.1password.com (1Password Enterprise)
1Password.cahttps://events.1password.ca
1Password.euhttps://events.1password.eu

For the tables you would like to enable from this managed log source, under a tables/ subdirectory in your log source directory, create a file with the name <table_name>.yml>. For example:

my-matano-dir/
└── log_sources/
└── onepassword/
└── log_source.yml
└── tables/
└── item_usages.yml
└── signin_attempts.yml

For a complete reference on configuring log sources, including extending the table schema, see Log source configuration.

Tables

The 1Password managed log source supports the following tables:

  • item_usages
  • signin_attempts

Ingest

Pull (default)

Matano integrates with your 1Password account to automatically pull relevant logs on a regular basis (every 1 min).

To get started with the integration, specify the following properties in the log source configuration file:

managed:
type: ONEPASSWORD
properties:
events_api_url: <MY_EVENTS_API_URL> # e.g. https://events.ent.1password.com (see above)

After the first deployment, this log source will also generate a secret in AWS secret's manager to store secrets related to this integration.

Secret

To finish onboarding the log source, populate the api_token field in the secret generated by Matano in AWS Secrets Manager, with the value from an API token created in the Integrations page from your 1Password Admin console.

Schema

1Password log data is normalized to ECS fields. Custom fields are normalized into the onepassword field. You can view the complete mapping to see the full schema.