{
"_event_score": 10,
"arguments": {
"target_port": 259,
"task_port": 7835
},
"header": {
"event_id": 43048,
"event_modifier": 0,
"event_name": "AUE_TASKFORPID",
"time_milliseconds_offset": 630,
"time_seconds_epoch": 1570154839,
"version": 11
},
"host_info": {
"host_name": "Dan_macbook_pro",
"host_uuid": "3F6E4B3A-9285-4E7E-9A0C-C3B62DC379DF",
"osversion": "Version 10.14.6 (Build 18G95)",
"primary_mac_address": "38:f9:e8:15:5a:82",
"serial_number": "C03XY889JHG3"
},
"process": {
"audit_id": 502,
"audit_user_name": "dan",
"effective_group_id": 20,
"effective_group_name": "staff",
"effective_user_id": 502,
"effective_user_name": "dan",
"group_id": 20,
"group_name": "staff",
"process_hash": "F38B8461CEC4C0C3930350729C15ACEFFA7F1B10",
"process_id": 97034,
"process_name": "/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/WorkflowServiceRunner.xpc/Contents/MacOS/WorkflowServiceRunner",
"session_id": 100011,
"terminal_id": {
"addr": [
0,
298845290,
1,
1701734754
],
"ip_address": "0.0.0.0",
"port": 50331650,
"type": 4
},
"user_id": 502,
"user_name": "dan"
},
"return": {
"description": "success",
"error": 0,
"return_value": 0
},
"subject": {
"audit_id": 4294967295,
"audit_user_name": "-1",
"effective_group_id": 0,
"effective_group_name": "wheel",
"effective_user_id": 0,
"effective_user_name": "root",
"group_id": 0,
"group_name": "wheel",
"process_hash": "564428A216F0E30BB51F31336EE53C61260B7E1D",
"process_id": 774,
"process_name": "/usr/libexec/sysmond",
"session_id": 100000,
"terminal_id": {
"addr": [
0
],
"ip_address": "0.0.0.0",
"port": 0,
"type": 0
},
"user_id": 0,
"user_name": "root"
}
}
cmdReporter Wiki