macOS Security Alerts and Logs Dictionary Reference

Jamf Protect Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US
Note:

The content in this section applies to the legacy threat prevention strategy in macOS Security. The legacy strategy will be deprecated in a future version of macOS Security. For information and instructions on configuring threat prevention strategies, see Threat Prevention for macOS Strategies.

General Event Fields

Each event comprises numerous event fields, and the field names in this overview are common for all event types.

#Field NameDescriptionData TypeExample Value
1input.eventTypeDefines event typeStringGPFSEvent
2input.host.ipsIP AddressString192.168.1.2
3input.host.serialSerial numberStringC02TL0WGGAAA
4input.host.hostnameHostnameStringJon’s MacBook Pro
5input.match{}.tags{}Information tags StringMITRE TTPs
6input.match{}.uuid UUID alertString237BF758-408B-402A-87C2-64BCCFF7D0A2
7input.match{}.event.timestamp Alert time Integer1635055240.016535
8input.match{}.facts{}.nameAlert name StringSpearphishOfficeWritesExecutableResearch
9input.match{}.facts{}.humanAlert descriptionStringOccurrences when Office creates an executable file.
10input.match{}.actions{}.name Event based actions StringLog
11input.match{}.customCustom analytic identifierBooleanfalse
12input.match{}.contextAdditional metadataString
[ 
{ "name": "ItemName", "value": "jamf", "valueType": "String" }, 
{ 
"name": "Label", 
"value": "com.jamfsoftware.task.checkForTasks", 
"valueType": "String" 
}, 
{ 
"name": "Args", 
"value": "/usr/local/jamf/bin/jamf manage -rebootIfNeeded -deleteLaunchdTask", 
"valueType": "String" 
}, 
{ 
"name": "Name", 
"value": "com.jamfsoftware.task.checkForTasks.plist", 
"valueType": "String" 
}, 
{ 
"name": "ItemBinary", 
"value": "/usr/local/jamf/bin/jamf", 
"valueType": "Binary" 
} 
]
13input.match{}.severityAlert severityInteger
  • 0 = Informational
  • 1 = Low
  • 2 = Medium
  • 3 = High
14input.related{}.users{}Event users arrayInteger, String
"binaries": [
      {
        "gid": 0,
        "uid": 0,
        "fsid": 16777225,
        "mode": 33261,
        "path": "/Library/PrivilegedHelperTools/com.microsoft.autoupdate.helper",
        "size": 293136,
        "inode": 19220446,
        "xattrs": [],
        "changed": 1698151132,
        "created": 1698151132,
        "sha1hex": "63182f5bda15fd2e262b512bf20104497b723b77",
        "accessed": 1698917972,
        "modified": 1698151132,
        "sha256hex": "f1ff86c81b106a4dc9445f01f2e62940fcca9117437941da99b0131dd98bb9e5",
        "isDownload": false,
        "objectType": "GPSystemObject",
        "isAppBundle": false,
        "isDirectory": false,
        "signingInfo": {
          "appid": "com.microsoft.autoupdate.helper",
          "cdhash": "l+/pmKVmSUighiu5PFt6q4t4pfs=",
          "status": 0,
          "teamid": "UBF8T346G9",
          "signerType": 2,
          "authorities": [
            "Developer ID Application: Microsoft Corporation (UBF8T346G9)",
            "Developer ID Certification Authority",
            "Apple Root CA"
          ],
          "entitlements": [],
          "statusMessage": "No error.",
          "informationStage": "extended"
        },
        "isScreenShot": false
      }
    ]
15input.related{}.groups{}Event groups arrayArray
 "groups": [
      {
        "gid": 0,
        "name": "wheel",
        "uuid": "Z2C23RW4DY0"
      },
      {
        "gid": 33,
        "name": "_appstore",
        "uuid": "Z2C23RW4DY21"
      }
    ]
16input.related{}.binaries{}Event binary information array1Integer, String
      {
        "gid": 0,
        "uid": 0,
        "fsid": 16777230,
        "mode": 35273,
        "path": "/usr/libexec/security_authtrampoline",
        "size": 134768,
        "inode": 1152921500312504800,
        "xattrs": [],
        "changed": 1694870910,
        "created": 1694870910,
        "sha1hex": "82e899cb1c8a42b74653b05ca526d5feae92b9f6",
        "accessed": 1694870910,
        "modified": 1694870910,
        "sha256hex": "7528368ce03bd25fb22520923f366e364ea40ae90b22dac79fba90f2152c3d32",
        "isDownload": false,
        "objectType": "GPSystemObject",
        "isAppBundle": false,
        "isDirectory": false,
        "signingInfo": {
          "appid": "com.apple.security_authtrampoline",
          "cdhash": "rbIoddPMz9MoMMZl1ATihY8wlMk=",
          "status": 0,
          "teamid": "",
          "signerType": 0,
          "authorities": [
            "Software Signing",
            "Apple Code Signing Certification Authority",
            "Apple Root CA"
          ],
          "entitlements": [],
          "statusMessage": "No error.",
          "informationStage": "extended"
        },
        "isScreenShot": false
      }
17input.related{}.binaries{}.uidFile owner user identifierInteger501
18input.related{}.binaries{}.gidFile owner group identifierInteger80
19input.related{}.binaries{}.pathBinary path1String/Applications/iMyFone iBypasser.app/Contents/MacOS/iMyFone iBypasser
20input.related{}.binaries{}.sha1hex SHA-1 hash file hex stringString39655008a0a72cabf6d488cd0dcfb37e9883e0b8
