{ "_event_score": 2, "attributes": { "device": 0, "file_access_mode": 16832, "file_system_id": 16777220, "node_id": 1254228, "owner_group_id": 20, "owner_group_name": "staff", "owner_user_id": 502, "owner_user_name": "dan" }, "header": { "event_id": 8, "event_modifier": 0, "event_name": "AUE_CHDIR", "time_milliseconds_offset": 885, "time_seconds_epoch": 1570154813, "version": 11 }, "host_info": { "host_name": "Dan_macbook_pro", "host_uuid": "3F6E4B3A-9285-4E7E-9A0C-C3B62DC379DF", "osversion": "Version 10.14.6 (Build 18G95)", "primary_mac_address": "38:f9:e8:15:5a:82", "serial_number": "C03XY889JHG3" }, "identity": { "cd_hash": "d6195eac3979557fc3938dbbdea4c811ff475ab4", "signer_id": "com.noodlesoft.hazelworker", "signer_id_truncated": 0, "signer_type": 0, "team_id": "86Z3GCJ4MF", "team_id_truncated": 0 }, "path": [ "/Users/dan/Desktop", "/Users/dan/Desktop" ], "return": { "description": "success", "error": 0, "return_value": 0 }, "subject": { "audit_id": 502, "audit_user_name": "dan", "effective_group_id": 20, "effective_group_name": "staff", "effective_user_id": 502, "effective_user_name": "dan", "group_id": 20, "group_name": "staff", "process_hash": "", "process_id": 33196, "process_name": "", "session_id": 100011, "terminal_id": { "addr": [ 0 ], "ip_address": "0.0.0.0", "port": 50331650, "type": 0 }, "user_id": 502, "user_name": "dan" } }