1Password

Pull

Synopsis

Director reads 1Password's Events API with a bearer token. Each feed is a dataset assigned to the device, three of them — see 1Password Datasets:

the sign-in attempts: who signed in to 1Password, or tried to, from which client and where;
the audit events: what members and administrators changed in the account;
the item usages: who used which item in which vault, and how (viewed, revealed, copied, filled).

The device is built on the Codeless Connector Framework (CCF) poller, as the Cato Networks device is: the device holds the API's address and token, each dataset how it reads, and the platform writes the connectors and sends them to the Director with its configuration. Nobody writes connector JSON.

A ccf device configured with 1Password's connectors keeps working as it is. The two share no checkpoints, so moving from one to the other starts every feed afresh.

note

The 1Password device needs Director 2.3.1 or later. With no Director or cluster at that version selected, the wizard shows 1Password devices are unavailable on directors or clusters below version 2.3.1 and the device cannot be created.

Before It Collects

In 1Password, under Integrations > Directory > Other > Events Reporting, set up an integration and create a bearer token with access to the event types the device reads.

A token belongs to one 1Password account, so a device reads one account.

Schema

- id: <numeric>
  name: <string>
  description: <string>
  type: onepassword
  tags: <string[]>
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    api_url: <string>
    api_key: <string>
    ccf_config: <string>
    tls:
      insecure_skip_verify: <boolean>

Configuration

The following fields are used to define the device:

Device

Field	Required	Default	Description
`id`	Y	-	Unique numeric identifier
`name`	Y	-	Device name
`description`	N	-	Optional description
`type`	Y	-	Must be `onepassword`
`tags`	N	-	Optional tags
`pipelines`	N	-	Optional pre-processor pipelines
`status`	N	`true`	Enable/disable the device

Connection

Field	Required	Default	Description
`api_url`	Y	-	The Events API for the account's region: `https://events.1password.com` (1password.com), `https://events.ent.1password.com` (ent.1password.com), `https://events.1password.ca` (1password.ca), or `https://events.1password.eu` (1password.eu)
`api_key`	Y	-	The bearer token, sent as `Authorization: Bearer`. A secret: withheld when the device is read back, and `${ENV_VAR}` and `$secret{...}` references are resolved on the Director.
`tls.insecure_skip_verify`	N	`false`	`true` accepts the API's certificate without verifying it
`ccf_config`	N	-	Written by the platform. Set it by hand only on a Director run from a configuration file (see Examples).

Datasets

What the device reads is decided by the datasets and profiles assigned to it. For the dataset types, their properties, and how a feed is read, see 1Password Datasets.

A device with no dataset assigned polls nothing and says so in its connection state.

Rate Limits

1Password allows a token 600 requests a minute. Each connector sends at most one request a second, so the three datasets together stay under that limit.

Records

Each record is one of the response's items, as 1Password returns it, written to the custom log table with its dataset's definition id. A pipeline normalizes it.

Troubleshooting

What you see	Why
Connected, "No dataset is assigned"	Assign a dataset to the device.
HTTP `401`	The token is wrong, revoked, or for another region's `api_url`.
HTTP `403` on one dataset	The token has no access to that event type. Edit the integration in 1Password.
A dataset writes nothing	Nothing happened since its cursor; or, on its first poll, within its `query_window`.

Console

In the console, go to Fleet Management > Devices > 1Password and click Add new device. The wizard's steps are:

General settings, as on every device.
Connection settings: Events API URL and Bearer token; under TLS Settings, whether to skip certificate verification.
The datasets or profile the device reads. A device receives datasets or a profile, never both.
Review and create.

Examples

A Director with no platform reading the sign-in attempts every minute: the ccf_config is the connector the platform would send, with its dataset block, and {{api_url}} and {{api_key}} are filled in from the device...

devices:
  - id: 471203888
    name: onepassword
    type: onepassword
    status: true
    properties:
      api_url: "https://events.1password.com"
      api_key: "${ONEPASSWORD_EVENTS_TOKEN}"
      ccf_config: |
        [
          {
            "name": "OnePasswordSignInAttempts",
            "kind": "RestApiPoller",
            "dataset": { "definitionId": 29110, "interval": 60 },
            "properties": {
              "auth": { "type": "APIKey", "ApiKey": "{{api_key}}", "ApiKeyName": "Authorization", "ApiKeyIdentifier": "Bearer" },
              "request": {
                "apiEndpoint": "{{api_url}}/api/v1/signinattempts",
                "httpMethod": "POST",
                "isPostPayloadJson": true,
                "headers": { "Content-Type": "application/json" },
                "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ",
                "queryWindowInMin": 1440,
                "queryParametersTemplate": { "limit": 1000, "start_time": "{_QueryWindowStartTime}" },
                "rateLimitQPS": 1,
                "retryCount": 3,
                "timeoutInSeconds": 60
              },
              "response": { "format": "json", "eventsJsonPaths": ["$.items"], "requiredJsonPaths": ["$.cursor"] },
              "paging": {
                "pagingType": "PersistentToken",
                "nextPageParaName": "cursor",
                "pagingInfoPlacement": "RequestBody",
                "pagingQueryParamOnly": true,
                "nextPageTokenJsonPath": "$.cursor",
                "hasNextFlagJsonPath": "$.has_more"
              }
            }
          }
        ]

Synopsis​

Before It Collects​

Schema​

Configuration​

Device​

Connection​

Datasets​

Rate Limits​

Records​

Troubleshooting​

Console​

Examples​

Sign-in Attempts from a Configuration File​