21input.related{}.binaries{}.sha256hex SHA-256 hash file hex stringStringd2d07ceb1e637c555786d68b65f7b8913c8d52c5e4348881632aea0fa91c1643
22input.related{}.binaries{}.xattrs{}File extended attributes arrayString["com.dropbox.attrs", "com.jamf.protect.quarantined"]
23input.related{}.binaries{}.isDownloadInternet downloaded file validationBooleantrue
24input.related{}.binaries{}.isAppBundleApp bundle directory file validation Booleantrue
25input.related{}.binaries{}.isDirectoryDirectory file validationBooleantrue
26input.related{}.binaries{}.isScreenShotScreenshot image file validationBooleantrue
27input.related{}.binaries{}.signingInfo{} Binary signing information array1String
"signingInfo": {
          "appid": "com.microsoft.autoupdate.helper",
          "cdhash": "l+/pmKVmSUighiu5PFt6q4t4pfs=",
          "status": 0,
          "teamid": "UBF8T346G9",
          "signerType": 2,
          "authorities": [
            "Developer ID Application: Microsoft Corporation (UBF8T346G9)",
            "Developer ID Certification Authority",
            "Apple Root CA"
          ],
          "entitlements": [],
          "statusMessage": "No error.",
          "informationStage": "extended"
        }
28input.related{}.binaries{}.signingInfo.appidBinary identifier1Stringcom.jamf.protect.security-extension
29input.related{}.binaries{}.signingInfo.cdhash Binary code directory hash1StringXeQsQOHD7J3vTAuYYZTMQP2mwm0=
30input.related{}.binaries{}.signingInfo.teamidBinary development team signer identifier1String483DWKW443
31input.related{}.binaries{}.signingInfo.signerTypeSignature type and binary implicit trust level1Integer2
32input.related{}.binaries{}.signingInfo.authoritiesSignature signing authorities arrayString
[
            "Developer ID Application: JAMF Software (483DWKW443)",
            "Developer ID Certification Authority",
            "Apple Root CA"
          ]
33input.related{}.binaries{}.signingInfo.entitlementsBinary granted entitlements array1 String
[
            "com.apple.private.responsibility.set-to-self",
            "com.apple.private.responsibility.set-to-other",
            "com.apple.private.security.storage.InstallerSandboxes",
            "com.apple.private.responsibility.set-hosted-properties"
          ]
34input.related{}.binaries{}.signingInfo.statusMessageSigning information retrieval translated status codeStringNo error.
35input.related{}.processes{}.uidEffective user executing process identifierInteger501
36input.related{}.processes{}.gidEffective group executing process identifierInteger20
37input.related{}.processes{}.ppidParent process identifierInteger1
38input.related{}.processes{}.pgidProcess group identifierInteger1
39input.related{}.processes{}.ruidReal user executing process identifierInteger501
40input.related{}.processes{}.rgidReal group executing process identifierInteger20
41input.related{}.processes{}.pidProcess identifier (process)Integer772
42input.related{}.processes{}.responsiblePIDResponsible process identifierInteger19678
43input.related{}.processes{}.originalParentPIDParent process identifierInteger55064
44input.related{}.processes{}.args{}Process passed optional arguments arrayString
[ 
"mv", 
"Slack.app", 
"/Users/ada.powers/Applications" 
]
45input.related{}.processes{}.nameProcess nameStringSnap Camera
46input.related{}.processes{}.pathProcess pathString/Applications/Snap Camera.app/Contents/MacOS/Snap Camera
47input.related{}.processes{}.exitCodeProcess exit codeInteger0
48input.related{}.process{}.signingInfo{}Process signing information array String
"signingInfo": {
          "appid": "com.microsoft.autoupdate.helper",
          "cdhash": "l+/pmKVmSUighiu5PFt6q4t4pfs=",
          "status": 0,
          "teamid": "UBF8T346G9",
          "signerType": 2,
          "authorities": [
            "Developer ID Application: Microsoft Corporation (UBF8T346G9)",
            "Developer ID Certification Authority",
            "Apple Root CA"
          ],
          "entitlements": [],
          "statusMessage": "No error.",
          "informationStage": "extended"
        }
49input.related{}.process{}.signingInfo.appidBundle Identifier (process)StringMF.iMyFone iBypasser
50input.related{}.process{}.signingInfo.cdhashProcess code directory hashStringXeQsQOHD7J3vTAuYYZTMQP2mwm0=
51input.related{}.process{}.signingInfo.teamid Process development team signing identifierString483DWKW443
52input.related{}.process{}.signingInfo.signerTypeSignature type and binary implicit trust level1Integer2
53input.related{}.process{}.signingInfo.authoritiesSignature signing authorities arrayString
[
            "Developer ID Application: JAMF Software (483DWKW443)",
            "Developer ID Certification Authority",
            "Apple Root CA"
          ]
54input.related{}.process{}.signingInfo.entitlementsProcess granted entitlements arrayStringcom.apple.rootless.restricted-block-devices
55input.related{}.binaries{}.signingInfo.statusMessageSigning information retrieval translated status codeStringNo error.
56input.related{}.process{}.startTimetampProcess starting timestampInteger1657114862
1Any event related binary and not a Jamf binary.

