New 1Password SIEM integration with Datadog

Starting now, your team can view 1Password security reporting in Datadog to easily monitor potential risks and investigate security issues while spending less time jumping between dashboards.

Integrating with Datadog is simple and secure, and will give you and your team everything you need to monitor the security health of your business. Datadog customers can connect their 1Password Business account in minutes and use pre-built rules from Datadog to start monitoring for security events right away.

1Password’s Events API

The 1Password Events API lets you stream 1Password events to your SIEM (security information and event management) tool. These 1Password events can then be incorporated into things like custom dashboards, alerts, visualizations, and search to give you a deeper understanding of how your team uses 1Password.

1Password’s enhanced Events API supports all events captured by the 1Password Activity Log, including:

• Account changes
• Billing changes
• Changes to email addresses
• Device addition or removal
• Families account changes
• File uploads
• Group access changes
• Group vault access changes
• Integration events
• Shared items
• Team member and guest invitations
• User access changes
• Vault changes
• Vault item changes
• Views of administrative reports

This means you can do things like monitor user adoption and usage, as well as set up alerts to be notified when a secret is shared, when a specific vault with sensitive data is accessed, or when a user is granted admin/owner privileges – all by streaming 1Password events to third-party SIEM tools like Datadog.

Datadog and 1Password

Datadog is a SIEM tool that collects, aggregates, searches, and monitors company data and notifies you of any potential risks or attacks. This makes it easier to stay secure, avoid downtime, and give your customers the best user experience.

Using the 1Password Events API, Datadog can now stream 1Password data into its own application for customers to use for dashboarding and analysis. If you’re a 1Password Business customer, you can combine 1Password events with information from Datadog to:

• Create custom reports, dashboards, alerts, and visualizations.
• Track 1Password adoption across the organization.
• Isolate certain security events in the service of an investigation.
• Better support auditing and compliance workflows.
• More easily monitor and report on security posture.

Yash Kumar, Senior Director of Product at Datadog, puts it best:

“By monitoring and analyzing activity generated from 1Password, Datadog Cloud SIEM detects threats and suspicious activities where highly sensitive information may be compromised – signaling attacks such as credential theft or brute-forcing. When threats do occur, we equip teams with the runtime context and security analytics needed on a single platform, enabling them to prioritize threats more easily, rule out false positives faster, investigate the full scope of activity through log visualizations, collaborate efficiently across teams and timezones in workspaces, and accelerate response with workflow automation to quickly contain attacks and reduce their impact on the business."

Getting started

This integration is available now to anyone with a 1Password Business account and a Datadog account.

Not using 1Password Business yet? Try it free for 14 days!

If you’re already a customer of both 1Password and Datadog, then you can get started and connect them from the integrations directory in your 1Password Business account. Once you’ve integrated your SIEM partner with 1Password, you can start enabling features.

Clarence Wong

Senior Product Manager, Ecosystem