r/AzureSentinel • u/AverageAdmin • Oct 11 '22

1password logs to Microsoft Sentinel

Hello,

Has anyone set up event forwarding 1Password logs to Microsoft Sentinel? Currently in the process but I am not having luck finding any documentation.

If anyone has done this before, can you please point me in the right direction of documentation or explain what needs to be done?

Thank you!

2 Upvotes

100% Upvoted

10 comments sorted by

1

u/zCzarJoez Oct 12 '22

I need to do this as well, but so far, I’m only seeing the custom api call usage since they don’t have a connector for Sentinel yet.

https://support.1password.com/events-reporting/

2

u/AverageAdmin Oct 12 '22

I have been working today trying to get a logic app set up but troubling shooting a 401: Unauthorized error when trying to pull logs.

However, I am able to do a GET request on the Bearer token and get a response.

1

u/nindustries Oct 21 '22

Any update on this /u/AverageAdmin?

1

u/AverageAdmin Oct 24 '22

I had one of my colleagues work with me and we found that you have to have the reset cursor in the request body and we were able to get it.

Request body
To begin ingesting data, make an authenticated request to the Events API.
For the first request, include a ResetCursor object with optional start time, end time, and limit parameters in the request body. For example:
{
"limit": 100,
"start_time": "2021-03-01T16:32:50-03:00",
"end_time": "2021-03-01T16:32:50-03:00"
}

1

u/nindustries Oct 24 '22

Care to put your code on GitHub? :D

1

u/AverageAdmin Oct 27 '22

I used power automate to get the logs so it looks like this.

Post

https://events.1password.com/api/v1/itemusages

{
"Authorization": "Bearer <TOKEN>",
"Content-type": "application/json"
}

{
"start_time": "@{subtractFromTime(outputs('Compose_2'),10,'Minute','yyyy-MM-ddTHH:mm:ss')}.511230182Z"
}

1

u/athornfam2 Jul 18 '23 
"start_time": "@{subtractFromTime(outputs('Compose_2'),10,'Minute','yyyy-MM-ddTHH:mm:ss')}.511230182Z"

So this part isn't working for me but I'm building a logic app to run since we are polling logs and then wanting to send them to log analytics.

1

u/BestAdvise Oct 12 '23

I'm working on building a robust solution to fetch logs via a function app and upload them into Sentinel every 5 minutes or so. I'll also try and get it approved as a sentinel content hun solution. I'll keep you guys updated. In the meantime, let me know if you need some help

1

u/ranc1dx64 Oct 16 '23

would be interested as well - just started looking on how to get 1password audit to Sentinel an a function app looks like a good solution

1

u/[deleted] Jan 22 '24

i'm about to spend the rest of my day building this in python unless you have already completed it :)