Skip to main content

1password

Visualize 1Password audit logs, vaults, and user activities in the JupiterOne graph. Track audit events, item usage, sign-in attempts, and secrets, and map users to their associated actions and vaults. Monitor changes and unusual behavior through custom queries and alerts.

1Password Integration Installation in JupiterOne

Overview​

This guide walks you through how to connect your 1Password Business or Enterprise account with JupiterOne to monitor and manage your security data.

The integration pulls data from 1Password using two components:

  1. Events API — retrieves security-related activity (sign-ins, item access, audit events) and sends it to JupiterOne.
  2. Connect Server — allows JupiterOne to read vault and item information from your 1Password account.

Prerequisites​

  • A 1Password Business account.
  • Owner or Administrator access in 1Password (required to generate tokens).
  • Access to JupiterOne with permission to configure integrations.

Set Up in 1Password​

You will generate two tokens: one for the Events API and one for the Connect Server.

Generate an Events API Token​

This token lets JupiterOne collect audit events, item usage events, and sign-in attempt events.

  1. Sign in to your account at 1password.com.
  2. Check the URL to identify your region. For example, if your account is at https://my.1password.com, your region is 1password.com.
  3. In the sidebar, select Integrations.
  4. On the Integrations page, select the Directory tab.
  5. In the Events Reporting section, choose your SIEM connector. If JupiterOne is not listed, select Other.
  6. Enter a name for the integration and select Add Integration.
  7. Configure the bearer token:
    • Token Name: enter a name (for example, "JupiterOne Events").
    • Expires After: optionally set an expiry.
    • Events to Report: enable all three event types — sign-in attempts, item usage events, and audit events.
  8. Select Issue Token. Copy the token and save it securely — you will need it in JupiterOne.

Based on your region, use the corresponding Events API Base URL:

RegionBase URL
1password.comhttps://events.1password.com
ent.1password.comhttps://events.ent.1password.com
1password.cahttps://events.1password.ca
1password.euhttps://events.1password.eu

Generate a Connect Server Token​

The Connect Server lets JupiterOne access vaults and items. You must deploy a 1Password Connect Server in your own infrastructure first.

What is a Connect Server?​

A lightweight 1Password service you run in your own infrastructure. It exposes a REST API that JupiterOne calls to read vault contents.

  1. Sign in to your account at 1password.com.
  2. Go to Developer in the left navigation.
  3. Open the Connect Servers tab and select New Connect Server.
  4. Enter a name for the server (for example, "JupiterOne").
  5. Select Add Vaults and choose the vaults this server should be able to read.
  6. Select Add Environment.
  7. Configure the access token:
    • Token Name: enter a name (for example, "JupiterOne Connect").
    • Expires After: optionally set an expiry.
    • Select the vaults this token should access.
  8. Select Issue Token. Copy the token and save it securely.
  9. Follow the 1Password Connect Server deployment guide to deploy the Connect Server in your infrastructure and obtain its Base URL.

Data Volume Configuration​

Control how much historical data is ingested from 1Password.

Ingestion Windows​

FieldDescriptionDefaultOptions
Reporting Event Historical daysNumber of days of past event data to ingest. Increasing this value ingests more events and increases data volume in JupiterOne.3030, 60, 90, 120

Configure Integration in JupiterOne​

  1. In JupiterOne, go to Integrations in the left navigation.

  2. Find and select the 1Password integration tile.

  3. Select Add Configuration and complete the fields:

    FieldDescription
    Reporting Event Access TokenThe Events API bearer token you generated above.
    Reporting Event Base UrlThe Events API base URL for your region (see table above).
    Connect Server Base UrlThe URL where your Connect Server is running. Optional — omit if you are not using the Connect Server.
    Connect Server Access TokenThe Connect Server bearer token you generated above. Optional — required only if you provide a Connect Server Base Url.

  4. Select Create Configuration to save.

JupiterOne will begin pulling data from 1Password on the polling interval you configure.

Next Steps​

Now that your integration instance is configured, it will run on the polling interval you set, populating data in JupiterOne. See the Instance management guide to learn more about working with integration instances.