1Password
Sign-in attempts and item usage from 1Password Business Events.
Category
Identity
Setup
About 5 minutes
Events Wardell reads
Sign-in attempts, item usage, vault changes
Create an Events Reporting token in 1Password Business and paste it into Wardell. Sign-in attempts and item usage stream every minute.
Wardell pairs a vault export or unusual item access with the same person's Okta or Google activity, so a stolen laptop reads as one case.
What Wardell watches
Failed sign-in bursts
Bulk item access and vault export alerts
Correlation with identity provider events
Weekly report of shared vault changes
Try it on your own logs
Connect this source with a read-only key. Within 48 hours a Wardell analyst sends a written report of what it would have caught.
