1Password

Preview

Lakewatch is in Private Preview. To request access, reach out to your Databricks account team.

Lakewatch provides an API connector to ingest data from 1Password. The connector supports three event types: audit events, item usages, and sign-in attempts. This page covers prerequisites, configuration instructions, connector schemas, and Lakewatch parser observables.

Prerequisites

The connector requires:

1. Serverless Lakeflow Spark Declarative Pipelines turned on in your workspace.
2. Unity Catalog, with privileges to create or use a Unity Catalog connection. See Connection permissions.
3. A 1Password account with permission to create an Events Reporting integration and issue a bearer token. See 1Password Events Reporting.
4. Access to the Events API for your account region. See the 1Password Events API.

Known limitations

• Historical lookback can't exceed 180 days. See Choose how far back to ingest.

Configure 1Password for ingestion

1Password authenticates Events API requests with a bearer token that the connector sends in the Authorization header. The connector does not refresh the token. Issue a long-lived token, and rotate it in the Unity Catalog connection if you revoke it.

1. Sign in to your 1Password account as an owner or administrator.
2. In the sidebar, click Integrations.
3. Open the Directory tab. In Events Reporting, click Other.
4. Enter a System Name, then click Add Integration.
5. Enter a Token Name. Set an expiration that matches your security policy. Under Events to Report, turn on all event types so the connector can ingest audit_events, item_usages, and sign_in_attempts.
6. Click Issue Token.
7. Copy the access token. 1Password does not show the full token again. You enter this value as the Bearer token when you create a connection in Databricks.

tip

When creating a connection through the Lakewatch UI, you need the Access Token and Base URL gathered above. The base URL can be identified using the Events API documentation.

Next steps

After completing the configuration above, create a datasource with the 1Password connector in the Lakewatch UI. See API connectors for instructions.

---

Connector and Lakewatch schemas

The connector ingests the following source tables from the default source schema:

Source table	1Password data	Built-in Lakewatch parser
audit_events	Account actions, including changes to users, vaults, and items	onepassword_audit_event
item_usages	Item access events from shared vaults	onepassword_item_usage
sign_in_attempts	Authentication attempts	onepassword_sign_in_attempt

Source table	1Password data	Built-in Lakewatch parser
audit_events	Account actions, including changes to users, vaults, and items	onepassword_audit_event
item_usages	Item access events from shared vaults	onepassword_item_usage
sign_in_attempts	Authentication attempts	onepassword_sign_in_attempt

The connector writes the source tables to the datasource's raw destination. Each built-in parser writes a separate parsed table named after the parser, unless you set a parsed destination when you configure the datasource.

Lakewatch-managed columns

The connector adds the following columns to each raw source row:

• lw_id: A non-null string that Lakewatch uses as the primary key. The connector derives a stable, time-sortable ID from the 1Password timestamp and uuid fields. The ID supports deduplication across incremental syncs.
• time: A non-null timestamp parsed from the 1Password timestamp field as an RFC 3339 timestamp. The connector uses time as the cursor field for incremental ingestion.

Each parsed table carries lw_id forward. The parser also assigns the parsed time column and adds:

• lw_meta: Standard Lakewatch processing metadata.
• lw_observables: Values extracted from fields marked as security observables in the parser.

For more information, see Parser reference.

Raw connector table schemas

The following schemas include the 1Password Events API fields and the Lakewatch-managed connector columns.

audit_events

Schema

Column	Data type
lw_id	STRING
time	TIMESTAMP
uuid	STRING
timestamp	STRING
actor_uuid	STRING
actor_details	STRUCT<uuid: STRING, name: STRING, email: STRING>
actor_type	STRING
actor_account_uuid	STRING
account_uuid	STRING
action	STRING
object_type	STRING
object_uuid	STRING
object_details	STRUCT<uuid: STRING, name: STRING, email: STRING>
aux_id	INT
aux_uuid	STRING
aux_details	STRUCT<uuid: STRING, name: STRING, email: STRING>
aux_info	STRING
session	STRUCT<uuid: STRING, login_time: STRING, device_uuid: STRING, ip: STRING>
location	STRUCT<country: STRING, region: STRING, city: STRING, longitude: DOUBLE, latitude: DOUBLE>

