Skip to content

[1password] Add new event.action to 1Password item usages #2367

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ogero wants to merge 4 commits into from
Closed

[1password] Add new event.action to 1Password item usages #2367

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9e8b477
Add new event.action to 1Password item usages
ogero Dec 21, 2021
bf4c00c
Add changelog entry
ogero Dec 22, 2021
a1f55b9
Remove unneeded descriptions from external ecs fields
ogero Dec 29, 2021
812ee29
Merge branch 'main' into 1password_itemusage_action
anthonythleung Feb 16, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions packages/1password/_dev/build/docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,16 +22,16 @@ Uses the 1Password Events API to retrieve information about sign-in attempts. Ev

*Exported fields*

{{fields "item_usages"}}
{{fields "signin_attempts"}}

{{event "item_usages"}}
{{event "signin_attempts"}}

### Item Usages

Uses the 1Password Events API to retrieve information about items in shared vaults that have been modified, accessed, or used. Events include the name and IP address of the user who accessed the item, when it was accessed, and the vault where the item is stored.

*Exported fields*

{{fields "signin_attempts"}}
{{fields "item_usages"}}

{{event "signin_attempts"}}
{{event "item_usages"}}
5 changes: 5 additions & 0 deletions packages/1password/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.2.0"
changes:
- description: Add new "event.action" to item usage events
type: enhancement
link: https://github.com/elastic/integrations/pull/2367
- version: "1.1.0"
changes:
- description: Update to ECS 8.0
Expand Down
2 changes: 1 addition & 1 deletion packages/1password/data_stream/item_usages/_dev/test/pipeline/test-itemusages.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
},
{
"@timestamp": "2021-08-30T22:57:42.484Z",
"message": "{\"uuid\":\"5HBWJDWCQADISKY2DVBNP3HJPV\",\"timestamp\":\"2021-08-30T19:10:00.123Z\",\"used_version\":1,\"vault_uuid\":\"jaqxqf5qylslqiitnduawrndc5\",\"item_uuid\":\"bvwmmwxisuca7wbehrbyqhag54\",\"user\":{\"uuid\":\"OJQGU46KAPROEJLCK674RHSAY5\",\"name\":\"Name\",\"email\":\"email@1password.com\"},\"client\":{\"app_name\":\"1Password Browser Extension\",\"app_version\":\"1109\",\"platform_name\":\"Chrome\",\"platform_version\":\"93.0.4577.62\",\"os_name\":\"Android\",\"os_version\":\"10\",\"ip_address\":\"89.160.20.156\"}}"
"message": "{\"uuid\":\"5HBWJDWCQADISKY2DVBNP3HJPV\",\"timestamp\":\"2021-08-30T19:10:00.123Z\",\"used_version\":1,\"action\":\"reveal\",\"vault_uuid\":\"jaqxqf5qylslqiitnduawrndc5\",\"item_uuid\":\"bvwmmwxisuca7wbehrbyqhag54\",\"user\":{\"uuid\":\"OJQGU46KAPROEJLCK674RHSAY5\",\"name\":\"Name\",\"email\":\"email@1password.com\"},\"client\":{\"app_name\":\"1Password Browser Extension\",\"app_version\":\"1109\",\"platform_name\":\"Chrome\",\"platform_version\":\"93.0.4577.62\",\"os_name\":\"Android\",\"os_version\":\"10\",\"ip_address\":\"89.160.20.156\"}}"
}
]
}
163 changes: 82 additions & 81 deletions ...s/1password/data_stream/item_usages/_dev/test/pipeline/test-itemusages.json-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,150 +1,151 @@
{
"expected": [
{
"@timestamp": "2021-08-30T18:57:42.484Z",
"ecs": {
"version": "8.0.0"
},
"event": {
"category": [
"file"
],
"created": "2021-08-30T22:57:42.484Z",
"ingested": "2022-02-16T21:38:40.438009400Z",
"kind": "event",
"original": "{\"uuid\":\"MCQODBBWJD5HISKYNP3HJPV2DV\",\"timestamp\":\"2021-08-30T18:57:42.484Z\",\"used_version\":1,\"vault_uuid\":\"jaqxqf5qylslqiitnduawrndc5\",\"item_uuid\":\"bvwmmwxisuca7wbehrbyqhag54\",\"user\":{\"uuid\":\"OJQGU46KAPROEJLCK674RHSAY5\",\"name\":\"Name\",\"email\":\"email@1password.com\"},\"client\":{\"app_name\":\"1Password Browser Extension\",\"app_version\":\"1109\",\"platform_name\":\"Chrome\",\"platform_version\":\"93.0.4577.62\",\"os_name\":\"Android\",\"os_version\":\"10\",\"ip_address\":\"89.160.20.156\"}}",
"type": [
"access"
]
},
"onepassword": {
"used_version": 1,
"client": {
"platform_name": "Chrome",
"app_name": "1Password Browser Extension",
"app_version": "1109",
"platform_name": "Chrome",
"platform_version": "93.0.4577.62"
},
"uuid": "MCQODBBWJD5HISKYNP3HJPV2DV",
"item_uuid": "bvwmmwxisuca7wbehrbyqhag54",
"used_version": 1,
"uuid": "MCQODBBWJD5HISKYNP3HJPV2DV",
"vault_uuid": "jaqxqf5qylslqiitnduawrndc5"
},
"@timestamp": "2021-08-30T18:57:42.484Z",
"ecs": {
"version": "8.0.0"
"os": {
"name": "Android",
"version": "10"
},
"related": {
"ip": [
"89.160.20.156"
],
"user": [
"OJQGU46KAPROEJLCK674RHSAY5",
"email@1password.com",
"Name"
],
"ip": [
"89.160.20.156"
]
},
"os": {
"name": "Android",
"version": "10"
},
"source": {
"geo": {
"continent_name": "Europe",