GPClickEvent

Synthetic Click Events
#Field NameDescriptionData TypeExample Value
1input.match{}.event{}.gidSynthetic click group identifierInteger20
2input.match{}.event{}.pidSynthetic click process identifier (PID)Integer96657
3input.match{}.event{}.uidSynthetic click user identifierInteger501
4input.match{}.event{}.clickTypeClick typeInteger
  • 0 = Other
  • 1 = Left Down
  • 2 = Left Up
  • 3 = Right Down
  • 4 = Right Up
5input.match{}.event{}.targetpidSynthetic click target process identifier (PID)Integer4456

GPDownloadEvent

Monitors files downloaded from the internet.

#Field Name DescriptionData TypeExample Value
1input.match{}.event.pathDownloaded file pathString/Library/LaunchDaemons/com.jamfsoftware.task.checkForTasks.plist
2input.related{}.files{}.gidFile group identifierInteger20
3input.related{}.files{}.uidFile owner user identifierInteger501
4input.related{}.files{}.fsidFile system ID (FSID)Integer16777234
5input.related{}.files{}.modeFiletype and modeInteger33188
6input.related{}.files{}.pathFile pathString/Library/LaunchDaemons/com.jamfsoftware.task.checkForTasks.plist
7input.related{}.files{}.sizeFile sizeInteger35249769
8input.related{}.files{}.inodeFile inode identifierInteger7174457
9input.related{}.files{}.xattrsFile extended attributes arrayString["com.apple.macl", "com.apple.metadata:kMDItemDownloadedDate", "com.apple.metadata:kMDItemWhereFroms", "com.apple.quarantine"]
10input.related{}.files{}.changedFile change dateInteger1632496484
11input.related{}.files{}.createdFile create date Integer1632496484
12input.related{}.files{}.sha1hex SHA-1 hash file hex stringString39655008a0a72cabf6d488cd0dcfb37e9883e0b8
13input.related{}.files{}.accessedFile last accessed dateInteger1632496484
14input.related{}.files{}.modifiedFile last modified date Integer1632496484
15input.related{}.files{}.sha256hexSHA-256 hash file hex stringStringca43054c05867b673d980bbcc97215d7ebaed5465ad1266eea4c776188bbd385
16input.related{}.files{}.isDownloadInternet downloaded file validation Booleantrue
17input.related{}.files{}.isAppBundleApp bundle directory file validation Booleantrue
18input.related{}.files{}.isDirectoryDirectory file validation Booleantrue
19input.related{}.files{}.signingInfo{}File signing information arrayInteger, String
{ 
"status": -67062, 
"authorities": [], 
"teamid": "", 
"signerType": 4, 
"statusMessage": "code object is not signed at all", 
"entitlements": [], 
"appid": "" 
},
20input.related{}.files{}.signingInfo.appidFile identifierStringGoogleChrome-97.0.4692.99-GGRO
21input.related{}.files{}.signingInfo.cdhashFile code directory hashStringWApZMfx1x99D8eRQhUFeID4YZDY=
22input.related{}.files{}.signingInfo.teamidDevelopment team signer identifierStringEQHXZ8M8AV
23input.related{}.files{}.signingInfo.signerTypeObject signature type and implicit trust levelInteger2
24input.related{}.files{}.signingInfo.authoritiesSignature signing authorities arrayString["Developer ID Application: Google, Inc. (EQHXZ8M8AV)", "Developer ID Certification Authority", "Apple Root CA"]
25input.related{}.files{}.signingInfo.entitlementsFile granted entitlements arrayStringcom.apple.rootless.restricted-block-devices
26input.related{}.files{}.isScreenShotScreenshot image file validation Booleantrue
27input.related{}.files{}.downloadedFromFile download locations arrayStringhttps://files.jamf.com

GPFSEvent

File System Events
