1Password Input

The 1Password input provides direct integration for collecting activity and event logs from your 1Password account. This input supports collecting log records such as sign-in attempts, vault activity, item access, and administrative actions from the 1Password Events API.

Prerequisites

Before proceeding, ensure that the following prerequisites are met:

A 1Password subscription is required.
You need owner or administrator credentials to view the Integrations sidebar in your 1Password account to create integrations.

Supported Log Types

This input supports collecting the following log types:

Audit Events
Sign-In Attempts
Item Usages

Required Third-Party Setup

To enable integration, complete the following required setup with your third-party service:

Set up an Events Reporting integration.
Create an API token.

Required Configuration Values

In your third-party configuration, make note of the following values that are required when configuring the input in Graylog:

API Token
Consumer Secret

Input Type

This input is a pull input type. See Inputs to learn about input types.

Input Configuration

Follow the input setup instructions. During setup of this input, you can configure the following options:

Configuration Option Description

Input Name

Provide a unique name for your new input.

API Token

Provide the API token for authentication.

Account Type

Choose the account type based on your account offering. The base URL of your 1Password instance determines the correct account type.

Account Type	Your base URL
1Password Business	https://events.1password.com
1Password Enterprise	https://events.ent.1password.com
1Password CA	https://events.1password.ca
1Password EU	https://events.1password.eu

Content Types to Collect

By default, all the log types are selected. If required, you can remove unwanted log types from the selection. At least one log type must be selected.

Polling Interval

Determines how often (in minutes) Graylog will check for new data in 1Password APIs. The smallest allowable interval is 5 minutes.

Enable Throttling

If enabled, no new messages are read from this input until Graylog catches up with its message load.

Store Full Message

If enabled, the entire message is displayed in the Graylog dashboard.

Override Source

By default, the source value is set to 1password. Provide a custom source value if you want to override the default.

Next Steps

After you complete input setup, visit Input Diagnosis for testing and validation of the new input. Use this functionality to help troubleshoot any connection issues.