{ "_event_score": 0, "header": { "action": "Allow", "event_name": "DLP_PROTECTED_FILE_MOVEMENT", "time_seconds_epoch": 1594325938 }, "host_info": { "host_name": "dan_macbook_pro", "host_uuid": "212B56BD-53E8-57AE-A7B5-4C12BC9343AA", "osversion": "macOS 10.15.5 (Build 19F101)", "primary_mac_address": "3c:22:fb:d0:38:45", "serial_number": "C02CV6ADMD6N" }, "identity": { "cd_hash": "886ac0f4bc9ae1a44328d6037a2578a70dbdc5c2", "signer_id": "com.sublimetext.3", "signer_id_truncated": 0, "signer_type": 0, "team_id": "Z6D26JE4Y4", "team_id_truncated": 0 }, "path": ["/Volumes/GoogleDrive/company_notes.txt"], "subject": { "audit_id": 502, "audit_user_name": "dan", "effective_group_id": 20, "effective_group_name": "staff", "effective_user_id": 502, "effective_user_name": "dan", "group_id": 20, "group_name": "staff", "process_hash": "218ED85733141C1C29E06BA39894665E5B2120A9", "process_id": 9925, "process_information": { "program": "/Applications/Sublime Text.app/Contents/MacOS/Sublime Text", "submitted_by_name": "Alfred", "submitted_by_pid": 592 }, "process_name": "/Applications/Sublime Text.app/Contents/MacOS/Sublime Text", "responsible_process_id": 9925, "responsible_process_name": "/Applications/Sublime Text.app/Contents/MacOS/Sublime Text", "session_id": 100006, "terminal_id": { "ip_address": "0.0.0.0", "port": 0, "type": 0 }, "user_id": 502, "user_name": "dan" }, "texts": ["app may have written sensitive data to external volume"] }