DLP_PROTECTED_FILE_MOVEMENT

Daniel Griggs
Modified on: Mon, 13 Jul, 2020 at 9:38 AM
{
    "_event_score": 0,
    "header":
    {
        "action": "Allow",
        "event_name": "DLP_PROTECTED_FILE_MOVEMENT",
        "time_seconds_epoch": 1594325938
    },
    "host_info":
    {
        "host_name": "dan_macbook_pro",
        "host_uuid": "212B56BD-53E8-57AE-A7B5-4C12BC9343AA",
        "osversion": "macOS 10.15.5 (Build 19F101)",
        "primary_mac_address": "3c:22:fb:d0:38:45",
        "serial_number": "C02CV6ADMD6N"
    },
    "identity":
    {
        "cd_hash": "886ac0f4bc9ae1a44328d6037a2578a70dbdc5c2",
        "signer_id": "com.sublimetext.3",
        "signer_id_truncated": 0,
        "signer_type": 0,
        "team_id": "Z6D26JE4Y4",
        "team_id_truncated": 0
    },
    "path": ["/Volumes/GoogleDrive/company_notes.txt"],
    "subject":
    {
        "audit_id": 502,
        "audit_user_name": "dan",
        "effective_group_id": 20,
        "effective_group_name": "staff",
        "effective_user_id": 502,
        "effective_user_name": "dan",
        "group_id": 20,
        "group_name": "staff",
        "process_hash": "218ED85733141C1C29E06BA39894665E5B2120A9",
        "process_id": 9925,
        "process_information":
        {
            "program": "/Applications/Sublime Text.app/Contents/MacOS/Sublime Text",
            "submitted_by_name": "Alfred",
            "submitted_by_pid": 592
        },
        "process_name": "/Applications/Sublime Text.app/Contents/MacOS/Sublime Text",
        "responsible_process_id": 9925,
        "responsible_process_name": "/Applications/Sublime Text.app/Contents/MacOS/Sublime Text",
        "session_id": 100006,
        "terminal_id":
        {
            "ip_address": "0.0.0.0",
            "port": 0,
            "type": 0
        },
        "user_id": 502,
        "user_name": "dan"
    },
    "texts": ["app may have written sensitive data to external volume"]
}