Skip to content

Commit

Permalink
address feedback
Browse files Browse the repository at this point in the history
  • Loading branch information
@ogero
ogero committed Aug 18, 2021
1 parent d42da0e commit 762b399
Showing 1 changed file with 36 additions and 33 deletions.
69 changes: 36 additions & 33 deletions README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,39 +42,42 @@ Elastic Common Schema

### Sign-in Attempts fields

| Field | Description |
|-------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------|
| @timestamp | The date and time of the sign-in attempt |
| event.action | The category of the sign-in attempt |
| user.id | The UUID of the user that attempted to sign in to the account |
| user.full_name | The name of the user, hydrated at the time the event was generated |
| user.email | The email address of the user, hydrated at the time the event was generated |
| os.name | The name of the operating system of the user that attempted to sign in to the account |
| host.ip | The IP address that attempted to sign in to the account |
| onepassword.uuid | The UUID of the event |
| onepassword.session_uuid | The UUID of the session that created the event |
| onepassword.type | Details about the sign-in attempt |
| onepassword.country | The country code of the event. Uses the ISO 3166 standard |
| onepassword.client.app_name | The name of the 1Password app that attempted to sign in to the account |
| onepassword.client.app_version | The version number of the 1Password app |
| onepassword.client.platform_name | The name of the platform running the 1Password app |
| onepassword.client.platform_version | The version of the browser or computer where the 1Password app is installed, or the CPU of the machine where the 1Password command-line tool is installed |
| Field | Description |
|---------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------|
| `@timestamp` | The date and time of the sign-in attempt |
| `event.action` | The category of the sign-in attempt |
| `user.id` | The UUID of the user that attempted to sign in to the account |
| `user.full_name` | The name of the user, hydrated at the time the event was generated |
| `user.email` | The email address of the user, hydrated at the time the event was generated |
| `os.name` | The name of the operating system of the user that attempted to sign in to the account |
| `os.version` | The version of the operating system of the user that attempted to sign in to the account |
| `host.ip` | The IP address that attempted to sign in to the account |
| `onepassword.uuid` | The UUID of the event |
| `onepassword.session_uuid` | The UUID of the session that created the event |
| `onepassword.type` | Details about the sign-in attempt |
| `onepassword.country` | The country code of the event. Uses the ISO 3166 standard |
| `onepassword.details` | Additional information about the sign-in attempt, such as any firewall rules that prevent a user from signing in |
| `onepassword.client.app_name` | The name of the 1Password app that attempted to sign in to the account |
| `onepassword.client.app_version` | The version number of the 1Password app |
| `onepassword.client.platform_name` | The name of the platform running the 1Password app |
| `onepassword.client.platform_version` | The version of the browser or computer where the 1Password app is installed, or the CPU of the machine where the 1Password command-line tool is installed |

### Item Usages fields

| Field | Description |
|-------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------|
| @timestamp | The date and time of the sign-in attempt |
| user.id | The UUID of the user that accessed the item |
| user.full_name | The name of the user, hydrated at the time the event was generated |
| user.email | The email address of the user, hydrated at the time the event was generated |
| os.name | The name of the operating system the item was accessed from |
| host.ip | The IP address the item was accessed from |
| onepassword.uuid | The UUID of the event |
| onepassword.used_version | The version of the item that was accessed |
| onepassword.vault_uuid | The UUID of the vault the item is in |
| onepassword.item_uuid | The UUID of the item that was accessed |
| onepassword.client.app_name | The name of the 1Password app the item was accessed from |
| onepassword.client.app_version | The version number of the 1Password app |
| onepassword.client.platform_name | The name of the platform the item was accessed from |
| onepassword.client.platform_version | The version of the browser or computer where the 1Password app is installed, or the CPU of the machine where the 1Password command-line tool is installed |
| Field | Description |
|---------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------|
| `@timestamp` | The date and time of the sign-in attempt |
| `user.id` | The UUID of the user that accessed the item |
| `user.full_name` | The name of the user, hydrated at the time the event was generated |
| `user.email` | The email address of the user, hydrated at the time the event was generated |
| `os.name` | The name of the operating system the item was accessed from |
| `os.version` | The version of the operating system the item was accessed from |
| `host.ip` | The IP address the item was accessed from |
| `onepassword.uuid` | The UUID of the event |
| `onepassword.used_version` | The version of the item that was accessed |
| `onepassword.vault_uuid` | The UUID of the vault the item is in |
| `onepassword.item_uuid` | The UUID of the item that was accessed |
| `onepassword.client.app_name` | The name of the 1Password app the item was accessed from |
| `onepassword.client.app_version` | The version number of the 1Password app |
| `onepassword.client.platform_name` | The name of the platform the item was accessed from |
| `onepassword.client.platform_version` | The version of the browser or computer where the 1Password app is installed, or the CPU of the machine where the 1Password command-line tool is installed |

0 comments on commit 762b399

Please sign in to comment.