#Field NameDescriptionData TypeExample Value
1input.match{}.event.devFile system event device IDs Integer16777233
2input.match{}.event.gidFile group identifier Integer0
3input.match{}.event.pidFile process identifier (PID) Integer96657
4input.match{}.event.uidFile user identifier Integer0
5input.match{}.event.pathFile path String/Library/LaunchDaemons/com.jamfsoftware.task.checkForTasks.plist
6input.match{}.event.typeFile system eventsInteger
  • 0 = Created
  • 1 = Deleted
  • 3 = Renamed
  • 4 = Modified
  • 7 = Created directory
7input.match{}.event.iNodeFile inode identifierInteger3493490
8input.match{}.event.eventIDFile system event identifier Integer62816
9input.match{}.event.prevFileFile rename operation previous path String/Library/LaunchDaemons/.dat.nosync7991.BW4gMk
10input.related{}.files{}.gidFile system operation group identifierInteger0
11input.related{}.files{}.uidFile system operation user identifierInteger0
12input.related{}.files{}.fsidFile FSIDInteger16777234
13input.related{}.files{}.modeFiletype and modeInteger33188
14input.related{}.files{}.pathFile pathString/Library/LaunchDaemons/com.jamfsoftware.task.checkForTasks.plist
15input.related{}.files{}.sizeFile sizeInteger0
16input.related{}.files{}.inodeFile inode identifierInteger7174457
17input.related{}.files{}.xattrsFile extended attributes arrayString["com.apple.quarantine"]
18input.related{}.files{}.changedFile change dateInteger1632496484
19input.related{}.files{}.createdFile create dateInteger1632496484
20input.related{}.files{}.sha1hex SHA-1 hash file hex stringString39655008a0a72cabf6d488cd0dcfb37e9883e0b8
21input.related{}.files{}.accessedFile access dateInteger1632496484
22input.related{}.files{}.modifiedFile modify dateInteger1632496484
23input.related{}.files{}.sha256hex SHA-256 hash file hex stringStringca43054c05867b673d980bbcc97215d7ebaed5465ad1266eea4c776188bbd385"
24input.related{}.files{}.isDownloadInternet downloaded file validation Booleanfalse
25input.related{}.files{}.isAppBundleApp bundle directory file validationBooleanfalse
26input.related{}.files{}.isDirectoryDirectory file validation Booleanfalse
27input.related{}.files{}.signingInfo{}File signing information arrayArray
{ 
"status": -67062, 
"authorities": [], 
"teamid": "", 
"signerType": 4, 
"statusMessage": "code object is not signed at all", 
"entitlements": [], 
"appid": "" 
},
28input.related{}.files{}.signingInfo.appidFile identifierStringcom.googlecode.iterm2
29input.related{}.files{}.signingInfo.cdhashFile code directory hashStringJmJW/m4Oafwj3PRZh8QspKxDUYw=
30input.related{}.files{}.signingInfo.teamidDevelopment team signer identifierStringAQPZ6F3ASY
31input.related{}.files{}.signingInfo.signerTypeObject signature type and implicit trust levelInteger
  • 0 = Apple
  • 1 = App Store
  • 2 = Developer
  • 3 = Ad hoc
  • 4 = Unsigned
32input.related{}.files{}.signingInfo.authoritiesSignature signing authorities arrayArray
[
            "Software Signing",
            "Apple Code Signing Certification Authority",
            "Apple Root CA"
          ]
33input.related{}.files{}.signingInfo.entitlementsFile entitlements arrayArraycom.apple.private.security.clear-library-validation
34input.related{}.files{}.isScreenShotScreenshot image file validation Booleantrue
35input.related{}.files{}.downloadedFromFile download locations array String https://files.jamf.com

