1Password Rule Vault Accessed - Desktop app

Elastic Security
1

Hello,

I have created a rule that alerts on users accessing a sensitive vault within 1Password (web) but this does not appear to fire when accessing the same vault through the desktop app.

There are access logs for the desktop app but nothing relating to vaults or items viewed once signed in.

Is this info not collected when using the desktop app?

2

Hi @Alex.W

I'm not sure if the limitation here is on the 1Password side or Elastic's 1Password integration. Can you confirm if 1Password is logging the relevant data and can be viewed within their activity logs?