1Password

Important

Lakewatch is in Private Preview. To request access, reach out to your Azure Databricks account team.

Lakewatch provides an API connector to ingest data from 1Password. The connector supports three event types: audit events, item usages, and sign-in attempts. This page covers prerequisites, configuration instructions, connector schemas, and Lakewatch parser observables.

Prerequisites

The connector requires:

  1. Serverless Lakeflow Spark Declarative Pipelines turned on in your workspace.
  2. Unity Catalog, with privileges to create or use a Unity Catalog connection. See Connection permissions.
  3. A 1Password account with permission to create an Events Reporting integration and issue a bearer token. See 1Password Events Reporting.
  4. Access to the Events API for your account region. See the 1Password Events API.

Known limitations

Configure 1Password for ingestion

1Password authenticates Events API requests with a bearer token that the connector sends in the Authorization header. The connector does not refresh the token. Issue a long-lived token, and rotate it in the Unity Catalog connection if you revoke it.

  1. Sign in to your 1Password account as an owner or administrator.
  2. In the sidebar, click Integrations.
  3. Open the Directory tab. In Events Reporting, click Other.
  4. Enter a System Name, then click Add Integration.
  5. Enter a Token Name. Set an expiration that matches your security policy. Under Events to Report, turn on all event types so the connector can ingest audit_events, item_usages, and sign_in_attempts.
  6. Click Issue Token.
  7. Copy the access token. 1Password does not show the full token again. You enter this value as the Bearer token when you create a connection in Databricks.

Tip

When creating a connection through the Lakewatch UI, you need the Access Token and Base URL gathered above. The base URL can be identified using the Events API documentation.

Next steps

After completing the configuration above, create a datasource with the 1Password connector in the Lakewatch UI. See API connectors for instructions.

Connector and Lakewatch schemas

The connector ingests the following source tables from the default source schema:

Source table 1Password data Built-in Lakewatch parser
audit_events Account actions, including changes to users, vaults, and items onepassword_audit_event
item_usages Item access events from shared vaults onepassword_item_usage
sign_in_attempts Authentication attempts onepassword_sign_in_attempt

The connector writes the source tables to the datasource's raw destination. Each built-in parser writes a separate parsed table named after the parser, unless you set a parsed destination when you configure the datasource.

Lakewatch-managed columns

The connector adds the following columns to each raw source row:

  • lw_id: A non-null string that Lakewatch uses as the primary key. The connector derives a stable, time-sortable ID from the 1Password timestamp and uuid fields. The ID supports deduplication across incremental syncs.
  • time: A non-null timestamp parsed from the 1Password timestamp field as an RFC 3339 timestamp. The connector uses time as the cursor field for incremental ingestion.

Each parsed table carries lw_id forward. The parser also assigns the parsed time column and adds:

  • lw_meta: Standard Lakewatch processing metadata.
  • lw_observables: Values extracted from fields marked as security observables in the parser.

For more information, see Parser reference.

Raw connector table schemas

The following schemas include the 1Password Events API fields and the Lakewatch-managed connector columns.

audit_events

Schema
Column Data type
lw_id STRING
time TIMESTAMP
uuid STRING
timestamp STRING
actor_uuid STRING
actor_details STRUCT<uuid: STRING, name: STRING, email: STRING>
actor_type STRING
actor_account_uuid STRING
account_uuid STRING
action STRING
object_type STRING
object_uuid STRING
object_details STRUCT<uuid: STRING, name: STRING, email: STRING>
aux_id INT
aux_uuid STRING
aux_details STRUCT<uuid: STRING, name: STRING, email: STRING>
aux_info STRING
session STRUCT<uuid: STRING, login_time: STRING, device_uuid: STRING, ip: STRING>
location STRUCT<country: STRING, region: STRING, city: STRING, longitude: DOUBLE, latitude: DOUBLE>

item_usages

Schema
Column Data type
lw_id STRING
time TIMESTAMP
uuid STRING
timestamp STRING
used_version INT
vault_uuid STRING
item_uuid STRING
action STRING
user STRUCT<uuid: STRING, name: STRING, email: STRING, user_type: STRING, user_account_uuid: STRING>
client STRUCT<app_name: STRING, app_version: STRING, platform_name: STRING, platform_version: STRING, os_name: STRING, os_version: STRING, ip_address: STRING>
location STRUCT<country: STRING, region: STRING, city: STRING, longitude: DOUBLE, latitude: DOUBLE>
account_uuid STRING

sign_in_attempts

Schema
Column Data type
lw_id STRING
time TIMESTAMP
uuid STRING
session_uuid STRING
timestamp STRING
category STRING
type STRING
country STRING
details STRUCT<value: STRING>
target_user STRUCT<uuid: STRING, name: STRING, email: STRING, user_type: STRING, user_account_uuid: STRING>
client STRUCT<app_name: STRING, app_version: STRING, platform_name: STRING, platform_version: STRING, os_name: STRING, os_version: STRING, ip_address: STRING>
location STRUCT<country: STRING, region: STRING, city: STRING, longitude: DOUBLE, latitude: DOUBLE>
account_uuid STRING

Parser observables

The built-in parsers write nested objects as VARIANT and extract the following fields into lw_observables.

onepassword_audit_event

Observables
Field Observable
actor_uuid actor_id
actor_details.uuid actor_id
actor_details.name username
actor_details.email email
actor_account_uuid actor_id
account_uuid actor_id
object_details.uuid actor_id
object_details.name username
object_details.email email
aux_details.uuid actor_id
aux_details.name username
aux_details.email email
session.ip ip

onepassword_item_usage

Observables
Field Observable
user.uuid actor_id
user.email email
client.ip_address ip
account_uuid actor_id

onepassword_sign_in_attempt

Observables
Field Observable
target_user.uuid actor_id
target_user.email email
client.ip_address ip
account_uuid actor_id
  • Last updated on