GPProcessEvent

Monitors processes that are launched or terminated on computers.

#Field NameDescriptionData TypeExample Value
1input.match{}.event.pidProcess event identifierInteger 96657
2input.match{},event.typeProcess activityInteger 1
3input.match{},event.subTypeDetailed process activityInteger23

GPKeylogRegisterEvent

Monitors for new "event tap" registrations via the Core Graphics framework on macOS. Core Graphic event taps are often used by certain types of keylogging and accessibility software.

#Field NameDescriptionData TypeExample Value
1input.match{}.event{}.optionsOptions set when key tap for log was registered.String
  • defaultTap = Default tap
  • listenOnly = Listen only
2input.match{}.event{}.sourcePIDSource process ID (key tap for log registration request)Integer86939
3input.match{}.event{}.destinationPIDDestination process ID (key tap for log registration request)Integer0

GPGatekeeperEvent

Monitors actions and logs from Gatekeeper, Apple's built-in feature for enforcing code signing and verifying downloaded apps before opening them.

#Field NameDescriptionData TypeExample Value
1input.match{}.event{}.pidProcess ID (GateKeeper event) Integer39357
2input.match{}.event{}.name Event nameStringCrashReporter
3input.match{}.event{}.pathProcess path (GateKeeper event) String/Library/LaunchDaemons/com.jamfsoftware.task.checkForTasks.plist
4input.match{}.event{}.senderLog message senderStringAppleSystemPolicy
5input.match{}.event{}.processLog message sender processStringkernel
6input.match{}.event{}.categoryLogging categoryStringXPEvent.structured
7input.match{}.event{}.subsystemLogging subsystemStringcom.apple.XProtectFramework.PluginAPI
8input.match{}.event{}.composedMessageLog messageString
ASP: Security policy would not allow process: 30659, /Applications/JamfComplianceReporter.app/Contents/Helpers/JamfComplianceReporterAgent.app/Contents/MacOS/JamfComplianceReporterAgent
9input.match{}.event{}.senderImagePathImage path (log message sender)String/System/Library/Extensions/AppleSystemPolicy.kext/Contents/MacOS/AppleSystemPolicy
10input.match{}.event{}.processImagePathProcess path (log message sender)String/kernel
11input.match{}.event{}.processIdentifierProcess ID (log message sender)Integer0
12input.match{}.facts{}.nameAlert name StringGatekeeperBlockedSigned

GPMRTEvent

Monitors actions and logs from Malware Removal Tool (MRT), Apple's built-in application responsible for removing targeted files from macOS.

