AUE_GETAUID

Get AUID (Obtener AUID)

El registro de obtención de AUID se genera cuando se usa una llamada al sistema para determinar el ID de usuario en vigor de un proceso. Esta información se utiliza para determinar para qué recurso tiene el proceso autorización de acceso.

Log Level (Nivel de registro)

1

Requiere ajuste detallado.

No

Ejemplo de AUE_GETAUID

Este es un ejemplo de registro de telemetría para un evento de obtener AUID.

{
  "exec_chain": {
    "uuid": "D45A43D9-E6F9-4641-918E-08F3F204649B"
  },
  "exec_chain_child": {
    "parent_path": "/sbin/launchd",
    "parent_pid": 1,
    "parent_uuid": "4AB281FE-6D4A-4E79-8508-E91FCA39BA02"
  },
  "header": {
    "time_seconds_epoch": 1657906962,
    "time_milliseconds_offset": 376,
    "version": 11,
    "event_modifier": 0,
    "event_id": 130,
    "event_name": "AUE_GETAUID"
  },
  "host_info": {
    "serial_number": "C03WG0H4HDTS",
    "host_name": "Test_MacBook_Pro",
    "osversion": "Version 12.4 (Build 21F79)",
    "host_uuid": "8891C1E2-0AC0-4E4A-844B-EA491B14D115"
  },
  "identity": {
    "signer_id": "com.apple.loginwindow",
    "team_id_truncated": false,
    "signer_id_truncated": false,
    "cd_hash": "c1e628cea8d99f35c367658373c85c5fa6da086f",
    "team_id": "",
    "signer_type": 1
  },
  "key": "4DBDAA85-56F8-4723-A832-620067DB9BF2",
  "return": {
    "error": 0,
    "description": "success",
    "return_value": 0
  },
  "subject": {
    "session_id": 100003,
    "group_id": 20,
    "process_name": "/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow",
    "parent_pid": 1,
    "effective_user_name": "jamf",
    "user_id": 0,
    "group_name": "staff",
    "parent_uuid": "4AB281FE-6D4A-4E79-8508-E91FCA39BA02",
    "uuid": "D45A43D9-E6F9-4641-918E-08F3F204649B",
    "effective_group_id": 20,
    "process_hash": "4b2779fead757431ec1e2c60f479c8a86ad744fe",
    "audit_id": 501,
    "responsible_process_id": 148,
    "parent_path": "/sbin/launchd",
    "process_id": 148,
    "effective_group_name": "staff",
    "audit_user_name": "jamf",
    "effective_user_id": 501,
    "terminal_id": {
      "type": 4,
      "ip_address": "0.0.0.0",
      "port": 50331650
    },
    "responsible_process_name": "/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow",
    "user_name": "root"
  }
}