"region_iso_code": "SE-E",
"city_name": "Linköping",
"country_iso_code": "SE",
"country_name": "Sweden",
"region_name": "Östergötland County",
"location": {
"lon": 15.6167,
"lat": 58.4167
}
},
"as": {
"number": 29518,
"organization": {
"name": "Bredband2 AB"
}
},
"geo": {
"city_name": "Linköping",
"continent_name": "Europe",
"country_iso_code": "SE",
"country_name": "Sweden",
"location": {
"lat": 58.4167,
"lon": 15.6167
},
"region_iso_code": "SE-E",
"region_name": "Östergötland County"
},
"ip": "89.160.20.156"
},
"tags": [
"preserve_original_event"
],
"user": {
"email": "email@1password.com",
"full_name": "Name",
"id": "OJQGU46KAPROEJLCK674RHSAY5"
}
},
{
"@timestamp": "2021-08-30T19:10:00.123Z",
"ecs": {
"version": "8.0.0"
},
"event": {
"ingested": "2021-12-23T23:23:00.336841554Z",
"original": "{\"uuid\":\"MCQODBBWJD5HISKYNP3HJPV2DV\",\"timestamp\":\"2021-08-30T18:57:42.484Z\",\"used_version\":1,\"vault_uuid\":\"jaqxqf5qylslqiitnduawrndc5\",\"item_uuid\":\"bvwmmwxisuca7wbehrbyqhag54\",\"user\":{\"uuid\":\"OJQGU46KAPROEJLCK674RHSAY5\",\"name\":\"Name\",\"email\":\"email@1password.com\"},\"client\":{\"app_name\":\"1Password Browser Extension\",\"app_version\":\"1109\",\"platform_name\":\"Chrome\",\"platform_version\":\"93.0.4577.62\",\"os_name\":\"Android\",\"os_version\":\"10\",\"ip_address\":\"89.160.20.156\"}}",
"action": "reveal",
"category": [
"file"
],
"created": "2021-08-30T22:57:42.484Z",
"ingested": "2022-02-16T21:38:40.438020200Z",
"kind": "event",
"original": "{\"uuid\":\"5HBWJDWCQADISKY2DVBNP3HJPV\",\"timestamp\":\"2021-08-30T19:10:00.123Z\",\"used_version\":1,\"action\":\"reveal\",\"vault_uuid\":\"jaqxqf5qylslqiitnduawrndc5\",\"item_uuid\":\"bvwmmwxisuca7wbehrbyqhag54\",\"user\":{\"uuid\":\"OJQGU46KAPROEJLCK674RHSAY5\",\"name\":\"Name\",\"email\":\"email@1password.com\"},\"client\":{\"app_name\":\"1Password Browser Extension\",\"app_version\":\"1109\",\"platform_name\":\"Chrome\",\"platform_version\":\"93.0.4577.62\",\"os_name\":\"Android\",\"os_version\":\"10\",\"ip_address\":\"89.160.20.156\"}}",
"type": [
"access"
],
"created": "2021-08-30T22:57:42.484Z",
"kind": "event"
},
"user": {
"email": "email@1password.com",
"full_name": "Name",
"id": "OJQGU46KAPROEJLCK674RHSAY5"
]
},
"tags": [
"preserve_original_event"
]
},
{
"onepassword": {
"used_version": 1,
"client": {
"platform_name": "Chrome",
"app_name": "1Password Browser Extension",
"app_version": "1109",
"platform_name": "Chrome",
"platform_version": "93.0.4577.62"
},
"uuid": "5HBWJDWCQADISKY2DVBNP3HJPV",
"item_uuid": "bvwmmwxisuca7wbehrbyqhag54",
"used_version": 1,
"uuid": "5HBWJDWCQADISKY2DVBNP3HJPV",
"vault_uuid": "jaqxqf5qylslqiitnduawrndc5"
},
"@timestamp": "2021-08-30T19:10:00.123Z",
"ecs": {
"version": "8.0.0"
"os": {
"name": "Android",
"version": "10"
},
"related": {
"ip": [
"89.160.20.156"
],
"user": [
"OJQGU46KAPROEJLCK674RHSAY5",
"email@1password.com",
"Name"
],
"ip": [
"89.160.20.156"
]
},
"os": {
"name": "Android",
"version": "10"
},
"source": {
"geo": {
"continent_name": "Europe",
"region_iso_code": "SE-E",
"city_name": "Linköping",
"country_iso_code": "SE",
"country_name": "Sweden",
"region_name": "Östergötland County",
"location": {
"lon": 15.6167,
"lat": 58.4167
}
},
"as": {
"number": 29518,
"organization": {
"name": "Bredband2 AB"
}
},
"geo": {
"city_name": "Linköping",
"continent_name": "Europe",
"country_iso_code": "SE",
"country_name": "Sweden",
"location": {
"lat": 58.4167,
"lon": 15.6167
},
"region_iso_code": "SE-E",
"region_name": "Östergötland County"
},
"ip": "89.160.20.156"
},
"event": {
"ingested": "2021-12-23T23:23:00.337283501Z",
"original": "{\"uuid\":\"5HBWJDWCQADISKY2DVBNP3HJPV\",\"timestamp\":\"2021-08-30T19:10:00.123Z\",\"used_version\":1,\"vault_uuid\":\"jaqxqf5qylslqiitnduawrndc5\",\"item_uuid\":\"bvwmmwxisuca7wbehrbyqhag54\",\"user\":{\"uuid\":\"OJQGU46KAPROEJLCK674RHSAY5\",\"name\":\"Name\",\"email\":\"email@1password.com\"},\"client\":{\"app_name\":\"1Password Browser Extension\",\"app_version\":\"1109\",\"platform_name\":\"Chrome\",\"platform_version\":\"93.0.4577.62\",\"os_name\":\"Android\",\"os_version\":\"10\",\"ip_address\":\"89.160.20.156\"}}",
"category": [
"file"
],
"type": [
"access"
],
"created": "2021-08-30T22:57:42.484Z",
"kind": "event"
},
"tags": [
"preserve_original_event"
],
"user": {
"email": "email@1password.com",
"full_name": "Name",
"id": "OJQGU46KAPROEJLCK674RHSAY5"
},
"tags": [
"preserve_original_event"
]
}
}
]
}
4 changes: 4 additions & 0 deletions packages/1password/data_stream/item_usages/elasticsearch/ingest_pipeline/default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,10 @@ processors:
- append:
field: event.type
value: [access]
- rename:
field: onepassword.action
target_field: event.action
ignore_missing: true