#Field NameDescriptionData TypeExample Value
1input.match{}.event{}.pidProcess ID (GateKeeper event)Integer96657
2input.match{}.event{}.nameEvent nameStringJamfComplianceReporterAgent
3input.match{}.event{}.pathProcess path (GateKeeper event) String/Library/LaunchDaemons/com.jamfsoftware.task.checkForTasks.plist
4input.match{}.event{}.senderLog message senderStringAppleSystemPolicy
5input.match{}.event{}.processLog message sender processStringkernel
6input.match{}.event{}.categoryLogging categoryStringXPEvent.structured
7input.match{}.event{}.subsystemLogging subsystemStringcom.apple.XProtectFramework.PluginAPI
8input.match{}.event{}.composedMessageLog messageString ASP: Security policy would not allow process: 30659, /Applications/JamfComplianceReporter.app/Contents/Helpers/JamfComplianceReporterAgent.app/Contents/MacOS/JamfComplianceReporterAgent"
9input.match{}.event{}.senderImagePathImage path (log message sender)String/System/Library/Extensions/AppleSystemPolicy.kext/Contents/MacOS/AppleSystemPolicy
10input.match{}.event{}.processImagePathProcess path (log message sender)String/kernel
11input.match{}.event{}.processIdentifierProcess ID (log message sender)Integer0
12input.match{}.facts{}.nameSpearphishOfficeWritesExecutableResearchStringLaunchDaemon

GPPreventedExecutionEvent

Custom Prevent List Events
#Field NameDescriptionData TypeExample Value
1input.match{}.event{}.blockedWas app blockedBooleantrue
2input.match{}.event{}.matchTypeMatching methodStringsigningID
3input.match{}.event{}.matchValuePrevented app nameStringscriptingosx.desktoppr
4input.match{}.event{}.process{}.gidProcess effective group identifierInteger20
5input.match{}.event{}.process{}.pidProcess identifier (process)Integer40990
6input.match{}.event{}.process{}.uidProcess effective user identifier Integer501
7input.match{}.event{}.process{}.argsPossible arguments passed by process arrayString
[
          "/tmp/PKInstallSandbox.nVjzpr/Scripts/com.jamf.ce.Wallpaper.43ZvSw/desktoppr",
          "/Library/Desktop Pictures/wallpaper.heic"
        ]
          "/tmp/PKInstallSandbox.nVjzpr/Scripts /com.jamf.ce.Wallpaper.43ZvSw/desktoppr",
          "/Library/Desktop Pictures/wallpaper.heic"
        ]
8input.match{}.event{}.process{}.nameProcess nameStringdesktoppr
9input.match{}.event{}.process{}.pathProcess pathString/tmp/PKInstallSandbox.nVjzpr/Scripts/com.jamf.ce.Wallpaper.43ZvSw/desktoppr
10input.match{}.event{}.process{}.pgidProcess group identifierInteger40990
11input.match{}.event{}.process{}.rgidProcess real group identifierInteger20
12input.match{}.event{}.process{}.ruidProcess real user identifierInteger501
13input.match{}.event{}.process{}.uuidEvent unique identifierStringade83c7a-2eaa-4bd3-b468-d1643483746f
14input.match{}.event{}.process{}.signingInfo{}Process signing information arrayInteger, String
[
          "appid": "com.scriptingosx.desktoppr",
          "cdhash": "oA74w5FQMn1N1G7k1Ar0lyClqu8=",
          "status": 0,
          "teamid": "JME5BW3F3R",
          "signerType": 2,
          "authorities": [
            "Developer ID Application: Jon Smith (JME5BW3F3R)",
            "Developer ID Certification Authority",
            "Apple Root CA"
          ]
15input.match{}.event{}.process{}.signingInfo{}.appidIdentifier (process)Stringcom.scriptingosx.desktoppr
16input.match{}.event{}.process{}.signingInfo{}.cdhashProcess code directory hashStringoA74w5FQMn1N1G7k1Ar0lyClqu8=
17input.match{}.event{}.process{}.signingInfo{}.statusSigning information retrieval statusInteger
  • 0 = Apple
  • 1 = App Store
  • 2 = Developer
  • 3 = Ad Hoc
  • 4 = Unsigned
18input.match{}.event{}.process{}.signingInfo{}.teamidProcess development team signer identifierStringJME5BW3F3R
19input.match{}.event{}.process{}.signingInfo{}.signerTypeSignature type and implicit trust levelInteger
  • 0 = Apple
  • 1 = App Store
  • 2 = Developer
  • 3 = Ad Hoc
  • 4 = Unsigned
20input.match{}.event{}.process{}.signingInfo{}.authoritiesSignature signing authorities arrayString
[
            "Developer ID Application: Jon Smith (JME5BW3F3R)",
            "Developer ID Certification Authority",
            "Apple Root CA"
          ]
21input.match{}.event{}.process{}.signingInfo{}.entitlementsProcess granted entitlements arrayStringcom.apple.private.security.clear-library-validation
22input.match{}.event{}.process{}.signingInfo{}.statusMessageSigning information retrieval status codeStringNo error.
23input.match{}.event{}.process{}.startTimestampProcess starting timestampInteger1668431165
24input.match{}.event{}.process{}.orginalParentPIDParent process identifierInteger1

