1password-signin-attempts
Get sign-in attempts from 1Password
1password-signin-attempts [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss]
- profile=PROFILE
- 1Password connect profile code
- duration=NUM{mon|w|d|h|m|s}
- Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10smeans data from 10 seconds earlier. - from=yyyyMMddHHmmss
- Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=yyyyMMddHHmmss
- End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | String | Connect profile | Profile name of 1Password |
| _time | Date | Time | |
| src_ip | IP address | Source IP | Client IP address |
| target_user_uuid | String | User UUID | |
| target_user_name | String | User name | |
| target_user_email | String | User email | |
| src_country | String | Source country | e.g. KR |
| category | String | Category | e.g. success, credentials_failed, mfa_failed, sso_failed, modern_version_failed, firewall_failed, firewall_reported_success |
| type | String | Type | e.g. credentials_ok, mfa_ok, password_secret_bad, mfa_missing |
| details | String | Details | |
| app_name | Date | Client app name | e.g. 1Password for Windows |
| app_ver | String | Client app version | e.g. 81006027 |
| platform_name | String | Client platform name | Hostname |
| platform_ver | String | Client platform version | e.g. Unknown |
| os_name | String | Client OS name | e.g. Windows |
| os_ver | String | Client OS version | e.g. 10.0.2009 |
| src_region | String | Source region | e.g. Seoul |
| src_city | String | Source city | e.g. Mapo-gu |
| src_latitude | Double | Source latitude | e.g. 37.5433 |
| src_longitude | Double | Source longitude | e.g. 126.9073 |
| log_uuid | String | Log UUID | |
| session_uuid | String | Session UUID |