one2sentinel

A Go program that exports 1Password usage, signin and audit events to Microsoft Sentinel SIEM.

Running

First create a yaml file, such as config.yml:

log:
level: INFOmicrosoft:
app_id: ""secret_key: ""tenant_id: ""subscription_id: ""resource_group: ""workspace_name: ""dcr:
endpoint: ""rule_id: ""stream_name: ""expires_months: 6update_table: falseonepassword:
api_token: ""

And now run the program from source code:

% make
go run ./cmd/... -config=dev.yml
INFO[0000] shipping logs module=sentinel_logs table_name=OnePasswordLogs total=82
INFO[0002] shipped logs module=sentinel_logs table_name=OnePasswordLogs
INFO[0002] successfully sent logs to sentinel total=82

Or binary:

% one2sen -config=config.yml

Building

% make build