category: Analytics & SIEM
provider: 1Password Inc.
sectionorder:
  - Connect
  - Collect
commonfields:
  id: OnePassword
  version: -1
configuration:
- defaultvalue: https://events.1password.com
  display: Server URL
  additionalinfo: The API server URL depends on the domain where the account is hosted. Refer to the integration Help section for more details.
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: API Token
  additionalinfo: The bearer token used to authenticate with the 1Password Events API. This must include the required features (scopes) that correspond to the event types to be fetched.
  name: credentials
  required: true
  hiddenusername: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  additionalinfo: Allow connections without verifying the SSL certificate of the server.
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- defaultvalue: Audit events,Item usage actions,Sign in attempts
  display: Types of events to fetch
  name: event_types
  type: 16
  options:
  - Audit events
  - Item usage actions
  - Sign in attempts
  required: true
  section: Collect
- defaultvalue: 5000
  additionalinfo: If not specified, API default (100) will be used.
  display: Maximum number of audit events per fetch
  name: audit_events_limit
  type: 0
  required: false
  section: Collect
  advanced: true
- defaultvalue: 5000
  additionalinfo: If not specified, API default (100) will be used.
  display: Maximum number of item usage actions per fetch
  name: item_usage_actions_limit
  type: 0
  required: false
  section: Collect
  advanced: true
- defaultvalue: 5000
  additionalinfo: If not specified, API default (100) will be used.
  display: Maximum number of sign-in attempts per fetch
  name: sign_in_attempts_limit
  required: false
  type: 0
  section: Collect
  advanced: true
description: 'Fetch events about actions performed by 1Password users within a specific account, access and modifications to items in shared vaults, and user sign-in attempts.'
display: 1Password
name: OnePassword
script:
  commands:
  - arguments:
    - description: 'The maximum number of events to fetch for the given event type.'
      name: limit
      required: false
      defaultValue: 1000
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Set this argument to True in order to push events to Cortex XSIAM, otherwise the command will only display them.
      name: should_push_events
      predefined:
      - 'True'
      - 'False'
      required: true
    - auto: PREDEFINED
      description: 1Password event type.
      name: event_type
      predefined:
      - Audit events
      - Item usage actions
      - Sign in attempts
      required: true
    - default: false
      description: The date from which to get events. If not specified, events from the last minute will be fetched.
      name: from_date
      required: false
    description: Fetch events from 1Password. This command is intended for development and debugging purposes and should be used with caution as it may create duplicate events.
    name: one-password-get-events
  isfetchevents: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- marketplacev2
- platform
fromversion: 8.4.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam