1password-signin-attempts
Get sign-in attempts from 1Password
1password-signin-attempts [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss]
- profile=PROFILE
- 1Password connect profile code
- duration=NUM{mon|w|d|h|m|s}
- Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10s
means data from 10 seconds earlier. - from=yyyyMMddHHmmss
- Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=yyyyMMddHHmmss
- End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
Output Fields
Field | Type | Name | Description |
---|---|---|---|
profile | String | Connect profile | Profile name of 1Password |
_time | Date | Time | |
src_ip | IP address | Source IP | Client IP address |
target_user_uuid | String | User UUID | |
target_user_name | String | User name | |
target_user_email | String | User email | |
src_country | String | Source country | e.g. KR |
category | String | Category | e.g. success, credentials_failed, mfa_failed, sso_failed, modern_version_failed, firewall_failed, firewall_reported_success |
type | String | Type | e.g. credentials_ok, mfa_ok, password_secret_bad, mfa_missing |
details | String | Details | |
app_name | Date | Client app name | e.g. 1Password for Windows |
app_ver | String | Client app version | e.g. 81006027 |
platform_name | String | Client platform name | Hostname |
platform_ver | String | Client platform version | e.g. Unknown |
os_name | String | Client OS name | e.g. Windows |
os_ver | String | Client OS version | e.g. 10.0.2009 |
src_region | String | Source region | e.g. Seoul |
src_city | String | Source city | e.g. Mapo-gu |
src_latitude | Double | Source latitude | e.g. 37.5433 |
src_longitude | Double | Source longitude | e.g. 126.9073 |
log_uuid | String | Log UUID | |
session_uuid | String | Session UUID |