GPThreatMatchExecEvent

Threat Prevention Events
#Field NameDescriptionData TypeExample Value
1input.match{}.event{}.blockedWas threat blockedBooleantrue
2input.match{}.event{}.matchTypeDatabase matchingStringThreat Signature
3input.match{}.event{}.matchValueThreat nameStringapplejeus_jmt_a
4input.match{}.event{}.scriptPathScript pathString/tmp/CrashReporter.sh
5input.match{}.event{}.process{}.gidEffective group executing process identifierInteger0
6input.match{}.event{}.process{}.pidProcess identifier (process)Integer39356
7input.match{}.event{}.process{}.uidEffective user executing process identifierInteger0
8input.match{}.event{}.process{}.argsProcess passed optional arguments arrayString
[
          "/Library/JMTTrader/CrashReporter",
          "Maintain"
        ]
9input.match{}.event{}.process{}.nameProcess nameStringCrashReporter
10input.match{}.event{}.process{}.pathProcess pathString/Library/radar/CrashReporter
11input.match{}.event{}.process{}.pgidProcess group identifierInteger39356
12input.match{}.event{}.process{}.rgidReal group executing process identifierInteger0
13input.match{}.event{}.process{}.ruidReal user executing process identifierInteger0
14input.match{}.event{}.process{}.uuidEvent unique identifierString3a842375-29f4-4516-8c8e-aca148c3ab32
15input.match{}.event{}.process{}.signingInfo{}Process signing information arrayInteger, String
{
          "appid": "com.microsoft.autoupdate.helper",
          "cdhash": "l+/pmKVmSUighiu5PFt6q4t4pfs=",
          "status": 0,
          "teamid": "UBF8T346G9",
          "signerType": 2,
          "authorities": [
            "Developer ID Application: Microsoft Corporation (UBF8T346G9)",
            "Developer ID Certification Authority",
            "Apple Root CA"
          ],
          "entitlements": [],
          "statusMessage": "No error.",
          "informationStage": "extended"
        }
16input.match{}.event{}.process{}.signingInfo{}.appidIdentifier (process)Stringcom.scriptingosx.desktoppr
17input.match{}.event{}.process{}.signingInfo{}.cdhashProcess code directory hashStringoA74w5FQMn1N1G7k1Ar0lyClqu8=
18input.match{}.event{}.process{}.signingInfo{}.statusSigning information retrieval statusInteger-67068
19input.match{}.event{}.process{}.signingInfo{}.teamid Process development team signing identifierStringJME5BW3F3R
20input.match{}.event{}.process{}.signingInfo{}.signerTypeObject signature type and implicit trust levelInteger
  • 0 = Apple
  • 1 = App Store
  • 2 = Developer
  • 3 = Ad hoc
  • 4 = Unsigned
21input.match{}.event{}.process{}.signingInfo{}.authoritiesSignature signing authorities arrayString
[
            "Developer ID Application: Jon Smith (JME5BW3F3R)",
            "Developer ID Certification Authority",
            "Apple Root CA"
          ]
22input.match{}.event{}.process{}.signingInfo{}.entitlementsProcess granted entitlements arrayStringcom.apple.private.security.clear-library-validation
23input.match{}.event{}.process{}.signingInfo{}.statusMessageSigning information retrieval translated status codeStringcannot find code object on disk
24input.match{}.event{}.process{}.startTimestampProcess starting timestampInteger1668430737
25input.match{}.event{}.process{}.orginalParentPIDParent process identifierInteger1
26input.match.facts{}.versionEndpoint threat prevention versionInteger11568

