1Password plugin

Visualize your 1Password report data. This includes sign-in attempts and item usage.

The 1Password plugin comes with 2 data sources, 6 data streams, and an out of the box dashboard.

The 1Password plugin features the ability to do the following and more:

• Sign in events by category (table, donut, line graph)

• Sign in events by type (table, donut, line graph)

• Top N Failed Sign-ins

• Top N Most used logins

• Most used Items

• Track user adoption or retention

• Monitor spikes in failed logins and visualize the source country.

How to add the 1Password plugin

To issue a 1Password events API key:

1. Sign in to your account on 1Password.com and click Integrations in the sidebar.

2. Set a name for the integration, such as SquaredUp Cloud.

3. Enter a name for the 1Password events API key and choose when it will expire. Select the event types the token has access to, this should be both, then click Issue Token.

4. Optionally, you can click Save in 1Password and choose which vault to save your token to. Then click View Integration Details.

Now use your bearer token to configure the plugin in SquaredUp Cloud:

1. In SquaredUp browse to Settings > Plugins > Add plugin and search for the plugin.

2. Display Name:

   Enter a name for your plugin. This helps you to identify this plugin in the list of your plugins.

3. 1Password Events API Key:

   Enter your 1Password events API key for either Business or Enterprise.

4. Select 1Password server domain:

   Select where your 1Password server is located. Available options are: .com, .ca, and .eu.

5. Business or Enterprise account:

   Select whether you are configuring the plugin for a Business or Enterprise account.

6. Leave the checkbox for Automatically create a workspace ticked, this will create a new workspace for this plugin containing out of the box dashboards and scopes.

7. Optionally, select whether you would like to restrict access to this plugin instance. By default, restricted access is set to off.

   Restrict access to this plugin?

   The term plugin here really means plugin instance. For example, a user may configure two instances of the AWS plugin, one for their development environment and one for production. In that case, each plugin instance has its own access control settings.

   By default, Restrict access to this plugin? is set to off. The plugin can be viewed, edited and administered by anyone. If you would like to control who has access to this plugin, switch Restrict access to this plugin? to on.

   Use the Restrict access to this plugin? dropdown to control who has access to the workspace:

   • By default, the user setting the permissions for the plugin will be given Full Control and the Everyone group will be given Link to workspace permissions.

   • Tailor access to the plugin, as required, by selecting individual users or user groups from the dropdown and giving them Link to workspace or Full Control permissions.

   • If the user is not available from the dropdown, you are able to invite them to the plugin by typing in their email address and then clicking Add. The new user will then receive an email inviting them to create an account on SquaredUp Cloud. Once the account has been created, they will gain access to the tenant.

   • At least one user or group must be given Full Control.

   • Admin users can edit the configuration, modify the Access Control List (ACL) and delete the plugin, regardless of the ACL chosen.

   Plugin access levels

   Access Level:

   Link to workspace	User can link the plugin to any workspace they have at least Editor permissions for. Data from the plugin can then be viewed by anyone with any access to the workspace. User can share the plugin data with anyone they want. User cannot configure the plugin in any way, or delete it.
   Full Control	User can change the plugin configuration, ACL, and delete the plugin.

   See Access control for more information.

8. Click Save.

Using the 1Password plugin

Data Streams

What is a data stream?

A data stream brings you data to answer a specific question like "What's the health state of the objects?", "What kind of alerts are coming from this plugin for my servers?", "What's the average memory usage of this app?"

The magic of data streams is that they standardize data from all the different shapes and formats your tools use into a straightforward tabular format. While creating a tile you can tweak data streams by grouping or aggregating specific columns. Depending on the kind of data, SquaredUp will automatically suggest how to visualize the result, for example as a table or line graph.

There is one type of data stream available for this plugin:

• Configurable data streams, see Using Configurable data streams with the 1Password plugin

Using Configurable data streams with the 1Password plugin

What is a configurable data stream?

A configurable data stream allows you to easily create new data streams specific to your needs, by entering information into a form, such as metric names or queries. Configurable data streams have a + before the name, and once new data streams have been created they show in the normal list of data streams.

Any data streams you create can be edited from Settings > Data Streams.

There are five types of configurable data streams available for this plugin:

• + 1Password - All Failed Sign-ins - Get the failed sign-ins, see All Failed Sign-ins

• + 1Password - All Item Usages - Get all the items used, see All Item Usages

• + 1Password - All Sign-ins - Get all the sign-ins, see All Sign-ins

• + 1Password - Graph Item Usages - Graph the items used by a selected property, see Graph Item Usages

• + 1Password - Graph Sign-ins - Graph sign-ins for the selected timeframe, see Graph Sign-ins

All Failed Sign-ins

1. Scope to the 1Password plugin or a 1Password object.

2. Select + 1Password - All Failed Sign-ins from the data stream list.

3. Enter a Display Name for the new data stream.

4. Optional, list top n:

   Optionally, enter how many failed sign-in attempts to limit the list to, for example: 10.

5. Optional, property to top n:

   Optionally, select a property that you wish to filter top n results by. Available options are: category, country, type, user_name, client_app_name, client_ip, client_platform_name, client_os_name.

All Item Usages

1. Scope to the 1Password plugin or a 1Password object.

2. Select + 1Password - All Item Usages from the data stream list.

3. Enter a Display Name for the new data stream.

4. Optional, list top n:

   Optionally, enter how many used items to limit the list to, for example: 10.

5. Optional, property to top n:

   Optionally, select a property that you wish to filter top n results by. Available options are: action, user_name, user_UUID, user_email, client_app_name, client_os_name, client_os_version, client_platform_name, client_ip.

All Sign-ins

1. Scope to the 1Password plugin or a 1Password object.

2. Select + 1Password - All Sign-ins from the data stream list.

3. Enter a Display Name for the new data stream.

4. Optional, list top n:

   Optionally, enter how many sign-in attempts to limit the list to, for example: 10.

5. Optional property to top n:

   Optionally, select a property that you wish to filter top n results by. Available options are: category, country, type, user_name, client_app_name, client_ip, client_platform_name, client_os_name.

Graph Item Usages

1. Scope to the 1Password plugin or a 1Password object.

2. Select + 1Password - Graph Item Usuages from the data stream list.

3. Enter a Display Name for the new data stream.

4. Property to graph:

   Select a property that you want to graph to, for example: action, user_name, user_UUID, user_email, client_app_name, client_os_name, client_os_version, client_platform_name, client_ip.

Graph Sign-ins

1. Scope to the 1Password plugin or a 1Password object.

2. Select + 1Password - Graph Item Usuages from the data stream list.

3. Enter a Display Name for the new data stream.

4. Property to graph:

   Select a property that you want to graph to, for example: category, country, type, user_name, client_app_name, client_ip, client_platform_name, client_os_name.

Data streams – dataSourceConfig Overrides

timeframe

You can override the provided timeframe enum when graphing by adding a timeframe to the dataSourceConfig to group by:

"Last1hour" for mins

"Last24hours" for hours

"Last7days" for days

"months" for months

“timeframe” : “Last24hours"

filter

A filter can be added to bring back values that match the values of the property named in name:

"filter": [{
  "name" : "category",
  "value" : ["credentials_failed","mfa_failed","modern_version_failed","firewall_failed"]
}],

This could be used to ensure only a specific users, actions or countries show up in the visualization.