Detect 1Password vault exports with TheHive and Slack alerts
Ready for 3.0Ready for 3.0. This template uses no nodes that n8n 3.0 removes. No removed nodes, versions or helpers found. Static check, last run 2026-10-19.
What this workflow does
This workflow has 7 nodes and runs on a schedule (every 15 minutes). Along the way it connects TheHive 5 and Slack. It also calls events.1password.com over HTTP.
How it runs
Trigger: On a schedule (every 15 minutes).
- Fetch 1Password Audit Events (HTTP Request): calls events.1password.com (POST)
- Split Out: splits a list into separate items
- Keep Only Vault Exports (Filter): keeps only the items that match a condition
- Extract Export Details (Edit Fields (Set)): sets 7 fields: user, user_email, vault_name…
- Create TheHive Alert (TheHive 5): uses TheHive 5
- Post Slack Summary (Slack): uses Slack
Services it uses
HTTP calls to: events.1password.com
Before you upgrade to n8n 3.0
Nothing in this workflow is removed in n8n 3.0, so it should import and run after the upgrade.
Nodes used (7)
- Schedule Trigger
n8n-nodes-base.scheduleTrigger - HTTP Request
n8n-nodes-base.httpRequest - Split Out
n8n-nodes-base.splitOut - Filter
n8n-nodes-base.filter - Edit Fields (Set)
n8n-nodes-base.set - TheHive 5
n8n-nodes-base.theHiveProject - Slack
n8n-nodes-base.slack
From the author
Quick Overview This workflow polls the 1Password Events API every 15 minutes for recent audit events, detects vault export activity, creates an alert in TheHive, and posts a notification to a Slack channel with the export details and a link to the alert. How…