Column	Data type
lw_id	STRING
time	TIMESTAMP
uuid	STRING
timestamp	STRING
actor_uuid	STRING
actor_details	STRUCT<uuid: STRING, name: STRING, email: STRING>
actor_type	STRING
actor_account_uuid	STRING
account_uuid	STRING
action	STRING
object_type	STRING
object_uuid	STRING
object_details	STRUCT<uuid: STRING, name: STRING, email: STRING>
aux_id	INT
aux_uuid	STRING
aux_details	STRUCT<uuid: STRING, name: STRING, email: STRING>
aux_info	STRING
session	STRUCT<uuid: STRING, login_time: STRING, device_uuid: STRING, ip: STRING>
location	STRUCT<country: STRING, region: STRING, city: STRING, longitude: DOUBLE, latitude: DOUBLE>

item_usages

Schema

Column	Data type
lw_id	STRING
time	TIMESTAMP
uuid	STRING
timestamp	STRING
used_version	INT
vault_uuid	STRING
item_uuid	STRING
action	STRING
user	STRUCT<uuid: STRING, name: STRING, email: STRING, user_type: STRING, user_account_uuid: STRING>
client	STRUCT<app_name: STRING, app_version: STRING, platform_name: STRING, platform_version: STRING, os_name: STRING, os_version: STRING, ip_address: STRING>
location	STRUCT<country: STRING, region: STRING, city: STRING, longitude: DOUBLE, latitude: DOUBLE>
account_uuid	STRING

Column	Data type
lw_id	STRING
time	TIMESTAMP
uuid	STRING
timestamp	STRING
used_version	INT
vault_uuid	STRING
item_uuid	STRING
action	STRING
user	STRUCT<uuid: STRING, name: STRING, email: STRING, user_type: STRING, user_account_uuid: STRING>
client	STRUCT<app_name: STRING, app_version: STRING, platform_name: STRING, platform_version: STRING, os_name: STRING, os_version: STRING, ip_address: STRING>
location	STRUCT<country: STRING, region: STRING, city: STRING, longitude: DOUBLE, latitude: DOUBLE>
account_uuid	STRING

sign_in_attempts

Schema

Column	Data type
lw_id	STRING
time	TIMESTAMP
uuid	STRING
session_uuid	STRING
timestamp	STRING
category	STRING
type	STRING
country	STRING
details	STRUCT<value: STRING>
target_user	STRUCT<uuid: STRING, name: STRING, email: STRING, user_type: STRING, user_account_uuid: STRING>
client	STRUCT<app_name: STRING, app_version: STRING, platform_name: STRING, platform_version: STRING, os_name: STRING, os_version: STRING, ip_address: STRING>
location	STRUCT<country: STRING, region: STRING, city: STRING, longitude: DOUBLE, latitude: DOUBLE>
account_uuid	STRING

Column	Data type
lw_id	STRING
time	TIMESTAMP
uuid	STRING
session_uuid	STRING
timestamp	STRING
category	STRING
type	STRING
country	STRING
details	STRUCT<value: STRING>
target_user	STRUCT<uuid: STRING, name: STRING, email: STRING, user_type: STRING, user_account_uuid: STRING>
client	STRUCT<app_name: STRING, app_version: STRING, platform_name: STRING, platform_version: STRING, os_name: STRING, os_version: STRING, ip_address: STRING>
location	STRUCT<country: STRING, region: STRING, city: STRING, longitude: DOUBLE, latitude: DOUBLE>
account_uuid	STRING

Parser observables

The built-in parsers write nested objects as VARIANT and extract the following fields into lw_observables.

onepassword_audit_event

Observables

Field	Observable
actor_uuid	actor_id
actor_details.uuid	actor_id
actor_details.name	username
actor_details.email	email
actor_account_uuid	actor_id
account_uuid	actor_id
object_details.uuid	actor_id
object_details.name	username
object_details.email	email
aux_details.uuid	actor_id
aux_details.name	username
aux_details.email	email
session.ip	ip

Field	Observable
actor_uuid	actor_id
actor_details.uuid	actor_id
actor_details.name	username
actor_details.email	email
actor_account_uuid	actor_id
account_uuid	actor_id
object_details.uuid	actor_id
object_details.name	username
object_details.email	email
aux_details.uuid	actor_id
aux_details.name	username
aux_details.email	email
session.ip	ip

onepassword_item_usage

Observables

Field	Observable
user.uuid	actor_id
user.email	email
client.ip_address	ip
account_uuid	actor_id

Field	Observable
user.uuid	actor_id
user.email	email
client.ip_address	ip
account_uuid	actor_id

onepassword_sign_in_attempt

Observables

Field	Observable
target_user.uuid	actor_id
target_user.email	email
client.ip_address	ip
account_uuid	actor_id

Field	Observable
target_user.uuid	actor_id
target_user.email	email
client.ip_address	ip
account_uuid	actor_id