#########################
## ECS Related Mapping ##
Expand Down
2 changes: 2 additions & 0 deletions packages/1password/data_stream/item_usages/fields/ecs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@
name: event.category
- external: ecs
name: event.type
- external: ecs
name: event.action
- external: ecs
name: user.id
- external: ecs
Expand Down
14 changes: 7 additions & 7 deletions packages/1password/data_stream/item_usages/sample_event.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
{
"@timestamp": "2021-08-30T18:57:42.484Z",
"agent": {
"ephemeral_id": "d02e8bec-48d2-46c8-bd33-5982bd82059f",
"id": "82d0dfd8-3946-4ac0-a092-a9146a71e3f7",
"ephemeral_id": "b3687a99-8907-497b-ba06-204e9664db73",
"id": "8a0c0293-badb-46e8-bcaf-4d82e41e65d0",
"name": "docker-fleet-agent",
"type": "filebeat",
"version": "8.0.0-beta1"
"version": "8.0.0"
},
"data_stream": {
"dataset": "1password.item_usages",
Expand All @@ -16,18 +16,18 @@
"version": "8.0.0"
},
"elastic_agent": {
"id": "82d0dfd8-3946-4ac0-a092-a9146a71e3f7",
"id": "8a0c0293-badb-46e8-bcaf-4d82e41e65d0",
"snapshot": false,
"version": "8.0.0-beta1"
"version": "8.0.0"
},
"event": {
"agent_id_status": "verified",
"category": [
"file"
],
"created": "2021-12-24T00:23:21.039Z",
"created": "2022-02-16T21:39:23.372Z",
"dataset": "1password.item_usages",
"ingested": "2021-12-24T00:23:22Z",
"ingested": "2022-02-16T21:39:24Z",
"kind": "event",
"type": [
"access"
Expand Down
Loading