1password-audit-events

Get audit events from 1Password

1password-audit-events [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss]

profile=PROFILE: 1Password connect profile code
duration=NUM{mon|w|d|h|m|s}: Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example, 10s means data from 10 seconds earlier.
from=yyyyMMddHHmmss: Start time of audit events
to=yyyyMMddHHmmss: End time of audit events

Output Fields

Field	Type	Name	Description
profile	String	Connect profile	Profile code of 1Password
_time	Date	Time	Event time
src_ip	IP address	Source IP	Source IP address
user_uuid	String	User UUID	User UUID
user_name	String	User Name	User name
user_email	String	User Email	User email
action	String	Action	Action type
object_type	String	Object Type	Object type
object_name	String	Object Name	Object name
aux_name	String	Aux Name	Auxiliary name
login_time	Date	Login Time	Login time
src_country_name	String	Source Country	Source country name
src_region	String	Source Region	Source region
src_city	String	Source City	Source city
src_latitude	Double	Source Latitude	Source latitude
src_longitude	Double	Source Longitude	Source longitude
session_uuid	String	Session UUID	Session UUID
device_uuid	String	Device UUID	Device UUID
log_uuid	String	Log UUID	Log UUID
object_uuid	String	Object UUID	Object UUID
object_details	Map	Object Details	Object details
aux_details	Map	Aux Details	Auxiliary details