GPUnifiedLogEvent

Unified Log Events
#Field NameDescriptionData TypeExample Value
1input.match{}.event{}.senderLog message senderStringXProtectRadarSecurity
2input.match{}.event{}.processLog message sender processStringXProtectRadarSecurity
3input.match{}.event{}.categoryLogging categoryStringXPEvent.structured
4input.match{}.event{}.subsystemLogging subsystemStringcom.apple.XProtectFramework.PluginAPI
5input.match{}.event{}.composedMessageLog messageString{\"caused_by\":[],\"status_message\":\"NoThreatDetected\",\"status_code\":20,\"execution_duration\":0.7135159969329834}
6input.match{}.event{}.senderImagePath Log message sender image pathString/Library/Apple/System/Library/CoreServices/XProtect.app/Contents/MacOS/XProtectRadarSecurity
7input.match{}.event{}.processImagePath Log message sender process pathString/Library/Apple/System/Library/CoreServices/XProtect.app/Contents/MacOS/XProtectRLibrary/Apple/System/Library/CoreServices/XProtect.app/Contents/MacOS/XProtectRadarSecurity
8input.match{}.event{}.processIdentifierLog message sender process IDInteger6925

GPUSBEvent

Monitors USB devices inserted into computers.

#Field NameDescriptionData TypeExample Value
1input.match.typeUSB event typeInteger
  • 0 = Device inserted
  • 1 = Device removed
2input.match.usbAddressUSB addressInteger6
3input.match{}.device{}.mediaPathMedia pathStringIODeviceTree:/PCI0@0/RP05@1C,4/UPSB@0/DSB2@2/XHC2@0/@1:0
4input.match{}.device{}.protocolProtocolStringUSB
5input.match{}.device{}.deviceModelModelStringUltra USB 3.0
6input.match{}.device{}.isRemovableRemovableBooleantrue
7input.match{}.device{}.mediaNameMedia nameStringSanDisk Ultra USB 3.0 Media
8input.match{}.device{}.bsdMinorBSD minorInteger11
9input.match{}.device{}.vendorNameUSB device vendorStringApple Inc.
10input.match{}.device{}.isWholeWholeBooleanfalse
11input.match{}.device{}.unitUnitInteger1
12input.match{}.device{}.deviceSubclassUSB device subclassInteger0
13input.match{}.device{}.serialNumberUSB device serial numberStringFM79997PJ3VYB7+SET
14input.match{}.device{}.bsdUnitBSD unitInteger2
15input.match{}.device{},busPathBus pathStringIODeviceTree:/PCI0@0/RP05@1C,4/UPSB@0/DSB2@2/XHC2@0
16input.match{}.device{}.isLeafLeafBooleantrue
17input.match{}.device{}.isInternalInternalBooleantrue
18input.match{}.device{}.busNamebusNameStringXHC2
19input.match{}.device{}.bsdMajorBSD majorInteger1
20input.match{}.device{}.isEjectableEjectableBooleantrue
21input.match{}.device{}.isEncryptedEncryptedBooleantrue
22input.match{}.device{}.devicePathDevice pathStringIOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/RP05@1C,4/IOPP/UPSB@0/IOPP/DSB2@2/IOPP/XHC2@0/XHC2@00000000/SSP1@00100000/Ultra USB 3.0@00100000/IOUSBHostInterface@0/IOUSBMassStorageInterfaceNub/IOUSBMassStorageDriverNub/IOUSBMassStorageDriver/IOSCSILogicalUnitNub@0/IOSCSIPeripheralDeviceType00/IOBlockStorageServices
23input.match{}.device{}.bsdNameBSD nameStringdisk2
24input.match{}.device{}.vendorIdUSB device vendor identifierString0x05ac
25input.match{}.device{}.contentDevice contentStringGUID_partition_scheme
26input.match{}.device{}.revisionDevice revisionString1.00
27input.match{}.device{}.sizeDevice sizeInteger15376000000
28input.match{}.device{}.isNetworkVolumeNetwork volumeBooleantrue
29input.match{}.device{}.blocksizeBlock sizeInteger512
30input.match{}.device{}.productNameUSB product nameStringApple Internal Keyboard / Trackpad
31input.match{}.device{}.mediaKindMedia kindStringIOMedia
32input.match{}.device{}.isWritableDevice writableBooleantrue
33input.match{}.device{}.productIdUSB device product identifierString0x027b
34input.match{}.device{}.deviceClassUSB device classInteger0
35input.match{}.device{}.encryptionDetailEncryption detailInteger0