AUE_ssauthmech

Authentication Mechanism (Mecanismo de autenticación)

El mecanismo de autenticación se genera cuando se usa el mecanismo de autenticación de un servicio de seguridad, normalmente para elevar los permisos.

Log Level (Nivel de registro)

1

Requiere ajuste detallado.

Sí

Ejemplo de AUE_ssauthmech

Este es un ejemplo de registro de telemetría para un evento de mecanismo de autenticación.

{
  "exec_chain": {
    "uuid": "EF8EBCA2-70C4-4E04-836B-BF393C961575"
  },
  "exec_chain_child": {
    "parent_path": "/sbin/launchd",
    "parent_pid": 1,
    "parent_uuid": "4AB281FE-6D4A-4E79-8508-E91FCA39BA02"
  },
  "header": {
    "time_seconds_epoch": 1657906213,
    "time_milliseconds_offset": 67,
    "version": 11,
    "event_modifier": 0,
    "event_id": 45030,
    "event_name": "AUE_ssauthmech"
  },
  "host_info": {
    "serial_number": "C03WG0H4HDTS",
    "host_name": "Test_MacBook_Pro",
    "osversion": "Version 12.4 (Build 21F79)",
    "host_uuid": "8891C1E2-0AC0-4E4A-844B-EA491B14D115"
  },
  "identity": {
    "signer_id": "com.apple.authd",
    "team_id_truncated": false,
    "signer_id_truncated": false,
    "cd_hash": "1cca9f67041916be9f31c171936ebd700c73f55e",
    "team_id": "",
    "signer_type": 1
  },
  "key": "C7BC9893-7A8A-4665-ACED-1A8DC1D12A83",
  "return": {
    "error": 1,
    "description": "failure: Operation not permitted",
    "return_value": 1
  },
  "subject": {
    "session_id": 100003,
    "group_id": 20,
    "process_name": "/System/Library/PreferencePanes/SharingPref.prefPane/Contents/XPCServices/com.apple.preferences.sharing.remoteservice.xpc/Contents/MacOS/com.apple.preferences.sharing.remoteservice",
    "parent_pid": 1,
    "effective_user_name": "jamf",
    "user_id": 501,
    "group_name": "staff",
    "parent_uuid": "4AB281FE-6D4A-4E79-8508-E91FCA39BA02",
    "uuid": "EF8EBCA2-70C4-4E04-836B-BF393C961575",
    "effective_group_id": 20,
    "process_hash": "5c0d6b0fbe4c423c3b39035df68acec0f0e58eb8",
    "audit_id": 501,
    "responsible_process_id": 1750,
    "parent_path": "/sbin/launchd",
    "process_id": 1763,
    "effective_group_name": "staff",
    "audit_user_name": "jamf",
    "effective_user_id": 501,
    "terminal_id": {
      "type": 4,
      "ip_address": "0.0.0.0",
      "port": 4448
    },
    "responsible_process_name": "/System/Applications/System Preferences.app/Contents/MacOS/System Preferences",
    "user_name": "jamf"
  },
  "texts": [
    "com.apple.opendirectoryd.linkidentity",
    "mechanism builtin:entitled,privileged"
  ]
}